enable SSL and CA cert for lightspeed-stack #133
Conversation
WalkthroughUpdated template.yaml to configure Postgres TLS with ssl_mode: verify-full and a CA cert path. Replaced env-based CA cert provisioning with a secret-mounted volume at /etc/tls/ca-bundle.pem, added the corresponding volume and mount, and removed the old ASSISTED_CHAT_POSTGRES_CA_CERT environment variable. Changes
Sequence Diagram(s)sequenceDiagram
participant Pod
participant Secret(db-ca-cert)
participant Container(lightspeed-stack)
participant Postgres
Pod->>Secret(db-ca-cert): Mount secret as volume
Pod->>Container(lightspeed-stack): Start with /etc/tls/ca-bundle.pem
Container(lightspeed-stack)->>Postgres: Connect with ssl_mode=verify-full, ca_cert_path=/etc/tls/ca-bundle.pem
Postgres-->>Container(lightspeed-stack): TLS connection established
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Possibly related PRs
Suggested labels
Suggested reviewers
Tip 🔌 Remote MCP (Model Context Protocol) integration is now available!Pro plan users can now connect to remote MCP servers from the Integrations page. Connect with popular remote MCPs such as Notion and Linear to add more context to your reviews and chats. ✨ Finishing Touches🧪 Generate unit tests
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. CodeRabbit Commands (Invoked using PR/Issue comments)Type Other keywords and placeholders
CodeRabbit Configuration File (
|
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: maorfr The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
/lgtm |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (2)
template.yaml (2)
181-182: Postgres TLS enabled; verify hostname matches cert and lib supports these keysGood move to enforce TLS. Two follow-ups to avoid runtime surprises:
- With ssl_mode=verify-full, the value in ASSISTED_CHAT_POSTGRES_HOST must match a SAN/CN on the server cert; otherwise connections will fail. Confirm the secret’s db.host aligns with the cert.
- Ensure lightspeed-stack actually reads postgres.ssl_mode and postgres.ca_cert_path (naming must match what the app/library expects). If this follows lightspeed-stack PR 347, you’re likely good.
Optional hardening:
- If other Postgres clients in this pod exist (e.g., llama_stack_client_config inference_store/persistence_store), consider setting PGSSLMODE=verify-full and PGSSLROOTCERT=/etc/tls/ca-bundle.pem in the container env to enforce TLS consistently, or extend their config to add TLS settings if supported.
478-481: Mount only the CA file to avoid shadowing /etc/tls directoryMounting the whole directory at /etc/tls can mask any existing contents. Mount the single file via subPath instead.
Apply this diff:
- - name: db-ca-cert - mountPath: /etc/tls - readOnly: true + - name: db-ca-cert + mountPath: /etc/tls/ca-bundle.pem + subPath: ca-bundle.pem + readOnly: true
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
💡 Knowledge Base configuration:
- MCP integration is disabled by default for public repositories
- Jira integration is disabled by default for public repositories
- Linear integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
📒 Files selected for processing (1)
template.yaml(3 hunks)
openshift-merge-bot
bot
merged commit 4a7696f
into
rh-ecosystem-edge:main
2 participants
part of https://issues.redhat.com/browse/MGMT-21487
this PR enables secure connectivity between the service and the database for the lightspeed-stack persistence layer.
we mount a DB CA certificate to a file on the pod and pass that file through the lightspeed-stack configuration, as was implemented in lightspeed-core/lightspeed-stack#347
Summary by CodeRabbit