Repository navigation
[FEATURE] Extensible DB Identity Setup #3184
Description
Defines the database roles, users, and schema ate-api-server expects, and who creates them.
Owner: kustomize release workstream (#3169). Consumers: GKE workstream (Cloud SQL, ai-on-gke/substrate-gke#155), operators with external databases.
Current state (0b635b80): the bundled Postgres postStart hook only runs createdb, and ate-setup runs psql via kubectl exec (cmd/ate-setup/internal/steps/postgres.go). Moving the SQL into postStart is #3677.
Specification:
| Item | Value |
|---|---|
| Schema | substrate |
| Owner role | substrate_owner |
| Owner user | substrate_owner_user |
| Readwrite role | substrate_readwrite |
| Readwrite user | substrate_readwrite_user |
- Bundled installs use no passwords; clients authenticate with certificates.
- The SQL. pkg/postgressetup/setup.sql is one idempotent DO block. It creates each role and the schema only if missing, and raises an error only on conflicting attributes. It is parameterized through psql --set variables (substrate_schema, substrate_owner_role, substrate_owner_user, substrate_owner_password, substrate_readwrite_role, substrate_readwrite_user, substrate_readwrite_password).
- Bundled Postgres runs the SQL from its postStart hook with the fixed bundled values, on every start.
- External databases run the same SQL once with their own values: substrate-gke for Cloud SQL, operators otherwise.
- Migrations are not part of this contract. ate-api-server applies them at startup under an advisory lock, using the owner connection.
Stability
Names are a compatibility surface. Adding a role or grant is additive; renaming is breaking.
Enforcement
The existing pkg/postgressetup tests, plus a kind test that restarts the Postgres pod and asserts the hook succeeds again.
Related: #2995 (bundled Postgres restart), #3638 (renewable passwords).
Parent Issue: #3160
Activity