[Baylem]

Closes #872. Part of #867. This PR is independent of the API audit and HA changes.

Merge order

This PR targets the upstream fix/native-api-credential-boundary branch because #886 and this change both edit the API Deployment and its Kind install fixture. Merge #886 into master first, then retarget this PR to master and confirm the remaining diff contains only the PostgreSQL Secret change. The Closes #872 declaration takes effect when this PR targets the default branch.

Configuration

Set api.db.existingSecret to an existing Secret in the release namespace and optionally set api.db.secretKey (default dsn). The API and exec subcommands such as bootstrap-admin inherit the required Secret reference. In this mode the Deployment omits the DSN argument. Existing literal and default SQLite configurations keep their prior behavior.

The installation guide covers migration with sanitized Helm values, credential rotation, historical Helm revisions and restarting the API after a Secret update.

Verification

• Rendered the PostgreSQL chart locally with a custom Secret name/key and the default SQLite chart. Confirmed the resulting environment and argument paths.
• The existing Kind PostgreSQL workflow now installs with only a Secret reference, exercises bootstrap/login and a populated Helm upgrade, inspects workload metadata, logs and release revisions for the disposable password, and tests missing Secret and key behavior on disposable pods.
• On b80d0ab8, the populated PostgreSQL upgrade passed in 92.97 s. The same Kind job checked the Secret selector, Helm history and logs, and verified that an invalid Secret name or key blocks Pod startup. Full CI passed with 51 successful jobs and 12 skips. PostgreSQL Secret test · CI report.

Summary by CodeRabbit

• New Features
  • The API and bootstrap-admin can now read the database connection string from an existing Kubernetes Secret. Configure the Secret name and key; the key defaults to dsn.
• Documentation
  • Added setup and migration guidance for Secret-based database configuration, including the behavior when the Secret or key is missing and how to apply Secret changes.

[coderabbitai]

No actionable comments were generated in the recent review.

Walkthrough

The chart can configure the API database DSN from an existing Kubernetes Secret instead of a literal value. The PostgreSQL Kind profile uses that setting, and a new check validates the deployment configuration and scans for a fixture canary.

Changes

Secret-backed PostgreSQL DSN

Layer / File(s)	Summary
Chart configuration and migration guidance charts/gameplane/values.yaml, charts/gameplane/templates/api.yaml, docs/install.md, changelog/unreleased/887-postgres-secret.md	The chart omits --db-dsn when api.db.existingSecret is set and sources GAMEPLANE_DB_DSN from the configured Secret key, defaulting to dsn. The values reference and installation guidance describe Secret precedence, missing Secret or key behavior, and migration considerations. The changelog describes Secret-based DSN use by the API and bootstrap-admin.
Kind PostgreSQL fixture and validation deploy/kind/e2e.sh, deploy/kind/check-postgres-secret.sh, .github/workflows/ci.yaml	The PostgreSQL profile selects gameplane-postgres without reading its DSN into Helm values. The new check validates the API argument and Secret reference, scans Helm revisions and API resources for the canary, and probes missing Secret names and keys. CI runs the check after the PostgreSQL recovery test and removes a command that printed API arguments.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Change: Feature · Severity of issue fixed: Medium

Possibly related PRs

• GameplanePanel/Gameplane#707: Both PRs change the API GAMEPLANE_DB_DSN wiring and the PostgreSQL Kind fixture.
• GameplanePanel/Gameplane#886: Both PRs modify the API Deployment template and Kind fixture on a shared branch.

Suggested labels: type: feature

Merge Risk: Minimal · up to 05342

This change lets the chart read the PostgreSQL connection string from an existing Secret and keeps the literal DSN and SQLite behavior unchanged. No merge-blocking risk was found in the supplied review context.

Pre-merge checks: 4

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title "fix(chart): read PostgreSQL connection strings from an existing Secret" matches the main change. The PR adds api.db.existingSecret and api.db.secretKey to the Helm chart. The API Deployment…
Linked Issues check		Direct linked issue #872 (current, open) requires Secret-backed PostgreSQL configuration for the API and bootstrap. Evidence from the reviewed head (merge base 5e44edf, head 05342f0): - Configurabl…
Out of Scope Changes check		Changes introduced by this PR and their links to #872: - charts/gameplane/templates/api.yaml and charts/gameplane/values.yaml: Secret-mode args and env wiring, and the values documentation. Direc…

Full details: Title check

Explanation

The title "fix(chart): read PostgreSQL connection strings from an existing Secret" matches the main change. The PR adds api.db.existingSecret and api.db.secretKey to the Helm chart. The API Deployment omits --db-dsn and reads GAMEPLANE_DB_DSN from the named Secret. The title names the chart scope, the PostgreSQL target, and the Secret-backed behavior. It is concise and specific.

