8000 feat: make postgres SSL certificate paths configurable by blink-so[bot] · Pull Request #41 · coder/observability · GitHub
[go: up one dir, main page]
Skip to content

feat: make postgres SSL certificate paths configurable #41

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 3 commits into from
Jun 16, 2025
Merged

feat: make postgres SSL certificate paths configurable #41

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
6db14cf
feat: make postgres SSL certificate paths configurable
blink-so[bot] Jun 5, 2025
6e8c46d
refactor: make comments more brief in values.yaml
blink-so[bot] Jun 5, 2025
3560b22
update compiled resources.yaml
ericpaulsen Jun 5, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Next Next commit
feat: make postgres SSL certificate paths configurable 
- Remove hardcoded /home/coder/.postgresql paths
- Make sslrootcert, volumes, and volumeMounts configurable with no defaults
- Add conditional rendering to avoid empty volume mounts
- Update postgres connector string to handle optional sslrootcert
- Update README documentation

Fixes hardcoded certificate paths introduced in PR #40
  • Loading branch information
@blink-so
blink-so[bot] committed Jun 5, 2025
commit 6db14cffa7248050469002721825e3ba903669c1
2 changes: 1 addition & 1 deletion README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -258,7 +258,7 @@ values which are defined [here](https://github.com/grafana/helm-charts/tree/main
| global.dashboards.timerange | string | `"12h"` | how far back dashboards should look |
| global.externalScheme | string | `"http"` | |
| global.externalZone | string | `"svc.cluster.local"` | |
| global.postgres | object | `{"alerts":{"groups":{"Basic":{"delay":"1m","enabled":true},"Connections":{"delay":"5m","enabled":true,"thresholds":{"critical":0.9,"notify":0.5,"warning":0.8}},"Notifications":{"delay":"15m","enabled":true,"thresholds":{"critical":0.9,"notify":0.5,"warning":0.8}}}},"database":"coder","exporter":{"image":"quay.io/prometheuscommunity/postgres-exporter"},"hostname":"localhost","mountSecret":"secret-postgres","password":null,"port":5432,"sslmode":"disable","sslrootcert":"/home/coder/.postgresql/rootcert.pem","username":"coder","volumeMounts":[{"mountPath":"/home/coder/.postgresql","name":"pg-certs-mount","readOnly":true}],"volumes":[{"configMap":{"name":"pg-certs-mount-config-map"},"name":"pg-certs-mount"}]}` | postgres connection information NOTE: these settings are global so we can parameterise some values which get rendered by subcharts |
| global.postgres | object | `{"alerts":{"groups":{"Basic":{"delay":"1m","enabled":true},"Connections":{"delay":"5m","enabled":true,"thresholds":{"critical":0.9,"notify":0.5,"warning":0.8}},"Notifications":{"delay":"15m","enabled":true,"thresholds":{"critical":0.9,"notify":0.5,"warning":0.8}}}},"database":"coder","exporter":{"image":"quay.io/prometheuscommunity/postgres-exporter"},"hostname":"localhost","mountSecret":"secret-postgres","password":null,"port":5432,"sslmode":"disable","sslrootcert":null,"username":"coder","volumeMounts":[],"volumes":[]}` | postgres connection information NOTE: these settings are global so we can parameterise some values which get rendered by subcharts |
| global.postgres.alerts | object | `{"groups":{"Basic":{"delay":"1m","enabled":true},"Connections":{"delay":"5m","enabled":true,"thresholds":{"critical":0.9,"notify":0.5,"warning":0.8}},"Notifications":{"delay":"15m","enabled":true,"thresholds":{"critical":0.9,"notify":0.5,"warning":0.8}}}}` | alerts for postgres |
| global.telemetry | object | `{"metrics":{"scrape_interval":"15s","scrape_timeout":"12s"}}` | control telemetry collection |
| global.telemetry.metrics | object | `{"scrape_interval":"15s","scrape_timeout":"12s"}` | control metric collection |
Expand Down
8 changes: 8 additions & 0 deletions coder-observability/templates/_helpers.tpl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -66,12 +66,20 @@ Create the name of the service account to use
{{- if and .Values.global.postgres.password (eq .Values.global.postgres.sslmode "disable") -}}
postgresql://{{ .Values.global.postgres.username }}:{{ urlquery .Values.global.postgres.password }}@{{ .Values.global.postgres.hostname }}:{{ .Values.global.postgres.port }}/{{ .Values.global.postgres.database }}?sslmode={{ .Values.global.postgres.sslmode }}
{{- else if and .Values.global.postgres.password (ne .Values.global.postgres.sslmode "disable") -}}
{{- if .Values.global.postgres.sslrootcert -}}
postgresql://{{ .Values.global.postgres.username }}:{{ urlquery .Values.global.postgres.password }}@{{ .Values.global.postgres.hostname }}:{{ .Values.global.postgres.port }}/{{ .Values.global.postgres.database }}?sslmode={{ .Values.global.postgres.sslmode }}&sslrootcert={{ .Values.global.postgres.sslrootcert }}
{{- else -}}
postgresql://{{ .Values.global.postgres.username }}:{{ urlquery .Values.global.postgres.password }}@{{ .Values.global.postgres.hostname }}:{{ .Values.global.postgres.port }}/{{ .Values.global.postgres.database }}?sslmode={{ .Values.global.postgres.sslmode }}
{{- end -}}
{{- else if and .Values.global.postgres.mountSecret (eq .Values.global.postgres.sslmode "disable") -}}
postgresql://{{ .Values.global.postgres.username }}@{{ .Values.global.postgres.hostname }}:{{ .Values.global.postgres.port }}/{{ .Values.global.postgres.database }}?sslmode={{ .Values.global.postgres.sslmode }}
{{- else if and .Values.global.postgres.mountSecret (ne .Values.global.postgres.sslmode "disable") -}}
{{- if .Values.global.postgres.sslrootcert -}}
postgresql://{{ .Values.global.postgres.username }}@{{ .Values.global.postgres.hostname }}:{{ .Values.global.postgres.port }}/{{ .Values.global.postgres.database }}?sslmode={{ .Values.global.postgres.sslmode }}&sslrootcert={{ .Values.global.postgres.sslrootcert }}
{{- else -}}
postgresql://{{ .Values.global.postgres.username }}@{{ .Values.global.postgres.hostname }}:{{ .Values.global.postgres.port }}/{{ .Values.global.postgres.database }}?sslmode={{ .Values.global.postgres.sslmode }}
{{- end -}}
{{- else -}}
{{ fail "either postgres.password or postgres.mountSecret must be defined" }}
{{- end -}}
{{- end }}
Expand Down
8 changes: 5 additions & 3 deletions coder-observability/templates/statefulset-postgres-exporter.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,9 +30,11 @@ spec:
- name: DATA_SOURCE_NAME
value: '{{ include "postgres-connector-string" . }}'
{{ include "postgres-secret-mount" . | nindent 10 }}

