fix: encode postgres secret credentials in database uri

[flemzord]

Summary

• create an encoded PostgreSQL credentials Secret when database credentials come from a Kubernetes Secret
• use encoded username/password env vars when building POSTGRES_URI
• keep POSTGRES_USERNAME and POSTGRES_PASSWORD sourced from the original Secret for existing consumers

Root cause

Database credentials loaded through ?secret=... were injected raw and then interpolated into postgresql://user:password@host:port, so special URI characters such as ^ could break the resulting connection string.

Fixes #481

Validation

• CGO_ENABLED=0 go test ./internal/resources/databases
• KUBEBUILDER_ASSETS="$(pwd)/bin/k8s/1.32.0-darwin-arm64" CGO_ENABLED=0 go test ./...
• nix develop -c just pc

[coderabbitai]

Warning

Review limit reached

@flemzord, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 43 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 73156af1-8c5e-4afe-a158-40bf31b77e00

📥 Commits

Reviewing files that changed from the base of the PR and between 114ad55 and b3cd1b4.

⛔ Files ignored due to path filters (1)

• docs/09-Configuration reference/settings.catalog.json is excluded by !**/*.json

📒 Files selected for processing (5)

• internal/resources/databases/env.go
• internal/resources/databases/env_test.go
• internal/resources/databases/init.go
• internal/resources/databases/secret.go
• internal/resources/databases/secret_test.go

Walkthrough

This PR fixes incorrect handling of special-character passwords by URL-escaping Postgres credentials into a new derived Kubernetes secret, and updates environment variable generation and controller reconciliation (including RBAC and resource ownership) to use the encoded credentials when constructing connection URIs.

Changes

Encoded Postgres credentials

Layer / File(s)	Summary
Env var generation using encoded credentials internal/resources/databases/env.go, internal/resources/databases/env_test.go	GetPostgresEnvVars selects between plain and URL-encoded username/password env var names based on whether the URI uses a secret reference, and new tests verify the encoded URI templates and secret key refs.
Encoded credentials secret helpers internal/resources/databases/secret.go, internal/resources/databases/secret_test.go	New secret.go derives the encoded secret name, fetches source credentials, URL-escapes them, upserts an opaque secret with owner reference, and deletes it when no longer needed; a new test validates encoding and ownership.
Controller RBAC, reconcile wiring, and ownership internal/resources/databases/init.go	RBAC is extended for secrets management, Reconcile now calls the new reconcile/delete functions instead of resourcereferences.Create/Delete, and *v1.Secret is registered as an owned/watched resource.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Sequence Diagram(s)

sequenceDiagram
  participant Reconcile
  participant SecretLogic as reconcileEncodedPostgresCredentialsSecret
  participant SourceSecret as Source K8s Secret
  participant EncodedSecret as Encoded K8s Secret
  participant EnvBuilder as GetPostgresEnvVars

  Reconcile->>SecretLogic: secret param present
  SecretLogic->>SourceSecret: fetch username/password
  SourceSecret-->>SecretLogic: raw credentials
  SecretLogic->>SecretLogic: URL-escape values
  SecretLogic->>EncodedSecret: CreateOrUpdate with owner reference
  Reconcile->>EnvBuilder: build env vars for database
  EnvBuilder->>EncodedSecret: reference POSTGRES_URL_ENCODED_USERNAME/PASSWORD
  EnvBuilder-->>Reconcile: env vars with escaped credential refs

Loading

Estimated code review effort: 3 (Moderate) | ~25 minutes

Poem

A rabbit hopped through secrets deep,
Found a caret hiding in the keep 🥕
Escaped it clean with QueryEscape's art,
Stitched a secret, played its part,
Now special chars no longer weep!

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly states the main change: encoding Postgres secret credentials in the database URI.
Description check	✅ Passed	The description matches the change set and explains the encoded-secret URI fix and validation.
Linked Issues check	✅ Passed	The PR addresses #481 by URL-encoding secret-backed Postgres credentials before building the URI.
Out of Scope Changes check	✅ Passed	The added Secret reconciliation, RBAC, and tests are directly tied to the encoded-credential URI fix.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/fix-postgres-secret-credentials-encoding

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[NumaryBot]

✅ Approve — automated review

The PR correctly encodes PostgreSQL credentials for use in database URIs. The previously raised concern about url.QueryEscape encoding spaces as + (invalid in URI userinfo) was flagged by automated review and subsequently addressed. The follow-up reviewer found no remaining actionable correctness issues in the diff. No new blocker or major findings remain.

No findings.

[NumaryBot]

NumaryBot posted 1 new inline finding.

Summary: #484 (comment)

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@internal/resources/databases/secret.go`:
- Around line 44-54: The credential encoding in the Secret creation flow uses
url.QueryEscape, which is not safe for URI userinfo and can corrupt
usernames/passwords containing spaces. Update the encoding logic in the secret
update path around CreateOrUpdate in secret.go to use a userinfo-safe escaping
method, and make the matching decode/encode handling in env.go consistent so
credentials round-trip correctly through libpq URI userinfo.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: ead86b76-9132-4821-b8fe-bad6ba974da9

📥 Commits

Reviewing files that changed from the base of the PR and between 419e394 and 114ad55.

⛔ Files ignored due to path filters (1)

• docs/09-Configuration reference/settings.catalog.json is excluded by !**/*.json

📒 Files selected for processing (5)

• internal/resources/databases/env.go
• internal/resources/databases/env_test.go
• internal/resources/databases/init.go
• internal/resources/databases/secret.go
• internal/resources/databases/secret_test.go

[NumaryBot]

NumaryBot review complete: no remaining inline findings.

Resolved 1 stale NumaryBot review thread (0 fixed, 1 outdated).

Summary: #484 (comment)