Full details: Linked Issues check

Explanation

Direct linked issue #872 (current, open) requires Secret-backed PostgreSQL configuration for the API and bootstrap. Evidence from the reviewed head (merge base 5e44edf, head 05342f0):

• Configurable existing Secret name and key [#872]: api.db.existingSecret and api.db.secretKey (default dsn) are added in charts/gameplane/values.yaml and read in charts/gameplane/templates/api.yaml. Confirmed by the reviewed template text.
• Omit the literal DSN flag in Secret mode [#872]: the api.yaml Deployment args render --db-dsn only when api.db.existingSecret is unset. Confirmed by the reviewed template text.
• Secret reference for GAMEPLANE_DB_DSN on applicable paths [#872]: the change summary states that the Deployment env value comes from the named Secret and key. deploy/kind/check-postgres-secret.sh asserts the exact secretKeyRef selector. The env block of api.yaml was truncated in my read, so the env section is supported by the attested summary and the script assertion, not by a full direct read. The PR description states that bootstrap-admin exec subcommands inherit the reference.
• Precedence: Secret mode replaces the literal DSN in args and env. Literal and default SQLite configurations keep their prior behavior, because --db-dsn still renders when existingSecret is unset.
• Migration, rotation, Helm revision persistence and API restart [#872]: docs/install.md (+24 lines per summary) covers these topics. I did not read the document text directly.
• Acceptance checks [#872]: deploy/kind/check-postgres-secret.sh scans every Helm revision's values and manifest, Deployment metadata, pods and logs for the canary e2e-postgres-password. It also creates disposable pods with the Secret name or key changed and waits for CreateContainerConfigError. deploy/kind/e2e.sh selects the gameplane-postgres Secret, and .github/workflows/ci.yaml runs the check after the populated upgrade.
• Qualification runs: the PR description links CI and PostgreSQL test runs. I did not verify these run results.

No coding requirement of #872 is unmet by the reviewed evidence. The Helm and Kind checks were not executed by this assessment.

Full details: Out of Scope Changes check

Explanation

Changes introduced by this PR and their links to #872:

• charts/gameplane/templates/api.yaml and charts/gameplane/values.yaml: Secret-mode args and env wiring, and the values documentation. Directly implements #872.
• deploy/kind/check-postgres-secret.sh (new) and deploy/kind/e2e.sh: Kind verification of the Secret reference, canary scanning, and missing Secret/key behavior. Supports the #872 acceptance criteria.
• .github/workflows/ci.yaml: removes an earlier argument print and adds the check-script step. Supports the Kind verification.
• docs/install.md: migration, rotation, Helm revision and restart guidance required by #872.
• changelog/unreleased/887-postgres-secret.md: changelog entry for the new configuration. Documents the change. Not a code change.

No unrelated changes were identified. The PR description states that this PR is independent of the API audit and HA changes. Stack review evidence is unavailable, so this assessment covers only the changes in the current PR.

Finishing Touches

Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

Recent review info

Run configuration

• Source mode: Auto
• Repository: GameplanePanel/Gameplane
• Branch: fix/postgres-dsn-secret
• File: .coderabbit.yaml
• Commit: 05342f0
• Layers: Repository YAML
• Review profile: CHILL
• Plan: Advanced
• Run ID: 6bb5ba2e-1373-4170-803d-5cfc5ea81b90

Commits

Reviewing files that changed from the base of the PR and between 5e44edf and 05342f0.

