From c3fae73de34b83be441b750e68adaeb55dd5a199 Mon Sep 17 00:00:00 2001 From: chrisfu Date: Sat, 2 May 2026 03:08:34 -0700 Subject: [PATCH] fix(cnpg,kong): wire cnpg-backup-sa, migrate PodMonitor, drop DASHBOARD consumer MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Three Junie briefs landed in one commit: #07 — Wire cnpg-backup-sa into CNPG cluster spec (drift R8) deploy/gcp/gke/knoe-db.yaml: add spec.serviceAccountName: cnpg-backup-sa (requires CNPG v1.29+, which is the live operator version). etc/init_cnpg_gke.sh: operator install URL now uses CNPG_OPERATOR_VERSION variable (default 1.29.0); new §11 patches knoe-db and knoe-db-barman-cloud RoleBindings to add cnpg-backup-sa as a subject if not already present — matching the 2026-04-29 live stabilization. #13 — Migrate off deprecated enablePodMonitor + podMonitorRelabelings Both deprecated fields removed from deploy/gcp/gke/knoe-db.yaml spec.monitoring. New deploy/gcp/gke/knoe-db-podmonitor.yaml carries the PodMonitor with the cluster relabeling rule (cnpg.io/cluster pod label → cluster label; required for all 85 CNPG Grafana panels). Apply alongside knoe-db.yaml on next cluster patch. #15 — Remove dead DASHBOARD consumer + basicauth_credentials supabase/helm/knoe-supabase: - wrapper.sh: drop DASHBOARD_USERNAME / DASHBOARD_PASSWORD envsubst lines - config.yaml: drop DASHBOARD consumer + basicauth_credentials block - kong/deployment.yaml: drop both DASHBOARD env-var secret refs - values.yaml: rename secret.dashboard → secret.openai (apiKey only; username/password dropped — no enforcer since commit 25f1b2e) - secrets/dashboard.yaml + _helpers.tpl: renamed to openai / supabase.secret.openai - studio/deployment.yaml: reads from secret.openai.apiKey - ci/example.yaml: updated to secret.openai.apiKey helm template confirms knoe-supabase-openai secret referenced; no DASHBOARD output. docs/TODO.md: queue items #7, #13, #15 + drift row R8 archived to Done. Co-authored-by: Junie --- deploy/gcp/gke/knoe-db-podmonitor.yaml | 33 +++++++++++++++ deploy/gcp/gke/knoe-db.yaml | 21 +++++----- docs/TODO.md | 10 +++-- etc/init_cnpg_gke.sh | 40 ++++++++++++++++++- supabase/helm/knoe-supabase/ci/example.yaml | 6 +-- .../knoe-supabase/templates/kong/config.yaml | 11 ----- .../templates/kong/deployment.yaml | 22 ---------- .../templates/secrets/_helpers.tpl | 6 +-- .../templates/secrets/dashboard.yaml | 8 ++-- .../templates/studio/deployment.yaml | 10 ++--- supabase/helm/knoe-supabase/values.yaml | 15 +++---- 11 files changed, 106 insertions(+), 76 deletions(-) create mode 100644 deploy/gcp/gke/knoe-db-podmonitor.yaml diff --git a/deploy/gcp/gke/knoe-db-podmonitor.yaml b/deploy/gcp/gke/knoe-db-podmonitor.yaml new file mode 100644 index 0000000..8c3730e --- /dev/null +++ b/deploy/gcp/gke/knoe-db-podmonitor.yaml @@ -0,0 +1,33 @@ +--- +# Manually-managed PodMonitor for the knoe-db CNPG cluster. +# +# Replaces the deprecated spec.monitoring.enablePodMonitor + +# spec.monitoring.podMonitorRelabelings fields in knoe-db.yaml (both flagged +# for removal by the CNPG operator; see queue #13 in docs/TODO.md). +# +# The relabeling rule injects a `cluster` label on every scraped sample, +# sourced from the cnpg.io/cluster pod label. The CNPG Grafana dashboards +# filter every panel by `cluster="$cluster"`, so without this relabel only +# 2 of 85 CNPG