{{- if .Values.global.postgres.volumeMounts }}
volumeMounts:
{{ toYaml .Values.global.postgres.volumeMounts | nindent 12 }}

{{- end }}
{{- if .Values.global.postgres.volumes }}
volumes:
{{ toYaml .Values.global.postgres.volumes | nindent 8 }}
{{ toYaml .Values.global.postgres.volumes | nindent 8 }}
{{- end }}
27 changes: 16 additions & 11 deletions coder-observability/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -123,23 +123,28 @@ global:
password:
database: coder
sslmode: disable
# add root cert path if using SSL
sslrootcert: /home/coder/.postgresql/rootcert.pem
# SSL root certificate path - only required when sslmode != "disable"
# Example: /path/to/certs/rootcert.pem
sslrootcert:

# ensure that your secret has a field named `PGPASSWORD`
mountSecret: "secret-postgres"
exporter:
image: "quay.io/prometheuscommunity/postgres-exporter"

volumes:
- name: "pg-certs-mount"
configMap:
name: "pg-certs-mount-config-map"

volumeMounts:
- name: "pg-certs-mount"
mountPath: "/home/coder/.postgresql"
readOnly: true
# volumes and volumeMounts for SSL certificates
# Only required when using SSL connections (sslmode != "disable")
# Example configuration:
# volumes:
# - name: "pg-certs-mount"
# configMap:
# name: "pg-certs-mount-config-map"
# volumeMounts:
# - name: "pg-certs-mount"
# mountPath: "/path/to/certs"
# readOnly: true
volumes: []
volumeMounts: []

# global.postgres.alerts -- alerts for postgres
alerts:
Expand Down
Loading
0