Fix PostgreSQL migration bugs

.github/workflows/pr.yaml

@@ -22,6 +22,8 @@ env:
   # space separated list of charts that we want to use a pullSecret for
   CHART_EXCLUSIONS: "sqnc-identity-service"
   # comma-separated list of charts to exclude from the workflow; paths-ignore will only skip if ALL paths in the PR are matching
+  CHART_CONSUMERS: "veritable-ui"
+  # comma-separated list of charts to be considered as downstream consumers and have additional dependencies installed first
 
 jobs:
   helm-testing:
@@ -105,6 +107,13 @@ jobs:
         helm install cnpg cnpg/cloudnative-pg --wait --namespace cnpg --create-namespace
       if: steps.list-changed.outputs.changed == 'true'
 
+    - name: Install upstream DC charts for consumers
+      run: |
+        helm install veritable-cloudagent digicatapult/veritable-cloudagent --wait --namespace default
+      if: |
+        steps.list-changed.outputs.changed == 'true' &&
+        contains('veritable-ui', env.CHART_CONSUMERS)
+
     - name: Run chart-testing (install)
       run: |
         ct install \

charts/veritable-cloudagent/Chart.yaml

@@ -27,4 +27,4 @@ maintainers:
 name: veritable-cloudagent
 sources:
   - https://github.com/digicatapult/veritable-cloudagent
-version: 3.0.50
+version: 3.0.51

charts/veritable-cloudagent/README.md

@@ -364,13 +364,13 @@ Digital Catapult will release a new chart updating its containers if a new versi
 
 ### Ingress
 
-This chart provides support for Ingress resources. If you have an ingress controller installed on your cluster, such as [nginx-ingress-controller](https://github.com/bitnami/charts/tree/main/bitnami/nginx-ingress-controller) or [contour](https://github.com/bitnami/charts/tree/main/bitnami/contour) you can utilize the ingress controller to serve your application.
+This chart provides support for Ingress resources. If you have an ingress controller installed on your cluster, such as [ingress-nginx](https://github.com/kubernetes/ingress-nginx/tree/main/charts/ingress-nginx) or [contour](https://github.com/bitnami/charts/tree/main/bitnami/contour) you can utilize the ingress controller to serve your application.
 
-To enable Ingress integration, set `ingress.enabled` to `true`. The `ingress.hostname` property can be used to set the host name. The `ingress.tls` parameter can be used to add the TLS configuration for this host. It is also possible to have more than one host, with a separate TLS configuration for each host. [Learn more about configuring and using Ingress](https://docs.bitnami.com/kubernetes/apps/veritable-cloudagent/configuration/configure-use-ingress/).
+To enable Ingress integration, set `ingress.enabled` to `true`. The `ingress.hostname` property can be used to set the host name. The `ingress.tls` parameter can be used to add the TLS configuration for this host. It is also possible to have more than one host, with a separate TLS configuration for each host. [Learn more about configuring and using Ingress](https://kubernetes.io/docs/concepts/services-networking/ingress/).
 
 ### TLS secrets
 
-The chart also facilitates the creation of TLS secrets for use with the Ingress controller, with different options for certificate management. [Learn more about TLS secrets](https://docs.bitnami.com/kubernetes/apps/veritable-cloudagent/administration/enable-tls/).
+The chart also facilitates the creation of TLS secrets for use with the Ingress controller, with different options for certificate management. [Learn more about TLS secrets](https://kubernetes.io/docs/concepts/services-networking/ingress/#tls).
 
 ### Additional environment variables
 
@@ -386,7 +386,7 @@ Alternatively, you can use a ConfigMap or a Secret with the environment variable
 
 ### Sidecars
 
-If additional containers are needed in the same pod as veritable-cloudagent (such as additional metrics or logging exporters), they can be defined using the `sidecars` parameter. If these sidecars export extra ports, extra port definitions can be added using the `service.extraPorts` parameter. [Learn more about configuring and using sidecar containers](https://docs.bitnami.com/kubernetes/apps/veritable-cloudagent/administration/configure-use-sidecars/).
+If additional containers are needed in the same pod as veritable-ui (such as additional metrics or logging exporters), they can be defined using the `sidecars` parameter. If these sidecars export extra ports, extra port definitions can be added using the `service.extraPorts` parameter. [Learn more about configuring and using sidecar containers](https://cloudnative-pg.io/docs/1.26/cnpg_i#sidecar-container).
 
 ### Pod affinity
 
@@ -396,7 +396,7 @@ As an alternative, use one of the preset configurations for pod affinity, pod an
 
 ## Troubleshooting
 
-Find more information about how to deal with common errors related to Bitnami's Helm charts in [this troubleshooting guide](https://docs.bitnami.com/general/how-to/troubleshoot-helm-chart-issues).
+Find more information about how to deal with common errors related to CloudNativePG's Helm charts in [this troubleshooting guide](https://cloudnative-pg.io/docs/1.26/troubleshooting/).
 
 ## License
 
@@ -406,7 +406,7 @@ Copyright © 2023 Digital Catapult
 
 ### Attribution
 
-This chart is adapted from The [charts](<(https://github.com/bitnami/charts)>) provided by [Bitnami](https://bitnami.com/) which are licensed under the Apache v2.0 License which is reproduced here:
+This chart is adapted from The [charts](<(https://github.com/cloudnative-pg/charts)>) provided by [CloudNativePG](https://cloudnative-pg.io/) which are licensed under the Apache v2.0 License which is reproduced here:
 
 ```
 Licensed under the Apache License, Version 2.0 (the "License");

charts/veritable-cloudagent/ci/ct-values.yaml

@@ -1 +1,7 @@
+fullnameOverride: veritable-cloudagent
 isNginxIngressController: true
+cnpg:
+  cluster:
+    initdb:
+      secret:
+        name: veritable-cloudagent-cnpg-superuser

charts/veritable-cloudagent/templates/_helpers.tpl

@@ -132,7 +132,7 @@ Return the CNPG secret name
 {{- define "veritable-cloudagent.databaseSecretName" -}}
 {{- if .Values.cnpg.enabled -}}
   {{- $secret := .Values.cnpg.cluster.initdb.secret | default dict }}
-  {{- $secretName := $secret.name | default (printf "%s-cnpg-app" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-") }}
+  {{- $secretName := $secret.name | default (printf "%s-cnpg-superuser" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-") }}
   {{- $secretName -}}
 {{- else -}}
     {{- default (printf "%s-externaldb" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-") (tpl .Values.externalDatabase.existingSecret $) -}}

charts/veritable-cloudagent/templates/secret-cnpg-app.yaml → charts/veritable-cloudagent/templates/secret-cnpg-app-user.yaml

@@ -4,7 +4,7 @@
 apiVersion: v1
 kind: Secret
 metadata:
-  name: {{ printf "%s-cnpg-app" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" }}
+  name: {{ printf "%s-cnpg-app-user" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" }}
   namespace: {{ .Release.Namespace | quote }}
   labels: {{- include "common.labels.standard" . | nindent 4 }}
     app.kubernetes.io/component: veritable-cloudagent

charts/veritable-cloudagent/values.yaml

@@ -1060,7 +1060,7 @@ externalDatabase:
       # database: example
       # owner: example-owner
       # secret:
-        # name: example-cnpg-app
+        # name: example-cnpg-superuser
       # options: []
       # encoding: UTF8
       # postInitSQL:
@@ -1083,6 +1083,8 @@ cnpg:
     initdb:
       database: veritable-cloudagent
       owner: postgres
+      secret:
+        name: veritable-cloudagent-cnpg-superuser
     instances: 1
     storage:
       size: 5Gi

charts/veritable-ui/Chart.lock

@@ -4,9 +4,9 @@ dependencies:
   version: 0.5.0
 - name: common
   repository: https://charts.bitnami.com/bitnami
-  version: 2.31.4
+  version: 2.36.0
 - name: veritable-cloudagent
   repository: https://digicatapult.github.io/helm-charts
-  version: 2.4.59
-digest: sha256:f84c0d684df504390c4cad4415326228e2f092d1e243be817c42f3971cdc714f
-generated: "2025-12-14T23:09:13.208629202Z"
+  version: 3.0.49
+digest: sha256:092778f91680722f08d9d42acae88c59ba2f0fbb2f99b71eb91c246a6cc19fa9
+generated: "2026-02-23T12:56:19.68431Z"

charts/veritable-ui/Chart.yaml

@@ -18,7 +18,7 @@ dependencies:
   - name: veritable-cloudagent
     condition: cloudagent.enabled
     repository: https://digicatapult.github.io/helm-charts
-    version: 2.4.59
+    version: 3.x.x
     alias: cloudagent
 description: The veritable user interface for managing connections
 home: https://github.com/digicatapult/veritable-ui
@@ -31,4 +31,4 @@ maintainers:
 name: veritable-ui
 sources:
   - https://github.com/digicatapult/veritable-ui
-version: 2.0.49
+version: 2.0.50

charts/veritable-ui/README.md