metrics (the operator-collector ones) render. +# +# Apply alongside knoe-db.yaml: +# kubectl apply -f deploy/gcp/gke/knoe-db-podmonitor.yaml +apiVersion: monitoring.coreos.com/v1 +kind: PodMonitor +metadata: + name: knoe-db + namespace: knoe-db-0 + labels: + # Match the label selector used by kube-prometheus-stack's Prometheus + # instance so this PodMonitor is picked up automatically. + release: kps +spec: + selector: + matchLabels: + cnpg.io/cluster: knoe-db + podMetricsEndpoints: + - port: metrics + relabelings: + - sourceLabels: ["__meta_kubernetes_pod_label_cnpg_io_cluster"] + targetLabel: cluster + action: replace diff --git a/deploy/gcp/gke/knoe-db.yaml b/deploy/gcp/gke/knoe-db.yaml index 183154e..a425c16 100644 --- a/deploy/gcp/gke/knoe-db.yaml +++ b/deploy/gcp/gke/knoe-db.yaml @@ -4,6 +4,11 @@ metadata: name: knoe-db namespace: knoe-db-0 spec: + # Run cluster pods as cnpg-backup-sa (annotated for Workload Identity to the + # cnpg-backup@... GCP SA). This is how barman-cloud authenticates to + # gs://knoe-0-backups/ without a static key. Requires CNPG v1.29+. + # The SA is provisioned by etc/init_cnpg_gke.sh § "Apply ServiceAccount + annotate with WI". + serviceAccountName: cnpg-backup-sa instances: 3 enablePDB: false # Image pulled from GCP Artifact Registry — set ARTIFACT_REGISTRY in conf/prod/gcp.cfg @@ -199,15 +204,7 @@ spec: storageClassName: premium-rwo # pd-ssd; restore to premium-rwo after quota increase (matches PGDATA above) monitoring: - # NOTE: enablePodMonitor + podMonitorRelabelings are CNPG-deprecated and - # will be removed in a future release. Migration path: manually manage - # the PodMonitor resource. Tracked in docs/TODO.md as a follow-up. - enablePodMonitor: true # kube-prometheus-stack is installed before CNPG → PodMonitor CRD present - # Add a `cluster` label to every scraped sample, sourced from the - # cnpg.io/cluster pod label. The cnpg-grafana dashboards filter every - # panel by `cluster="$cluster"`, so without this relabel only 2 of 85 - # CNPG metrics (the operator-collector ones) render. - podMonitorRelabelings: - - sourceLabels: ["__meta_kubernetes_pod_label_cnpg_io_cluster"] - targetLabel: cluster - action: replace + # enablePodMonitor and podMonitorRelabelings removed — both fields are + # deprecated by the CNPG operator and will be removed in a future release. + # The PodMonitor is now managed as a sibling resource: + # deploy/gcp/gke/knoe-db-podmonitor.yaml (queue #13). diff --git a/docs/TODO.md b/docs/TODO.md index 8d89b71..9a607a1 100644 --- a/docs/TODO.md +++ b/docs/TODO.md @@ -43,7 +43,6 @@ The Kanban "Now" section at top is the only place this doc imposes structure. Ev - **DB cluster (`knoe-dev-cnpg-0`):** delete `kube-system/prole-supabase-dirprep` Job (18d stale, prole-era) -7. **Update `etc/init_cnpg_gke.sh` to set `cluster.spec.serviceAccountName: cnpg-backup-sa` and create the RoleBinding additions** — current script creates `cnpg-backup-sa` but doesn't wire it as the cluster pod SA. After 2026-04-29 stabilization the live cluster does this; the init script should reflect it so a fresh deploy lands in the same end state. **Brief: [`docs/plans/junie/07-init-cnpg-gke-sa-wiring.md`](plans/junie/07-init-cnpg-gke-sa-wiring.md). Assigned to Junie.