Skip to content

Postgres db creds are refreshed every time not just inital reun #2994

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
openshift-merge-bot merged 2 commits into from
Jul 20, 2026
+88 −43
Merged

Postgres db creds are refreshed every time not just inital reun #2994

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
264723f
Postgres db creds are refreshed every time not just inital reun since…
jland-redhat Jul 16, 2026
bdb16b4
Bouncing maas-api pods post secret creation
jland-redhat Jul 17, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
131 changes: 88 additions & 43 deletions ods_ci/tasks/Resources/Database/configure_maas_postgres.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,8 +19,8 @@

# Derive MaaS infrastructure namespace (matches MaaS controller logic from PR #1051).
# When INFRA_NAMESPACE=AUTO (default since 3.5), the controller expects maas-db-config
# in a separate infra namespace. Postgres stays in APPS_NS; maas-db-config is copied
# to the infra namespace with a cross-namespace connection URL.
# in a separate infra namespace. Postgres stays in APPS_NS; maas-db-config is always
# refreshed from postgres-creds and applied to INFRA_NS (and APPS_NS when they differ).
derive_infra_namespace() {
case "$1" in
redhat-ods-applications) echo "redhat-ai-gateway-infra" ;;
Expand All @@ -31,7 +31,7 @@

detect_infra_namespace() {
local apps_ns="$1"

# MaaS provisioning may run before the RHOAI operator has fully deployed
# the maas-controller (CRD registration, reconciliation, and pod scheduling
# can take 10+ minutes after the CSV is ready). Without waiting, detect
Expand Down Expand Up @@ -59,6 +59,78 @@
fi
}

# Always (re)apply maas-db-config from current credentials so namespaces cannot drift.
apply_maas_db_config() {

Check warning on line 63 in ods_ci/tasks/Resources/Database/configure_maas_postgres.sh

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Add an explicit return statement at the end of the function. 


See more on https://sonarcloud.io/project/issues?id=red-hat-data-services_ods-ci&issues=AZ9rihJZue6TkHj3B0yT&open=AZ9rihJZue6TkHj3B0yT&pullRequest=2994
local target_ns="$1"
local pg_host="$2"
local db_url="postgresql://${PG_USER}:${PG_PASS}@${pg_host}:5432/${PG_DB}?sslmode=disable"

oc apply -f - <<EOF
apiVersion: v1
kind: Secret
metadata:
name: maas-db-config
namespace: ${target_ns}
labels:
app: maas-api
purpose: poc
type: Opaque
stringData:
DB_CONNECTION_URL: "${db_url}"
EOF
}

refresh_maas_db_config_secrets() {

Check warning on line 83 in ods_ci/tasks/Resources/Database/configure_maas_postgres.sh

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Add an explicit return statement at the end of the function. 


See more on https://sonarcloud.io/project/issues?id=red-hat-data-services_ods-ci&issues=AZ9rihJZue6TkHj3B0yU&open=AZ9rihJZue6TkHj3B0yU&pullRequest=2994
# FQDN works from both namespaces; prefer it whenever infra is separate.
local pg_host
if [[ "${INFRA_NS}" != "${APPS_NS}" ]]; then
pg_host="postgres.${APPS_NS}.svc"
else
pg_host="postgres"
fi

apply_maas_db_config "${INFRA_NS}" "${pg_host}"
if [[ "${INFRA_NS}" != "${APPS_NS}" ]]; then
# Keep apps namespace in sync for consumers/tools that still look there.
apply_maas_db_config "${APPS_NS}" "${pg_host}"
fi
}

# Restart maas-api so it reloads DB_CONNECTION_URL after secret refresh.
# No-op if the deployment is not present yet (e.g. first-time install before DSC).
restart_maas_api_in_ns() {

Check warning on line 101 in ods_ci/tasks/Resources/Database/configure_maas_postgres.sh

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Add an explicit return statement at the end of the function. 


See more on https://sonarcloud.io/project/issues?id=red-hat-data-services_ods-ci&issues=AZ9wFrvGSOpiTrw4rPd7&open=AZ9wFrvGSOpiTrw4rPd7&pullRequest=2994
local ns="$1"
if oc get deployment maas-api -n "${ns}" &>/dev/null; then
echo "Restarting maas-api in ${ns} to pick up refreshed maas-db-config"
oc rollout restart deployment/maas-api -n "${ns}"
oc rollout status deployment/maas-api -n "${ns}" --timeout=5m
fi
}

restart_maas_api_if_present() {

Check warning on line 110 in ods_ci/tasks/Resources/Database/configure_maas_postgres.sh

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Add an explicit return statement at the end of the function. 


See more on https://sonarcloud.io/project/issues?id=red-hat-data-services_ods-ci&issues=AZ9wFrvGSOpiTrw4rPd8&open=AZ9wFrvGSOpiTrw4rPd8&pullRequest=2994
restart_maas_api_in_ns "${INFRA_NS}"
if [[ "${INFRA_NS}" != "${APPS_NS}" ]]; then
restart_maas_api_in_ns "${APPS_NS}"
fi
}

load_or_generate_postgres_creds() {

Check warning on line 117 in ods_ci/tasks/Resources/Database/configure_maas_postgres.sh

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Add an explicit return statement at the end of the function. 


