Support PostgreSQL connection secrets by iplay88keys · Pull Request #32 · kagent-dev/substrate

iplay88keys · 2026-09-04T18:37:55Z

Important

This PR requires the runtime changes in agent-substrate/substrate#1752 and a Substrate image containing them.

Summary

Make the standalone chart's bundled PostgreSQL install create one administrator Secret and separate fixed owner and read/write connection Secrets. The database name defaults to atepg, and both application connections target it. The chart's fixed credential helpers can also receive the shared database address from a parent chart.
Mount application connection strings as projected Secret files and pass separate owner/read/write connection flags and configurable group roles to ateapi. The roles default to the fixed bundled names. Helm postgres.pool.maxConnLifetime sets the --postgres-max-conn-lifetime flag. Mount the administrator Secret only when bootstrap is enabled.
Default postgres.bootstrap to true for the standalone bundled install. With bootstrap disabled or an external database, require existing owner and read/write Secret references. Reject operator-managed application Secret references while bundled bootstrap is enabled.
Configure the bundled PostgreSQL pod from the administrator Secret and require password authentication alongside its client certificate check. Generated application connections verify the server certificate and disable SCRAM channel binding for compatibility with the default Ed25519 service certificate.
Default the standalone table schema to substrate, following best practices to not use the public schema from the [Postgres Wiki].

Scope and dependencies

This layout requires a fresh PostgreSQL database; the chart does not migrate existing identities or grants.

This chart requires the ateapi flags and bootstrap behavior in agent-substrate#1752. The chart's release image must include that runtime before this chart is published.

Operators using their own logins must create them and their group-role memberships, supply both application Secrets, and set postgres.bootstrap=false. The chart does not rotate or reset database passwords.

The chart's default administrator and application passwords are fixed, published values. The bundled bootstrap configuration is for development and evaluation, not production. Production installations should supply unique, operator-managed credentials and disable bootstrap.

BYO chart installs can set postgres.ownerRole and postgres.readWriteRole to provisioned group roles. Bundled bootstrap keeps the fixed development role names. Separate installs sharing one database should use distinct schemas, roles, and logins, with each login granted only its own install's roles. The Substrate identity SQL accepts the role names as optional transaction-local settings for manual provisioning, defaulting to the bundled names.

Validation

helm unittest charts/substrate passed (16 tests).
A local umbrella-chart render verified separate custom Kagent and Substrate role names.

…agent-dev#32), atelet scheduling knobs

…ests; the #8 patches' commits as they are on giantswarm (#11) The second release of the line, v0.0.27-gs.2 (tag on ef30433 = gs.1 + the Postgres connection Secret cherry-picks of kagent-dev#32 and the atelet scheduling knobs, #8), published by run 34554981306 with every scan clean, gets its ledger row: index digests of the six images, the two chart digests, the dataplane it runs. The carried-patches table named the #8 commits by their pull-request branch SHAs (42c0c6b, 392841e, d9717d7), which the rebase merge rewrote; the commits on giantswarm are c1e4e32, f06f5ef and 084d916.

Build and publish versioned binaries, container images, and Helm charts from release tags. Signed-off-by: Eitan Yarmush <eitan.yarmush@solo.io>

Resolve atelet discovery and identity from the pod namespace, centralize install defaults, and allow explicitly selected local clusters to run without Pod Certificates. Keep authenticated transport as the default. Signed-off-by: Eitan Yarmush <eitan.yarmush@solo.io>

Add a configurable end-to-end workflow deadline and propagate it through lease acquisition. Apply released worker assignments to the cache immediately so subsequent scheduling sees the completed pause. Signed-off-by: Eitan Yarmush <eitan.yarmush@solo.io>

Parse PKCS1 RSA and SEC1 EC keys alongside PKCS8 keys, including regression coverage for RSA bundles. Signed-off-by: Eitan Yarmush <eitan.yarmush@solo.io>

Require the agentgateway E2E lane, reuse the installed control plane for microVM demos, wait for asset storage initialization, and accommodate runtime startup and counter persistence behavior in E2E checks. Signed-off-by: Eitan Yarmush <eitan.yarmush@solo.io>

Package the control plane, workers, PostgreSQL, RustFS, and CRDs as Helm charts. Keep manifests and generated RBAC aligned, add Helm E2E checks, and include current scheduling, sandbox permissions, and agentgateway configuration. Co-authored-by: Jet Chiang <jetjiang.ez@gmail.com> Co-authored-by: Keith Mattix II <keithmattix2@gmail.com> Signed-off-by: Jet Chiang <pokyuen.jetchiang-ext@solo.io> Signed-off-by: Eitan Yarmush <eitan.yarmush@solo.io>

Allow an external PostgreSQL instance and a configurable schema, validate connection settings, and pass the schema to the API server. Signed-off-by: Eitan Yarmush <eitan.yarmush@solo.io>

Wire the API server snapshot backend and S3 settings to the chart storage configuration. Signed-off-by: Eitan Yarmush <eitan.yarmush@solo.io>

Configure trace, metric, and log endpoints independently, expose trace sampling, and route agentgateway access logs through the collector logs pipeline. Signed-off-by: Eitan Yarmush <eitan.yarmush@solo.io>

Isolate sandbox asset download tests from pause image pulls, explicitly advance the CA file timestamp, and disable VCS stamping for license checks in temporary verification worktrees. Signed-off-by: Eitan Yarmush <eitan.yarmush@solo.io>

…connection-secret