** 8. **Port oauth2-proxy manifest to k3d / k3s / min modes** — `deploy/gcp/gke/oauth2-proxy-deployment.yaml` is GKE-shaped (uses `cloud.google.com/v1` BackendConfig + GCE health-check semantics). For non-GCE deploy modes the same Deployment runs unchanged but the ingress glue differs (Traefik / nginx-ingress / no LB at all). Add a `deploy/k3s/oauth2-proxy-deployment.yaml` with the Traefik-flavored ingress annotations once we deploy that mode. @@ -55,11 +54,9 @@ The Kanban "Now" section at top is the only place this doc imposes structure. Ev 12. **Fork the Supabase Studio image to wire in-app help / support / feedback buttons to `mailto:support@knoe.dev` (or `https://db.0.knoe.dev/support`)** — upstream Studio (`supabase/studio:2026.02.16-sha-26c615c`) hardcodes those URLs to Supabase-cloud endpoints (`supabase.com/dashboard/api/feedback` etc.) which are unreachable from self-hosted, so the in-app "Report a problem" / "Send feedback" / "Get help" flows error out. No env-var hook exists in upstream — verified by Explore search. Fork the image, patch the relevant TSX (`apps/studio/components/layouts/AppLayout/AppLayout.tsx`, support-dialog component, settings/help links — handful of files), publish to our registry, bump `image.studio.repository` in [`supabase/helm/knoe-supabase/values.yaml`](../supabase/helm/knoe-supabase/values.yaml). Same fork is the natural place to fix the OpenAI key panel, telemetry endpoints, and any other in-Studio assumptions about Supabase cloud as we encounter them. Stop-gap until then: `https://db.0.knoe.dev/support` 302s to `mailto:support@knoe.dev` (Kong route `support`); just need to tell users to bookmark or remember it. -13. **Migrate off CNPG-deprecated `monitoring.enablePodMonitor` + `podMonitorRelabelings` fields** — both fields in [`deploy/gcp/gke/knoe-db.yaml`](../deploy/gcp/gke/knoe-db.yaml) `spec.monitoring` are flagged deprecated by the CNPG operator and "will be removed in a future release". Migration path per the operator's warning: manually manage the PodMonitor resource (i.e. write `deploy/gcp/gke/knoe-db-podmonitor.yaml` ourselves and apply alongside the Cluster). New file would carry the `relabelings` (cluster label injection, currently sourced from pod label `cnpg.io/cluster`) and any future scrape customization. Cluster spec keeps only the bare CNPG operator config. No urgency — works fine on the current operator (CNPG v1.29) — but file before the next CNPG upgrade. Reference: kubectl deprecation warning emitted on every patch of these fields. **Brief: [`docs/plans/junie/13-podmonitor-manual-management.md`](plans/junie/13-podmonitor-manual-management.md). Assigned to Junie.** 14. **Migrate cnpg-prometheus datasource UID to the stable `cnpg-prometheus` name** — currently the live datasource has the auto-generated UID `P5531627C358300FE` from the original kps install. We pinned `uid: cnpg-prometheus` in [`monitoring/kps-values-gke.yaml`](../monitoring/kps-values-gke.yaml) so any FRESH kps install lands on the stable name, but Grafana refuses to change the UID of an already-provisioned datasource (read-only via API; rollout-restart doesn't migrate it). The dashboard transform [`monitoring/cnpg-dashboard-transforms.yaml`](../monitoring/cnpg-dashboard-transforms.yaml) `ds_prometheus_default_to_cnpg` carries the auto-uid as a workaround. Migration path on the next clean kps re-install (or after a maintenance