Rework bundled postgres helm and templates#1527
Open
iplay88keys wants to merge 8 commits intomainfrom
Open
Conversation
Signed-off-by: Jeremy Alvis <jeremy.alvis@solo.io>
Signed-off-by: Jeremy Alvis <jeremy.alvis@solo.io>
Signed-off-by: Jeremy Alvis <jeremy.alvis@solo.io>
Signed-off-by: Jeremy Alvis <jeremy.alvis@solo.io>
Signed-off-by: Jeremy Alvis <jeremy.alvis@solo.io>
Contributor
There was a problem hiding this comment.
Pull request overview
This PR reworks how kagent's bundled PostgreSQL is configured and deployed, following up on PR #1503. The main improvements include moving credentials from ConfigMap to Kubernetes Secrets, adding health probes and proper security context, making the bundled and external database configuration independent, and switching the default bundled image from pgvector to the standard PostgreSQL image for dev/eval use.
Changes:
- Moved PostgreSQL password storage from ConfigMap (plaintext) to Secret (base64-encoded)
- Added liveness/readiness probes to the bundled PostgreSQL Deployment using
pg_isready - Implemented non-root security context with UID 999 and fixed PGDATA path to survive restarts
- Made bundled database deployment independent from external database configuration
- Changed default bundled image to
docker.io/library/postgres:18(without pgvector) - Updated Makefile to use pgvector image for local development
- Added comprehensive Helm unit tests for PostgreSQL configuration
Reviewed changes
Copilot reviewed 13 out of 13 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| helm/kagent/values.yaml | Restructured bundled postgres config with explicit enabled flag and image subfields |
| helm/kagent/templates/postgresql.yaml | Complete rewrite with PVC, Deployment, and Service; moved to Secret-based password |
| helm/kagent/templates/postgresql-secret.yaml | New file creating Kubernetes Secret for password |
| helm/kagent/templates/controller-deployment.yaml | Updated to reference password Secret and properly handle database URL configuration |
| helm/kagent/templates/controller-configmap.yaml | Removed database URL configuration (moved to Deployment env) |
| helm/kagent/templates/_helpers.tpl | Added helpers for image building, secret naming, and connection string |
| helm/kagent/tests/postgresql_test.yaml | New comprehensive test suite for bundled PostgreSQL configuration |
| Makefile | Added pgvector image overrides for local development |
| DEVELOPMENT.md | Updated documentation to clarify pgvector availability |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Signed-off-by: Jeremy Alvis <jeremy.alvis@solo.io>
…nd url/urlfile work Signed-off-by: Jeremy Alvis <jeremy.alvis@solo.io>
Signed-off-by: Jeremy Alvis <jeremy.alvis@solo.io>
This was referenced Mar 19, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Follow-up to: #1503
Warning
If you are using a vector enabled DB for your external database, set
database.postgres.vectorEnabledtotrueas the default value has changed tofalsein order to use the officialPostgresimage instead of thepgvectorimage for the bundled database.If you were using the bundled PostgreSQL and want to keep the data, read the mitigation section below. A direct upgrade will initialize a fresh database.
This PR reworks how kagent's bundled PostgreSQL is configured and deployed. The main goals are:
Recreatestrategy, non-root security context, and a correctly configuredPGDATApath that survives restartsbundled.enabledandurl/urlFileare now independent — you can keep the bundled pod running while pointing the controller at an external database, which makes migration easierpostgres:18in the helm chart and the toggle is an explicit flag rather than an implicit side effect of leavingurlempty. The local make target deployspgvector:pg18-trixiefor developing against a vector enabled database.Note that this is a breaking change from the bundled Postgres added earlier this week.
What changed in the helm chart for the bundled image:
pgvector/pgvector:pg18-trixiedocker.io/library/postgres:18postgreskagent(hardcoded)postgreskagent(hardcoded)/var/lib/postgresql/var/lib/postgresql/data/var/lib/postgresql/data(default)/var/lib/postgresql/data/pgdata(explicit)url/urlFile)database.postgres.bundled.enabled(default:true)Restarts and helm upgrades preserve data in the bundled Postgres instance correctly once on the new chart.
Mitigation
The bundled PostgreSQL is intended for local development. If you don't need to keep existing data, just upgrade — the new chart initializes a fresh database at a different path on the existing PVC and will not touch the old data directory.
If you want to keep existing local data, you'll need to back up first and restore after upgrading.
Backup (run before upgrading):
Restore (run after upgrading):
Note The helm chart by default uses the
Postgresimage without vector support whereas thehelm installmake target overwrites the image to use thepgvectorimage.Restoring when overwriting the bundled image to use the
pgvectorimage:Database configuration reference
bundled.enabledandurl/urlFileare independent controls:database.postgres.bundled.enabledcontrols whether the bundled PostgreSQL pod and its PVC are deployed. It has no effect on which database the controller connects to.database.postgres.url/database.postgres.urlFilecontrol what the controller connects to. When either is set, the controller uses it. When both are empty, the controller connects to the bundled instance.This means you can have the bundled pod running while the controller points at an external database — useful for migrating data from the bundled Postgres to an external Postgres.
Connection precedence (controller only):
urlFile>url> bundled connection string.bundled.enabledurl/urlFiletruefalsetruefalseurlFile is recommended when your connection string contains credentials — it keeps secrets out of Helm values and the Kubernetes Deployment spec:
Mount the secret yourself via
controller.volumes/controller.volumeMounts:url is suitable when credentials are already managed externally (e.g. injected by a secrets manager at deploy time):
bundled deploys a single-replica PostgreSQL pod with a PersistentVolumeClaim. Not suitable for production — no replication, no backups, data is lost if the PVC is deleted: