Update `postgresql` chart from 10 to 17 by antgamdia · Pull Request #208 · trento-project/helm-charts

antgamdia · 2026-06-11T17:19:30Z

Description

This PR bumps the base chart version from v10 to v17 (10.3.18 to 17.1.0). It's been a long time since the last occasion we upgraded it, the base chart has evolved significantly. As a consequence, some extra changes/adaptations had to be made.

Related TRNT-4394

How was this tested?

For now, just via CI automated upgrade tests. Manual testing is still pending.

Documentation changes

Not yet, but we'd need to revisit some flags used in the docs, just in case.

Additional information

N/A

Signed-off-by: Antonio Gamez Diaz <antonio.gamez@suse.com>

github-actions

license-eye has checked 182 files.

Valid	Invalid	Ignored	Fixed
64	1	117	0

Click to see the invalid file list

charts/trento-server/templates/postgresql-secret-migration-hook.yaml

Use this command to fix any missing license headers

```bash

docker run -it --rm -v $(pwd):/github/workspace apache/skywalking-eyes header fix

</details>

Signed-off-by: Antonio Gamez Diaz <antonio.gamez@suse.com>

Copilot

Pull request overview

This PR upgrades the embedded postgresql Helm subchart used by trento-server from the Bitnami v10-based chart to a v17-based chart, updating chart templates/values and adding upgrade-time hooks/CI diagnostics to handle breaking/immutable changes introduced upstream.

Changes:

Replace the charts/trento-server/charts/postgresql implementation with the v17-derived template/layout (primary/read split, new helpers, new resources).
Update trento-server values to match the new chart API (e.g., architecture, auth.*, primary.*).
Add a pre-upgrade migration hook and CI diagnostics aimed at catching/diagnosing upgrade-time hook failures.

Reviewed changes

Copilot reviewed 63 out of 66 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
NOTICE	Update referenced upstream license URL and copyright notice.
charts/trento-server/values.yaml	Adapt `postgresql` values to v17-style configuration (architecture/auth/primary).
charts/trento-server/templates/postgresql-migration-hook.yaml	Add pre-upgrade Job to handle StatefulSet selector immutability across upgrades.
charts/trento-server/charts/postgresql/values.schema.json	Update schema to reflect v17 value structure (architecture/auth).
charts/trento-server/charts/postgresql/templates/update-password/previous-secret.yaml	Add hook secret for previous credentials for password rotation job.
charts/trento-server/charts/postgresql/templates/update-password/new-secret.yaml	Add hook secret for new credentials for password rotation job.
charts/trento-server/charts/postgresql/templates/update-password/job.yaml	Add pre-upgrade password update Job.
charts/trento-server/charts/postgresql/templates/tls-secrets.yaml	Add template for autogenerated TLS secret.
charts/trento-server/charts/postgresql/templates/svc.yaml	Remove legacy single Service template (replaced by primary/read services).
charts/trento-server/charts/postgresql/templates/svc-read.yaml	Remove legacy read Service template.
charts/trento-server/charts/postgresql/templates/svc-headless.yaml	Remove legacy headless Service template.
charts/trento-server/charts/postgresql/templates/statefulset.yaml	Remove legacy monolithic StatefulSet template.
charts/trento-server/charts/postgresql/templates/statefulset-readreplicas.yaml	Remove legacy read replicas StatefulSet template.
charts/trento-server/charts/postgresql/templates/servicemonitor.yaml	Remove legacy ServiceMonitor template.
charts/trento-server/charts/postgresql/templates/serviceaccount.yaml	Update ServiceAccount creation logic/metadata to v17 pattern.
charts/trento-server/charts/postgresql/templates/secrets.yaml	Update secret rendering and add backward-compat notes/logic.
charts/trento-server/charts/postgresql/templates/rolebinding.yaml	Update RoleBinding names/labels and service account reference.
charts/trento-server/charts/postgresql/templates/role.yaml	Update Role rules and PSP handling for newer patterns.
charts/trento-server/charts/postgresql/templates/read/svc.yaml	Add read service template for replication mode.
charts/trento-server/charts/postgresql/templates/read/svc-headless.yaml	Add read headless service template.
charts/trento-server/charts/postgresql/templates/read/statefulset.yaml	Add read-replica StatefulSet template.
charts/trento-server/charts/postgresql/templates/read/servicemonitor.yaml	Add read-replica ServiceMonitor template.
charts/trento-server/charts/postgresql/templates/read/pdb.yaml	Add read-replica PodDisruptionBudget.
charts/trento-server/charts/postgresql/templates/read/networkpolicy.yaml	Add read-replica NetworkPolicy.
charts/trento-server/charts/postgresql/templates/read/metrics-svc.yaml	Add read-replica metrics Service.
charts/trento-server/charts/postgresql/templates/read/metrics-configmap.yaml	Add read-replica metrics ConfigMap.
charts/trento-server/charts/postgresql/templates/read/extended-configmap.yaml	Add read-replica extended configuration ConfigMap.
charts/trento-server/charts/postgresql/templates/psp.yaml	Update PodSecurityPolicy template gating/metadata.
charts/trento-server/charts/postgresql/templates/prometheusrule.yaml	Update PrometheusRule to v17 naming/label conventions.
charts/trento-server/charts/postgresql/templates/primary/svc.yaml	Add primary Service template.
charts/trento-server/charts/postgresql/templates/primary/svc-headless.yaml	Add primary headless Service template.
charts/trento-server/charts/postgresql/templates/primary/statefulset.yaml	Add primary StatefulSet template.
charts/trento-server/charts/postgresql/templates/primary/servicemonitor.yaml	Add primary ServiceMonitor template.
charts/trento-server/charts/postgresql/templates/primary/preinitialization-configmap.yaml	Add primary pre-init scripts ConfigMap template.
charts/trento-server/charts/postgresql/templates/primary/pdb.yaml	Add primary PodDisruptionBudget.
charts/trento-server/charts/postgresql/templates/primary/networkpolicy.yaml	Add primary NetworkPolicy template.
charts/trento-server/charts/postgresql/templates/primary/metrics-svc.yaml	Add primary metrics Service template.
charts/trento-server/charts/postgresql/templates/primary/metrics-configmap.yaml	Update primary metrics ConfigMap template for new naming/metadata.
charts/trento-server/charts/postgresql/templates/primary/initialization-configmap.yaml	Add primary init scripts ConfigMap template.
charts/trento-server/charts/postgresql/templates/primary/extended-configmap.yaml	Add primary extended configuration ConfigMap template.
charts/trento-server/charts/postgresql/templates/primary/configmap.yaml	Add primary main configuration ConfigMap template.
charts/trento-server/charts/postgresql/templates/NOTES.txt	Replace NOTES with v17-style notes and warnings.
charts/trento-server/charts/postgresql/templates/networkpolicy.yaml	Remove legacy NetworkPolicy template.
charts/trento-server/charts/postgresql/templates/metrics-svc.yaml	Remove legacy metrics Service template.
charts/trento-server/charts/postgresql/templates/initialization-configmap.yaml	Remove legacy init ConfigMap template.
charts/trento-server/charts/postgresql/templates/extra-list.yaml	Add standard header and keep extraDeploy rendering.
charts/trento-server/charts/postgresql/templates/extended-config-configmap.yaml	Remove legacy extended-config ConfigMap template.
charts/trento-server/charts/postgresql/templates/configmap.yaml	Remove legacy combined config ConfigMap template.
charts/trento-server/charts/postgresql/templates/backup/pvc.yaml	Add backup PVC template for pg_dumpall cronjob.
charts/trento-server/charts/postgresql/templates/backup/networkpolicy.yaml	Add backup cronjob NetworkPolicy template.
charts/trento-server/charts/postgresql/templates/backup/cronjob.yaml	Add backup pg_dumpall CronJob template.
charts/trento-server/charts/postgresql/templates/_helpers.tpl	Replace helpers with v17-style helpers + customization hooks.
charts/trento-server/charts/postgresql/files/README.md	Remove legacy files/README placeholder.
charts/trento-server/charts/postgresql/files/docker-entrypoint-initdb.d/README.md	Remove legacy initdb README placeholder.
charts/trento-server/charts/postgresql/files/conf.d/README.md	Remove legacy conf.d README placeholder.
charts/trento-server/charts/postgresql/ci/shmvolume-disabled-values.yaml	Remove legacy CI values file.
charts/trento-server/charts/postgresql/ci/default-values.yaml	Remove legacy CI values file.
charts/trento-server/charts/postgresql/ci/commonAnnotations.yaml	Remove legacy CI values file.
charts/trento-server/charts/postgresql/Chart.yaml	Update subchart metadata/version for v17-derived chart.
charts/trento-server/charts/postgresql/Chart.lock	Update Bitnami common dependency to OCI source and newer version.
charts/trento-server/charts/postgresql/.helmignore	Extend ignore rules (img/ and CHANGELOG.md).
charts/trento-server/Chart.yaml	Bump `trento-server` chart version.
.github/workflows/helm-upgrade.yaml	Add always-run step to print hook job status/logs.
.github/scripts/helm-upgrade-helper.sh	Add hook job diagnostics + init container log collection on failures.

Comments suppressed due to low confidence (1)

charts/trento-server/charts/postgresql/templates/psp.yaml:12

PodSecurityPolicy is cluster-scoped; setting metadata.namespace makes the manifest invalid on apply. Remove the namespace field from the PSP metadata.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

antgamdia · 2026-06-17T13:41:15Z

+            echo "Found old selector label 'role: primary', migration needed"
+            echo "Deleting StatefulSet and pods (PVCs will be preserved)..."
+            kubectl delete statefulset {{ .Release.Name }}-postgresql -n {{ .Release.Namespace }}
+            echo "StatefulSet deleted successfully. New StatefulSet will be created with updated selectors."


It's intentional; the on cascade approach was conflicting with pgupgrade

+      initContainers:
+        {{- if .Values.passwordUpdateJob.initContainers }}
+        {{- include "common.tplvalues.render" (dict "value" .Values.passwordUpdateJob.initContainers "context" $) | nindent 8 }}
+        {{- end }}


+{{- define "postgresql.v1.metricsPasswordKey" -}}
+{{- if or .Values.global.auth.existingSecret .Values.auth.existingSecret -}}
+    {{- if .Values.global.postgresql.auth.secretKeys.metricsPasswordKey -}}
+        {{- printf "%s" (tpl .Values.global.postgresql.auth.secretKeys.metricsPasswordKey $) -}}


+  {{- if and (eq .Values.readReplicas.service.type "LoadBalancer") (not (empty .Values.readReplicas.service.loadBalancerSourceRanges)) }}
+  loadBalancerSourceRanges: {{ .Values.readReplicas.service.loadBalancerSourceRanges }}
+  {{- end }}


+  section "=== All hook jobs ==="
+  kubectl get jobs -n "$TRENTO_NAMESPACE" \
+    -l 'helm.sh/hook' \
+    -o wide 2>/dev/null || echo "No hook jobs found"
+
+  section "=== Hook job details ==="
+  local hook_jobs
+  hook_jobs=$(kubectl get jobs -n "$TRENTO_NAMESPACE" \
+    -l 'helm.sh/hook' \
+    -o jsonpath='{.items[*].metadata.name}' 2>/dev/null || echo "")


 {{- else -}}
-    {{- .Values.replication.user -}}
+    {{- "password" -}}
 {{- end -}}
 {{- end -}}


Initial upgrade to postgresql latest chart

93c8175

Signed-off-by: Antonio Gamez Diaz <antonio.gamez@suse.com>

antgamdia added the dependencies Pull requests that update a dependency file label Jun 11, 2026

antgamdia changed the base branch from main to TRNT-4394-4-updateRabbitmq June 11, 2026 17:19

antgamdia added 5 commits June 12, 2026 15:42

Fix chart name

791a401

Signed-off-by: Antonio Gamez Diaz <antonio.gamez@suse.com>

Add customizations

3919abd

Signed-off-by: Antonio Gamez Diaz <antonio.gamez@suse.com>

Replace bitnami images

8b472df

Signed-off-by: Antonio Gamez Diaz <antonio.gamez@suse.com>

Merge branch 'TRNT-4394-4-updateRabbitmq' into TRNT-4394-5-updatePG

a09b426

Update version

c469118

Signed-off-by: Antonio Gamez Diaz <antonio.gamez@suse.com>

antgamdia marked this pull request as ready for review June 12, 2026 16:33

antgamdia added 5 commits June 15, 2026 11:27

Merge branch 'TRNT-4394-4-updateRabbitmq' into TRNT-4394-5-updatePG

2821dee

Add replication pwd

b93fe8c

Signed-off-by: Antonio Gamez Diaz <antonio.gamez@suse.com>

add hook

10c6c9d

Signed-off-by: Antonio Gamez Diaz <antonio.gamez@suse.com>

Use standalone

390a0c0

Signed-off-by: Antonio Gamez Diaz <antonio.gamez@suse.com>

Add hook

9847d1f

Signed-off-by: Antonio Gamez Diaz <antonio.gamez@suse.com>

github-actions Bot reviewed Jun 15, 2026

View reviewed changes

Comment thread charts/trento-server/templates/postgresql-secret-migration-hook.yaml Outdated

antgamdia added 9 commits June 15, 2026 16:41

Use old secret names

6f5de09

Signed-off-by: Antonio Gamez Diaz <antonio.gamez@suse.com>

Use old names

7ce4597

Signed-off-by: Antonio Gamez Diaz <antonio.gamez@suse.com>

Fix keys

87fb09a

Signed-off-by: Antonio Gamez Diaz <antonio.gamez@suse.com>

Fix hook

9125917

Signed-off-by: Antonio Gamez Diaz <antonio.gamez@suse.com>

Fix hook

bb6322f

Signed-off-by: Antonio Gamez Diaz <antonio.gamez@suse.com>

Add logs in hook pods

b299f73

Signed-off-by: Antonio Gamez Diaz <antonio.gamez@suse.com>

Remove bitnami paths

ef23fb6

Signed-off-by: Antonio Gamez Diaz <antonio.gamez@suse.com>

Add additional info in ci

b78ff2b

Signed-off-by: Antonio Gamez Diaz <antonio.gamez@suse.com>

Fix perms

b93f59c

Signed-off-by: Antonio Gamez Diaz <antonio.gamez@suse.com>

antgamdia requested a review from Copilot June 17, 2026 08:11

Copilot started reviewing on behalf of antgamdia June 17, 2026 08:12 View session

Copilot AI reviewed Jun 17, 2026

View reviewed changes

Merge branch 'TRNT-4394-4-updateRabbitmq' into TRNT-4394-5-updatePG

de38e54

antgamdia marked this pull request as draft August 17, 2026 09:41

Navigation Menu

Uh oh!

Update `postgresql` chart from 10 to 17 - #208

Update `postgresql` chart from 10 to 17#208
antgamdia wants to merge 21 commits into
TRNT-4394-4-updateRabbitmqfrom
TRNT-4394-5-updatePG

antgamdia commented Jun 11, 2026 •

edited

Loading

Uh oh!

github-actions Bot left a comment

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

antgamdia Jun 17, 2026

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

antgamdia commented Jun 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

How was this tested?

Documentation changes

Additional information

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

antgamdia Jun 17, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

2 participants

antgamdia commented Jun 11, 2026 •

edited

Loading