window where we can wipe the Grafana sqlite DB to drop datasources): swap `value: P5531627C358300FE` → `value: cnpg-prometheus` in the transform and re-run the sync tool. No client-visible change either way. -15. **Remove DASHBOARD consumer + `basicauth_credentials` from `supabase/helm/knoe-supabase/templates/kong/config.yaml`** — now-dead config: the basic-auth plugin block was removed in commit (this oauth2-proxy work), so the consumer + credentials it gated have no enforcer. Lines 30-32 (`{{- if .Values.secret.dashboard }} - username: DASHBOARD {{- end }}`) and lines 44-49 (the `basicauth_credentials:` block) can be deleted; then drop `secret.dashboard` from `values.yaml` and the `DASHBOARD_USERNAME` / `DASHBOARD_PASSWORD` envsubst lines from `wrapper.sh`. Cleanup-only; current state is harmless. **Brief: [`docs/plans/junie/15-remove-dead-dashboard-consumer.md`](plans/junie/15-remove-dead-dashboard-consumer.md). Assigned to Junie. Note: brief flags the OpenAI key trap — `secret.dashboard.openAiApiKey` is the only LIVE consumer of that section, so don't blanket-delete.** --- @@ -70,7 +67,6 @@ Items where docs describe an intended state that doesn't match live state. Each | # | Reality (current) | Intended state | Documented at | Tracked work item | |---|---|---|---|---| | R6 | Image refs `knoe-authority:latest` in deploy manifests | `knoe-auth:latest` (matches Maven artifact `knoe-auth.jar` post-rename) | Phase C plan follow-ups | Queue item #3 | -| R8 | `etc/init_cnpg_gke.sh` doesn't set `cluster.spec.serviceAccountName` or extend the role bindings to `cnpg-backup-sa` | Script lands a fresh deploy in the same end state as live (with `serviceAccountName: cnpg-backup-sa` and role-binding subjects added) | Live cluster spec + RoleBindings | Queue item #7 | --- @@ -99,6 +95,12 @@ Items where docs describe an intended state that doesn't match live state. Each *(items get archived here when they land, with a date and commit reference; or just delete if not worth memorializing)* +- 2026-05-02 — **Wire `cnpg-backup-sa` into CNPG cluster spec + init script** (queue #7 / drift R8). `deploy/gcp/gke/knoe-db.yaml` gains `spec.serviceAccountName: cnpg-backup-sa` (requires CNPG v1.29+). `etc/init_cnpg_gke.sh`: operator install URL now uses `CNPG_OPERATOR_VERSION` variable (default `1.29.0`); new §11 patches both `knoe-db` and `knoe-db-barman-cloud` RoleBindings to add `cnpg-backup-sa` as a subject if not already present, matching the 2026-04-29 live stabilization. `bash -n` clean. Brief: [`docs/plans/junie/07-init-cnpg-gke-sa-wiring.md`](plans/junie/07-init-cnpg-gke-sa-wiring.md). + +- 2026-05-02 — **Migrate off CNPG-deprecated `enablePodMonitor` + `podMonitorRelabelings`** (queue #13). Both deprecated fields removed from `deploy/gcp/gke/knoe-db.yaml` `spec.monitoring`. New sibling manifest `deploy/gcp/gke/knoe-db-podmonitor.yaml` carries the `PodMonitor` with the `cluster` relabeling rule (sourced from `cnpg.io/cluster` pod label; required for all 85 CNPG Grafana dashboard panels). Apply alongside `knoe-db.yaml`. Brief: [`docs/plans/junie/13-podmonitor-manual-management.md`](plans/junie/13-podmonitor-manual-management.md). + +- 2026-05-02 — **Remove dead DASHBOARD consumer + `basicauth_credentials` from Kong chart** (queue #15). `supabase/helm/knoe-supabase`: removed `DASHBOARD_USERNAME`/`DASHBOARD_PASSWORD` envsubst lines from `wrapper.sh`, DASHBOARD consumer + `basicauth_credentials` block from `config.yaml`, and both env-var secret refs from `kong/deployment.yaml`. `values.yaml` `secret.dashboard` section renamed to `secret.openai` (only `apiKey` field; `username`/`password` dropped). `templates/secrets/dashboard.yaml` + `_helpers.tpl` updated to `openai`/`supabase.secret.openai`. `studio/deployment.yaml` updated to read from `secret.openai.apiKey`. `ci/example.yaml` updated. `helm template` confirms `knoe-supabase-openai` secret referenced, no DASHBOARD output. Brief: [`docs/plans/junie/15-remove-dead-dashboard-consumer.md`](plans/junie/15-remove-dead-dashboard-consumer.md). + - 2026-05-02 — **k3s manifest rename: `prole-*` → `knoe-*`** (queue #2 / drift R5) in commit [fb7e8b7](#). Five `git mv` in `deploy/opentofu/k3s/manifests/knoe/`: `prole-{configmap,deployment,service,kdc-configmap,kdc-secrets.example}.yaml` → `knoe-*`. Content sweep of `knoe-kdc-configmap.yaml`: replaced stale `PROLE.LOCAL`/`PROLE.ORG` realm refs and `PROLE_KDC_*` env vars with `KNOE.DEV`/`KNOE_KDC_*` to match the canonical GKE configmap. Kustomize renders cleanly (`kubectl kustomize` → 1193 lines, exit 0). Brief: [`docs/plans/junie/02-k3s-prole-rename.md`](plans/junie/02-k3s-prole-rename.md). - 2026-05-02 — **Fix `scripts/patch_garage_cross_cluster.sh`** (queue #6 / drift R9) in commits [34a25dd](#) + [e9df3c4](#). Three defects from the 2026-04-29 one-shot run: (A) `DB_CLUSTER` default `knoe-cnpg-0` → `knoe-dev-cnpg-0` (stale rebrand artifact; header comment + overrides block also updated); (B) Phase 1 deletion loop now includes `service/garage-s3-ilb` (the LoadBalancer that was left orphaned after the original run); (C) `deploy/gcp/gke/knoe-db-backup-gcs.yaml` split — legacy `ScheduledBackup` with deprecated `method: barmanObjectStore` removed, file is now SA-only. `bash -n` clean; CONFIRM=false dry-run prints correct cluster names. Brief: [`docs/plans/junie/06-patch-garage-script-fixes.md`](plans/junie/06-patch-garage-script-fixes.md). diff --git a/etc/init_cnpg_gke.sh b/etc/init_cnpg_gke.sh index 5c85073..056fd68 100755 --- a/etc/init_cnpg_gke.sh +++ b/etc/init_cnpg_gke.sh @@ -30,6 +30,11 @@ DB_PASSWORD="${DB_PASSWORD:-}" CNPG_DB_OWNER="${CNPG_DB_OWNER:-knoe}" CNPG_STORAGE_CLASS_ORDER="${CNPG_STORAGE_CLASS_ORDER:-premium-rwo,ssd,premium,standard-rwo,garage-hdd,standard,dynamic-rwo}" CNPG_STORAGE_WAIT_TIMEOUT="${CNPG_STORAGE_WAIT_TIMEOUT:-240}" +# v1.29.0+ is required: spec.serviceAccountName lets the cluster pods run as +# cnpg-backup-sa (annotated with iam.gke.io/gcp-service-account for WI), which +# is how the GCS-backed barman ObjectStore authenticates without a static key. +# Older operators (we used 1.24.0 historically) silently drop the field. +CNPG_OPERATOR_VERSION="${CNPG_OPERATOR_VERSION:-1.29.0}" # ── Argument parsing ───────────────────────────────────────────────────────── while [[ $# -gt 0 ]]; do @@ -398,9 +403,9 @@ kubectl apply -f "$GKE_MANIFEST_DIR/namespace.yaml" # ── 7. Install CNPG operator (if not present) ───────────────────────────────── if ! kubectl get crd clusters.postgresql.cnpg.io >/dev/null 2>&1; then - log "Installing CloudNativePG operator ..." + log "Installing CloudNativePG operator v${CNPG_OPERATOR_VERSION} ..." kubectl apply --server-side -f \ - https://raw.githubusercontent.com/cloudnative-pg/cloudnative-pg/main/releases/cnpg-1.24.0.yaml + "https://raw.githubusercontent.com/cloudnative-pg/cloudnative-pg/main/releases/cnpg-${CNPG_OPERATOR_VERSION}.yaml" log "Waiting for CNPG operator to be ready ..." kubectl rollout status deployment/cnpg-controller-manager -n cnpg-system --timeout=120s else @@ -478,6 +483,37 @@ done log "CNPG provisioning selected storageClass=${selected_storage_class}." +# ── 11. Ensure RoleBindings reference cnpg-backup-sa ───────────────────────── +# CNPG auto-creates knoe-db and knoe-db-barman-cloud RoleBindings at cluster +# creation. With spec.serviceAccountName set from the start the operator may +# use cnpg-backup-sa as the sole subject, but if it still uses the default SA +# name (cluster name) we patch both bindings to add cnpg-backup-sa — matching +# the live state after the 2026-04-29 stabilization session. +log "Ensuring CNPG-managed RoleBindings include cnpg-backup-sa ..." +for rb in "${CNPG_CLUSTER_NAME}" "${CNPG_CLUSTER_NAME}-barman-cloud"; do + for _ in 1 2 3 4 5; do + kubectl -n "${CNPG_NAMESPACE}" get rolebinding "${rb}" >/dev/null 2>&1 && break + sleep 2 + done + if kubectl -n "${CNPG_NAMESPACE}" get rolebinding "${rb}" >/dev/null 2>&1; then + if ! kubectl -n "${CNPG_NAMESPACE}" get rolebinding "${rb}" \ + -o jsonpath='{.subjects[*].name}' | grep -qw cnpg-backup-sa; then + patch_file="$(mktemp)" + cat > "${patch_file}" < /usr/local/kong/kong.yml @@ -27,9 +25,6 @@ data: _transform: true consumers: - {{- if .Values.secret.dashboard }} - - username: DASHBOARD - {{- end }} - username: anon keyauth_credentials: - key: ${SUPABASE_ANON_KEY} @@ -41,12 +36,6 @@ data: group: anon - consumer: service_role group: admin - {{- if .Values.secret.dashboard }} - basicauth_credentials: - - consumer: DASHBOARD - username: ${DASHBOARD_USERNAME} - password: ${DASHBOARD_PASSWORD} - {{- end }} services: # Dedicated health endpoint used by the GCE LB BackendConfig. # request-termination returns 200 synchronously without hitting any diff --git a/supabase/helm/knoe-supabase/templates/kong/deployment.yaml b/supabase/helm/knoe-supabase/templates/kong/deployment.yaml index 64811b0..c722cac 100644 --- a/supabase/helm/knoe-supabase/templates/kong/deployment.yaml +++ b/supabase/helm/knoe-supabase/templates/kong/deployment.yaml @@ -71,28 +71,6 @@ spec: name: {{ include "supabase.secret.jwt" . }} key: serviceKey {{- end }} - {{- if .Values.secret.dashboard }} - - name: DASHBOARD_USERNAME - valueFrom: - secretKeyRef: - {{- if .Values.secret.dashboard.secretRef }} - name: {{ .Values.secret.dashboard.secretRef }} - key: {{ .Values.secret.dashboard.secretRefKey.username | default "username" }} - {{- else }} - name: {{ include "supabase.secret.dashboard" . }} - key: username - {{- end }} - - name: DASHBOARD_PASSWORD - valueFrom: - secretKeyRef: - {{- if .Values.secret.dashboard.secretRef }} - name: {{ .Values.secret.dashboard.secretRef }} - key: {{ .Values.secret.dashboard.secretRefKey.password | default "password" }} - {{- else }} - name: {{ include "supabase.secret.dashboard" . }} - key: password - {{- end }} - {{- end }} {{- with .Values.deployment.kong.livenessProbe }} livenessProbe: {{- toYaml . | nindent 12 }} diff --git a/supabase/helm/knoe-supabase/templates/secrets/_helpers.tpl