chore: sync component image versions from upstream Supabase - #17
Conversation
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: dd7dfb8550
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| DefaultKongImage = "kong/kong:3.9.1" | ||
| DefaultAuthImage = "supabase/gotrue:v2.189.0" | ||
| DefaultPostgRESTImage = "postgrest/postgrest:v14.12" | ||
| DefaultRealtimeImage = "supabase/realtime:v2.102.3" |
There was a problem hiding this comment.
When users rely on the defaults, this image bump moves Realtime to the current self-hosted tenant model, but RealtimeBuilder still only sets the older env set (JWT_SECRET, SECRET_KEY_BASE, APP_NAME, PORT, RLIMIT_NOFILE, SECURE_CHANNELS) and never enables SEED_SELF_HOST or otherwise creates the default tenant. With supabase/realtime:v2.102.3, the /socket and tenant health/API paths require that tenant to exist, so a default SupabaseProject will deploy a Realtime pod that cannot serve /realtime/v1/* traffic through Kong. Please add the new self-host tenant seeding/env wiring before making this image the default, or keep the previous default until the builder is updated.
Useful? React with 👍 / 👎.
…rades Kong 2.8 -> 3.9: the kong/kong image renamed /docker-entrypoint.sh to /entrypoint.sh, causing the container to crashloop. Replace the inline eval/echo command with an entrypoint script shipped in the ConfigMap that mirrors upstream kong-entrypoint.sh (awk-based env substitution), write the rendered config to /usr/local/kong/kong.yml (writable by the kong user), align the declarative config and env vars with upstream kong.yml, and add kong health probes. Realtime v2.51 -> v2.102: JWT_SECRET is no longer read and METRICS_JWT_SECRET is now required at boot. Switch to API_JWT_SECRET, add METRICS_JWT_SECRET, and add self-host tenant seeding (SEED_SELF_HOST, SELF_HOST_TENANT_NAME matching the Service name, DB_AFTER_CONNECT_QUERY, DB_ENC_KEY, ERL_AFLAGS, DNS_NODES, RUN_JANITOR). Drop the removed SECURE_CHANNELS. storage-api v1.60: rename PGRST_JWT_SECRET to AUTH_JWT_SECRET. PostgREST v14: use PGRST_DB_SCHEMAS (plural). GoTrue v2.189: add GOTRUE_API_HOST, GOTRUE_JWT_ADMIN_ROLES, GOTRUE_JWT_AUD. Studio 2026.07: add POSTGRES_HOST/PORT/DB and feature toggles.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 98bf09e418
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| Command: []string{ | ||
| "/bin/sh", | ||
| "/etc/kong/kong-entrypoint.sh", | ||
| }, |
There was a problem hiding this comment.
Update existing Kong ConfigMaps before making the Deployment invoke this file. For projects created by the previous operator version, internal/controller/supabaseproject_controller.go:203-209 only fetches the existing ConfigMap and never updates its data, so it contains kong.yml but not kong-entrypoint.sh; reconciliation nevertheless rolls out this Deployment, and /bin/sh exits because /etc/kong/kong-entrypoint.sh does not exist.
Useful? React with 👍 / 👎.
| Name: "KONG_ROUTER_FLAVOR", | ||
| Value: "expressions", |
There was a problem hiding this comment.
Gate the Kong 3.x-specific configuration on the selected image or explicitly migrate existing specs. The webhook persists its default image, so projects created before this change retain kong:2.8.1, while this builder now unconditionally supplies the expressions router and a 3.9-oriented configuration/startup path; after an operator upgrade, those existing or explicitly configured 2.8 pods cannot start with the newly generated Deployment.
Useful? React with 👍 / 👎.
| {Name: "NEXT_PUBLIC_ENABLE_LOGS", Value: "false"}, | ||
| {Name: "NEXT_ANALYTICS_BACKEND_PROVIDER", Value: "postgres"}, | ||
| {Name: "ENABLED_FEATURES_LOGS_ALL", Value: "false"}, | ||
| {Name: "POSTGRES_USER_READ_WRITE", Value: "postgres"}, |
There was a problem hiding this comment.
Use the database secret's username for this value instead of hard-coding postgres. The API explicitly supports and recommends credentials such as supabase_admin (and dev/dev-secrets.yaml uses that user), but Studio receives that user's password alongside POSTGRES_USER_READ_WRITE=postgres; when the two roles do not share a password, Studio's direct database operations authenticate with a mismatched username/password pair and fail.
Useful? React with 👍 / 👎.
| username: '$DASHBOARD_USERNAME' | ||
| password: '$DASHBOARD_PASSWORD' |
There was a problem hiding this comment.
Encode or YAML-escape the substituted credentials rather than placing arbitrary Secret values inside single quotes. A valid basic-auth password such as it's-secret renders as password: 'it's-secret', producing invalid declarative YAML and preventing Kong from starting; the webhook validates only that the Secret keys are present, so it does not exclude apostrophes or other YAML-significant content.
Useful? React with 👍 / 👎.