Files selected for processing: 7

• .github/workflows/ci.yaml
• changelog/unreleased/887-postgres-secret.md
• charts/gameplane/templates/api.yaml
• charts/gameplane/values.yaml
• deploy/kind/check-postgres-secret.sh
• deploy/kind/e2e.sh
• docs/install.md

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

Recent review details

Context from checks skipped due to timeout: 10

• GitHub Check: docs and repository checks
• GitHub Check: workflow lint
• GitHub Check: chart render
• GitHub Check: ingress-nginx smoke (kind)
• GitHub Check: e2e bucket coverage
• GitHub Check: helm lint
• GitHub Check: dependency review
• GitHub Check: build e2e images
• GitHub Check: build e2e images (arm64)
• GitHub Check: CodeRabbit

Additional context used

Code guidelines: 3

docs/security.md — auto-discovered
docs/contributing.md — auto-discovered
.specify/memory/constitution.md — configured

Path-based instructions: 5

CRITICAL: Every workflow MUST follow hardened-CI practices: All external actions MUST be pinned to a full 40-hex commit SHA (not a tag or branch) Each action SHA pin MUST include an inline version comment for human readability Workflows MUS...

CodeRabbit configuration file

Files:

• .github/workflows/ci.yaml

Applicability reference: AGENTS.md: # Gameplane — AI assistant guide `docs/architecture.md`, `docs/security.md` (threat model); `docs/module-authoring.md`; `mcp-server/README.md`; `audit-syslog-bridge/README.md`.

CodeRabbit inference engine (docs/security.md)

Files:

• .github/workflows/ci.yaml

Applicability reference: AGENTS.md: # Gameplane — AI assistant guide `docs/architecture.md`, `docs/security.md` (threat model); `docs/module-authoring.md`; `mcp-server/README.md`; `audit-syslog-bridge/README.md`.

CodeRabbit inference engine (docs/security.md)

Files:

• .github/workflows/ci.yaml

Applicability reference: AGENTS.md: # Gameplane — AI assistant guide Architecture, commands, and binding rules for AI agents.

CodeRabbit inference engine (docs/contributing.md)

Files:

• .github/workflows/ci.yaml

Source excerpt: A feature's spec folder MUST be renamed from `specs/-/` to `specs/done_-/` once that feature is complete — meaning every task in its `tasks.md` is checked off or explicitly withdrawn, and the feature's...

CodeRabbit inference engine (.specify/memory/constitution.md)

Files:

• deploy/kind/e2e.sh
• .github/workflows/ci.yaml
• changelog/unreleased/887-postgres-secret.md
• charts/gameplane/templates/api.yaml
• charts/gameplane/values.yaml
• docs/install.md
• deploy/kind/check-postgres-secret.sh

Additional comments: 7

charts/gameplane/values.yaml: 1

227-231: LGTM!

charts/gameplane/templates/api.yaml: 1

273-275: LGTM!

Also applies to: 390-397

docs/install.md: 1

261-261: LGTM!

Also applies to: 1083-1105

changelog/unreleased/887-postgres-secret.md: 1

1-5: LGTM!

deploy/kind/e2e.sh: 1

404-404: LGTM!

deploy/kind/check-postgres-secret.sh: 1

1-45: LGTM!

.github/workflows/ci.yaml: 1

2540-2541: LGTM!

[github-actions]

CI Report - b80d0ab

run 43137115926 - attempt 1

0 failed - 21 passed - 12 skipped - 96m28s elapsed

Test selection: partial - per-suite table

Coverage

no coverage/* commit statuses found on b80d0ab

Changed

Area	Files	+/-
deploy/	2	+46/-3
docs/	1	+24/-0
charts/	2	+14/-4
changelog/	1	+5/-0
.github/	1	+2/-1

Slowest jobs

Job	Duration
e2e telemetry / arm64 (kind)	22m39s
e2e telemetry / amd64 (kind)	22m28s
build e2e images	18m16s
e2e restricted-workloads / arm64 (kind)	14m30s
e2e restricted-workloads / amd64 (kind)	14m26s

e2e buckets run

api-agent, api-auth, api-mods, api-rbac, api-roles, backup-preparation, bot-fast, management-placement, monitoring, multicluster, network-isolation, operator, optional-components, postgres-availability, ratelimit, recovery, restricted-workloads, telemetry, upgrade, wake-hostport

[ValgulNecron]

Hey, could you add the change you made to changelog

[Baylem]

Added the requested unreleased changelog entry.

CI passed on 5d202922. The diff through e4a4e349 changes only the changelog entry and two lines in the installation guide. I canceled the repeat CI run because this update changes only Markdown. The earlier guide-only CI run was canceled for the same reason.

The merge-base changed after approval.