b/supabase/helm/knoe-supabase/templates/secrets/_helpers.tpl index 228d14d..aa37694 100644 --- a/supabase/helm/knoe-supabase/templates/secrets/_helpers.tpl +++ b/supabase/helm/knoe-supabase/templates/secrets/_helpers.tpl @@ -13,10 +13,10 @@ Expand the name of the SMTP secret. {{- end -}} {{/* -Expand the name of the dashboard secret. +Expand the name of the openai secret. */}} -{{- define "supabase.secret.dashboard" -}} -{{- printf "%s-dashboard" (include "supabase.fullname" .) }} +{{- define "supabase.secret.openai" -}} +{{- printf "%s-openai" (include "supabase.fullname" .) }} {{- end -}} {{/* diff --git a/supabase/helm/knoe-supabase/templates/secrets/dashboard.yaml b/supabase/helm/knoe-supabase/templates/secrets/dashboard.yaml index cd99197..e46d656 100644 --- a/supabase/helm/knoe-supabase/templates/secrets/dashboard.yaml +++ b/supabase/helm/knoe-supabase/templates/secrets/dashboard.yaml @@ -1,14 +1,14 @@ -{{- if .Values.secret.dashboard }} -{{- if not .Values.secret.dashboard.secretRef }} +{{- if .Values.secret.openai }} +{{- if not .Values.secret.openai.secretRef }} apiVersion: v1 kind: Secret metadata: - name: {{ include "supabase.secret.dashboard" . }} + name: {{ include "supabase.secret.openai" . }} labels: {{- include "supabase.labels" . | nindent 4 }} type: Opaque data: -{{- range $key, $value := .Values.secret.dashboard }} +{{- range $key, $value := .Values.secret.openai }} {{- if $value }} {{- if eq (typeOf $value) "string" }} {{ $key }}: {{ $value | b64enc }} diff --git a/supabase/helm/knoe-supabase/templates/studio/deployment.yaml b/supabase/helm/knoe-supabase/templates/studio/deployment.yaml index d9804fc..71c5600 100644 --- a/supabase/helm/knoe-supabase/templates/studio/deployment.yaml +++ b/supabase/helm/knoe-supabase/templates/studio/deployment.yaml @@ -92,12 +92,12 @@ spec: - name: OPENAI_API_KEY valueFrom: secretKeyRef: - {{- if .Values.secret.dashboard.secretRef }} - name: {{ .Values.secret.dashboard.secretRef }} - key: {{ .Values.secret.dashboard.secretRefKey.openAiApiKey | default "openAiApiKey" }} + {{- if .Values.secret.openai.secretRef }} + name: {{ .Values.secret.openai.secretRef }} + key: {{ .Values.secret.openai.secretRefKey.apiKey | default "apiKey" }} {{- else }} - name: {{ include "supabase.secret.dashboard" . }} - key: openAiApiKey + name: {{ include "supabase.secret.openai" . }} + key: apiKey {{- end }} - name: SUPABASE_ANON_KEY diff --git a/supabase/helm/knoe-supabase/values.yaml b/supabase/helm/knoe-supabase/values.yaml index ee1ddd6..7ac31f7 100644 --- a/supabase/helm/knoe-supabase/values.yaml +++ b/supabase/helm/knoe-supabase/values.yaml @@ -101,21 +101,18 @@ secret: # username: username # password: password - ## Studio dashboard credentials - ## - dashboard: - username: "supabase" - password: "this_password_is_insecure_and_should_be_updated" - openAiApiKey: "key_super_secret" + ## OpenAI API key — passed to Studio's AI Assist sidebar. + ## Optional; if absent, the AI Assist panel renders an error toast but + ## the rest of Studio works fine. Replace via secretRef in production. + openai: + apiKey: "key_super_secret" ## Reference to existing secret # secretRef: "" ## Map to actual keys inside secretRef if they differ # secretRefKey: - # username: username - # password: password - # openAiApiKey: openAiApiKey + # apiKey: apiKey ## S3-compatible credentials ##