@@ -330,13 +330,13 @@ Digital Catapult will release a new chart updating its containers if a new versi
 
 ### Ingress
 
-This chart provides support for Ingress resources. If you have an ingress controller installed on your cluster, such as [nginx-ingress-controller](https://github.com/bitnami/charts/tree/main/bitnami/nginx-ingress-controller) or [contour](https://github.com/bitnami/charts/tree/main/bitnami/contour) you can utilize the ingress controller to serve your application.
+This chart provides support for Ingress resources. If you have an ingress controller installed on your cluster, such as [ingress-nginx](https://github.com/kubernetes/ingress-nginx/tree/main/charts/ingress-nginx) or [contour](https://github.com/bitnami/charts/tree/main/bitnami/contour) you can utilize the ingress controller to serve your application.
 
-To enable Ingress integration, set `ingress.enabled` to `true`. The `ingress.hostname` property can be used to set the host name. The `ingress.tls` parameter can be used to add the TLS configuration for this host. It is also possible to have more than one host, with a separate TLS configuration for each host. [Learn more about configuring and using Ingress](https://docs.bitnami.com/kubernetes/apps/veritable-ui/configuration/configure-use-ingress/).
+To enable Ingress integration, set `ingress.enabled` to `true`. The `ingress.hostname` property can be used to set the host name. The `ingress.tls` parameter can be used to add the TLS configuration for this host. It is also possible to have more than one host, with a separate TLS configuration for each host. [Learn more about configuring and using Ingress](https://kubernetes.io/docs/concepts/services-networking/ingress/).
 
 ### TLS secrets
 
-The chart also facilitates the creation of TLS secrets for use with the Ingress controller, with different options for certificate management. [Learn more about TLS secrets](https://docs.bitnami.com/kubernetes/apps/veritable-ui/administration/enable-tls/).
+The chart also facilitates the creation of TLS secrets for use with the Ingress controller, with different options for certificate management. [Learn more about TLS secrets](https://kubernetes.io/docs/concepts/services-networking/ingress/#tls).
 
 ### Additional environment variables
 
@@ -352,7 +352,7 @@ Alternatively, you can use a ConfigMap or a Secret with the environment variable
 
 ### Sidecars
 
-If additional containers are needed in the same pod as veritable-ui (such as additional metrics or logging exporters), they can be defined using the `sidecars` parameter. If these sidecars export extra ports, extra port definitions can be added using the `service.extraPorts` parameter. [Learn more about configuring and using sidecar containers](https://docs.bitnami.com/kubernetes/apps/veritable-ui/administration/configure-use-sidecars/).
+If additional containers are needed in the same pod as veritable-ui (such as additional metrics or logging exporters), they can be defined using the `sidecars` parameter. If these sidecars export extra ports, extra port definitions can be added using the `service.extraPorts` parameter. [Learn more about configuring and using sidecar containers](https://cloudnative-pg.io/docs/1.26/cnpg_i#sidecar-container).
 
 ### Pod affinity
 
@@ -362,7 +362,7 @@ As an alternative, use one of the preset configurations for pod affinity, pod an
 
 ## Troubleshooting
 
-Find more information about how to deal with common errors related to Bitnami's Helm charts in [this troubleshooting guide](https://docs.bitnami.com/general/how-to/troubleshoot-helm-chart-issues).
+Find more information about how to deal with common errors related to CloudNativePG's Helm charts in [this troubleshooting guide](https://cloudnative-pg.io/docs/1.26/troubleshooting/).
 
 ## License
 
@@ -372,7 +372,7 @@ Copyright © 2023 Digital Catapult
 
 ### Attribution
 
-This chart is adapted from The [charts](<(https://github.com/bitnami/charts)>) provided by [Bitnami](https://bitnami.com/) which are licensed under the Apache v2.0 License which is reproduced here:
+This chart is adapted from The [charts](<(https://github.com/cloudnative-pg/charts)>) provided by [CloudNativePG](https://cloudnative-pg.io/) which are licensed under the Apache v2.0 License which is reproduced here:
 
 ```
 Licensed under the Apache License, Version 2.0 (the "License");

charts/veritable-ui/ci/ct-values.yaml

@@ -1,8 +1,11 @@
+fullnameOverride: veritable-ui
 invitationPin:
   secret: blah
 cloudagent:
-  enabled: true
-  logLevel: debug
+  enabled: false
+externalCloudagent:
+  host: "veritable-cloudagent-admin.default.svc.cluster.local"
+  port: "3000"
 emailTransport: SMTP_EMAIL
 smtpCredentials:
   enabled: true

charts/veritable-ui/templates/_helpers.tpl

@@ -219,7 +219,7 @@ Return the CNPG secret name
 {{- define "veritable-ui.databaseSecretName" -}}
 {{- if .Values.cnpg.enabled -}}
   {{- $secret := .Values.cnpg.cluster.initdb.secret | default dict }}
-  {{- $secretName := $secret.name | default (printf "%s-cnpg-app" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-") }}
+  {{- $secretName := $secret.name | default (printf "%s-cnpg-superuser" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-") }}
   {{- $secretName -}}
 {{- else -}}
     {{- default (printf "%s-externaldb" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-") (tpl .Values.externalDatabase.existingSecret $) -}}

charts/veritable-ui/templates/secret-cnpg-app.yaml → charts/veritable-ui/templates/secret-cnpg-app-user.yaml

@@ -4,7 +4,7 @@
 apiVersion: v1
 kind: Secret
 metadata:
-  name: {{ printf "%s-cnpg-app" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" }}
+  name: {{ printf "%s-cnpg-app-user" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" }}
   namespace: {{ .Release.Namespace | quote }}
   labels: {{- include "common.labels.standard" . | nindent 4 }}
     app.kubernetes.io/component: veritable-cloudagent

charts/veritable-ui/values.yaml

@@ -760,7 +760,7 @@ externalDatabase:
       # database: example
       # owner: example-owner
       # secret:
-        # name: example-cnpg-app
+        # name: example-cnpg-superuser
       # options: []
       # encoding: UTF8
       # postInitSQL:
@@ -783,6 +783,8 @@ cnpg:
     initdb:
       database: veritable-ui
       owner: postgres
+      secret:
+        name: veritable-ui-cnpg-superuser
     instances: 1
     storage:
       size: 5Gi
@@ -791,13 +793,8 @@ cnpg:
 
 ## @section Veritable-Cloudagent section
 ##
-## @param cloudagent.enabled Enable veritable-cloudagent
-## @param cloudagent.postgresql.nameOverride Name for the veritable-cloudagent PostgreSQL dependency
-##
 cloudagent:
   enabled: false
-  postgresql:
-    nameOverride: vca-postgresql
 
 ## @section External vertiable-cloudagent section
 ##