T106 patches the Kong image, and T107 re-applying the CR reverts it to the default, triggering a rolling update. T107 could pick a Ready pod from the old ReplicaSet that gets terminated mid-test, killing the port-forward. Wait for the deployment rollout to complete first.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 7dd5add248
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| Value: "supabaserealtime", | ||
| }, | ||
| { | ||
| Name: "API_JWT_SECRET", |
There was a problem hiding this comment.
Preserve the legacy JWT_SECRET variable when the selected image is supabase/realtime:v2.51.11, or gate the environment set by image version. The defaulting webhook persists image values, so projects created before this upgrade retain v2.51.11; reconciliation then replaces that pod's required JWT_SECRET with the newer API_JWT_SECRET, leaving the old Realtime server unable to validate client JWTs even though the user never opted into the image upgrade.
Useful? React with 👍 / 👎.
| }, | ||
| { | ||
| Name: "PGRST_JWT_SECRET", | ||
| Name: "AUTH_JWT_SECRET", |
There was a problem hiding this comment.
Keep PGRST_JWT_SECRET for the previously defaulted supabase/storage-api:v1.32.0, or select the variable name according to the configured image. Since the webhook stores the old default in existing specs, an operator upgrade reconciles those deployments with v1.32.0 but supplies only the v1.60-era AUTH_JWT_SECRET; the old Storage API consequently loses its JWT verification secret and can fail startup or authentication without any user image change.
Useful? React with 👍 / 👎.
…secret The Kong ConfigMap was only created when absent, so template changes (including the new kong-entrypoint.sh) never propagated to existing projects. Reconcile it with create-or-update and stop swallowing non-NotFound Get errors. Studio's POSTGRES_USER_READ_WRITE was hard-coded to postgres while its password comes from the database secret; use the secret's username so the credential pair stays consistent.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 0458d5defd
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| existingKongConfigMap.Data = kongConfigMap.Data | ||
| if err := r.Update(ctx, existingKongConfigMap); err != nil { |
There was a problem hiding this comment.
After the ConfigMap has converged, every steady-state reconciliation still calls Update, which bumps its resource version even when Data is unchanged. Because SetupWithManager watches owned ConfigMaps, that write emits another reconciliation event and causes repeated unnecessary API-server writes; compare the existing data before updating (or patch only when it differs).
Useful? React with 👍 / 👎.
1 participant
Problem
Default component images were far behind the upstream Supabase compose file. The version gap includes several major upgrades (Kong 2.8 -> 3.9, Realtime v2.51 -> v2.102, storage-api v1.32 -> v1.60, PostgREST v13 -> v14) whose runtime contracts changed, so simply bumping image tags left components unable to start (Kong crashlooped on a renamed entrypoint, Realtime aborted on missing required env vars).
Solution
Sync default images from upstream and align each component builder with the corresponding upstream compose configuration, treating incompatibilities with previously persisted old images as breaking changes instead of maintaining dual compatibility.
Major Changes
kong/kong:3.9.1, GoTruev2.189.0, PostgRESTv14.12, Realtimev2.102.3, storage-apiv1.60.4, postgres-metav0.96.6, Studio2026.07.07).kong-entrypoint.sh: awk-based env substitution and the renamed/entrypoint.sh(the old/docker-entrypoint.shno longer exists in 3.x images and caused the crashloop)./usr/local/kong/kong.yml, writable by the kong user (uid 1001).kong.yml: jwks / SAML / OAuth well-known routes, admin-only OpenAPI root (expressions router), realtime REST routes with openapi/tenants blocking,/api/mcpblocker,$LUA_AUTH_EXPRAuthorization injection, storage post-function empty-header cleanup.KONG_ROUTER_FLAVOR=expressions, DNS/buffer settings, full plugin list) and addedkong healthreadiness/liveness probes.JWT_SECRETtoAPI_JWT_SECRET, added now-requiredMETRICS_JWT_SECRET, and wired self-host tenant seeding (SEED_SELF_HOST,SELF_HOST_TENANT_NAMEmatching the Service name,DB_AFTER_CONNECT_QUERY,DB_ENC_KEY,ERL_AFLAGS,DNS_NODES,RUN_JANITOR). Removed the deletedSECURE_CHANNELS.PGRST_JWT_SECRET->AUTH_JWT_SECRET; PostgREST:PGRST_DB_SCHEMA->PGRST_DB_SCHEMAS; GoTrue: addedGOTRUE_API_HOST,GOTRUE_JWT_ADMIN_ROLES,GOTRUE_JWT_AUD; Studio: addedPOSTGRES_HOST/PORT/DBandPOSTGRES_USER_READ_WRITEsourced from the database secret.Breaking Changes
The defaulting webhook persists image values into the spec, so SupabaseProjects created before this release keep the old defaults (
kong:2.8.1,supabase/realtime:v2.51.11,supabase/storage-api:v1.32.0, ...). The component builders now target the new versions only:JWT_SECRET; storage-api v1.32 no longer receivesPGRST_JWT_SECRET.Existing projects must update
spec.<component>.imageto the new defaults (or recreate the CR) after upgrading the operator.