See more on https://sonarcloud.io/project/issues?id=red-hat-data-services_ods-ci&issues=AZ9rihJZue6TkHj3B0yV&open=AZ9rihJZue6TkHj3B0yV&pullRequest=2994
if oc get secret postgres-creds -n "${APPS_NS}" &>/dev/null; then
PG_USER="$(oc get secret postgres-creds -n "${APPS_NS}" -o jsonpath='{.data.POSTGRES_USER}' | base64 -d)"
PG_PASS="$(oc get secret postgres-creds -n "${APPS_NS}" -o jsonpath='{.data.POSTGRES_PASSWORD}' | base64 -d)"
PG_DB="$(oc get secret postgres-creds -n "${APPS_NS}" -o jsonpath='{.data.POSTGRES_DB}' | base64 -d)"
if [[ -z "${PG_USER}" || -z "${PG_PASS}" || -z "${PG_DB}" ]]; then
echo "postgres-creds in ${APPS_NS} is missing required keys/values" >&2
exit 1
fi
echo "Reusing existing postgres-creds in ${APPS_NS}"
else
PG_USER="maas-$(cat /dev/urandom | tr -dc a-z0-9 | head -c 8)"
PG_PASS="$(cat /dev/urandom | tr -dc A-Za-z0-9 | head -c 32)"
PG_DB="maas-$(cat /dev/urandom | tr -dc a-z0-9 | head -c 8)"
fi
}

INFRA_NS=$(detect_infra_namespace "${APPS_NS}")

# Ensure namespaces exist
Expand All @@ -67,31 +139,21 @@
oc create namespace "${INFRA_NS}" --dry-run=client -o yaml | oc apply -f -
fi

# Skip if all resources already exist and deployment is ready
if oc get secret maas-db-config -n "${INFRA_NS}" &>/dev/null \
&& oc get secret postgres-creds -n "${APPS_NS}" &>/dev/null \
# If postgres is already provisioned, still refresh maas-db-config every run so
# INFRA_NS (and APPS_NS when separate) cannot keep a stale connection URL.
if oc get secret postgres-creds -n "${APPS_NS}" &>/dev/null \
&& oc get service postgres -n "${APPS_NS}" &>/dev/null \
&& oc get deployment postgres -n "${APPS_NS}" &>/dev/null; then
oc wait deployment/postgres -n "${APPS_NS}" --for=condition=Available --timeout=5m
echo "MaaS PostgreSQL prerequisites already exist (postgres in ${APPS_NS}, maas-db-config in ${INFRA_NS}), skipping."
load_or_generate_postgres_creds
refresh_maas_db_config_secrets
restart_maas_api_if_present
echo "MaaS PostgreSQL already provisioned in ${APPS_NS}; refreshed maas-db-config in ${INFRA_NS}$([[ "${INFRA_NS}" != "${APPS_NS}" ]] && echo " and ${APPS_NS}")."
exit 0
fi

# Reuse existing credentials if postgres-creds secret is present, otherwise generate new ones
if oc get secret postgres-creds -n "${APPS_NS}" &>/dev/null; then
PG_USER="$(oc get secret postgres-creds -n "${APPS_NS}" -o jsonpath='{.data.POSTGRES_USER}' | base64 -d)"
PG_PASS="$(oc get secret postgres-creds -n "${APPS_NS}" -o jsonpath='{.data.POSTGRES_PASSWORD}' | base64 -d)"
PG_DB="$(oc get secret postgres-creds -n "${APPS_NS}" -o jsonpath='{.data.POSTGRES_DB}' | base64 -d)"
if [[ -z "${PG_USER}" || -z "${PG_PASS}" || -z "${PG_DB}" ]]; then
echo "postgres-creds in ${APPS_NS} is missing required keys/values" >&2
exit 1
fi
echo "Reusing existing postgres-creds in ${APPS_NS}"
else
PG_USER="maas-$(cat /dev/urandom | tr -dc a-z0-9 | head -c 8)"
PG_PASS="$(cat /dev/urandom | tr -dc A-Za-z0-9 | head -c 32)"
PG_DB="maas-$(cat /dev/urandom | tr -dc a-z0-9 | head -c 8)"
fi
load_or_generate_postgres_creds

# 1. postgres-creds secret
oc apply -f - <<EOF
Expand All @@ -110,27 +172,8 @@
POSTGRES_DB: "${PG_DB}"
EOF

# 2. maas-db-config secret (DB_CONNECTION_URL key)
# Use cross-namespace DNS when postgres and maas-db-config are in different namespaces
if [[ "${INFRA_NS}" != "${APPS_NS}" ]]; then
PG_HOST="postgres.${APPS_NS}.svc"
else
PG_HOST="postgres"
fi
DB_URL="postgresql://${PG_USER}:${PG_PASS}@${PG_HOST}:5432/${PG_DB}?sslmode=disable"
oc apply -f - <<EOF
apiVersion: v1
kind: Secret
metadata:
name: maas-db-config
namespace: ${INFRA_NS}
labels:
app: maas-api
purpose: poc
type: Opaque
stringData:
DB_CONNECTION_URL: "${DB_URL}"
EOF
# 2. maas-db-config secret (always applied; both namespaces when infra is separate)
refresh_maas_db_config_secrets

# 3. postgres Service
oc apply -f - <<EOF
Expand Down Expand Up @@ -220,8 +263,10 @@
exit 1
fi

restart_maas_api_if_present

if [[ "${INFRA_NS}" != "${APPS_NS}" ]]; then
echo "MaaS PostgreSQL prerequisites provisioned (postgres in ${APPS_NS}, maas-db-config in ${INFRA_NS})"
echo "MaaS PostgreSQL prerequisites provisioned (postgres in ${APPS_NS}, maas-db-config in ${INFRA_NS} and ${APPS_NS})"
else
echo "MaaS PostgreSQL prerequisites provisioned in ${APPS_NS}"
fi
Loading