Skip to content

feat: Replace credentials-secret with db/broker connection(s)#743

Draft
adwk67 wants to merge 11 commits intomainfrom
feat/split-credentials-secret
Draft

feat: Replace credentials-secret with db/broker connection(s)#743
adwk67 wants to merge 11 commits intomainfrom
feat/split-credentials-secret

Conversation

@adwk67
Copy link
Member

@adwk67 adwk67 commented Feb 5, 2026

Description

Fixes #64

Notes for reviewers

  • This is large PR although most of the files that have been changed are due to tests and docs: the main changes are in database.rs, queue.rs and connection.rs.
  • We don't want the operator to have to read the secrets, and so the connection code (which will eventually be moved to the framework) returns a connection string containing embedded variables.
  • These can be resolved in one of the following ways:
    • by shell variable substitution (if the variables are presented as normal env-vars e.g. $FOO) by processes started from the shell
    • by config-utils templating: this assumes that the variable is presented in the form of ${env:...} and has been written to a config file
    • N.B. templating of env-vars themselves was considered but rejected as (re-)writing env-vars from Rust using the env library is not safe in a multithreaded environment
  • The operator is responsible for passing env-var names in the form that matches one of the above.
  • Some connections contain a driver-dependent prefix, depending on the context. The operator makes the decision which type of connection string to retrieve (e.g. postgresql/sqlalchemyuri or postgresql/celery).
  • Queues/brokers could be considered as being a subset of backends but have been kept separate as they were not specifically covered by ADR 29.

Definition of Done Checklist

  • Not all of these items are applicable to all PRs, the author should update this template to only leave the boxes in that are relevant
  • Please make sure all these things are done and tick the boxes

Author

  • Changes are OpenShift compatible
  • CRD changes approved
  • CRD documentation for all fields, following the style guide.
  • Helm chart can be installed and deployed operator works
  • Integration tests passed (for non trivial changes)
  • Changes need to be "offline" compatible
  • Links to generated (nightly) docs added
  • Release note snippet added

Reviewer

  • Code contains useful comments
  • Code contains useful logging statements
  • (Integration-)Test cases added
  • Documentation added or updated. Follows the style guide.
  • Changelog updated
  • Cargo.toml only contains references to git tags (not specific commits or branches)

Acceptance

  • Feature Tracker has been updated
  • Proper release label has been added
  • Links to generated (nightly) docs added
  • Release note snippet added
  • Add type/deprecation label & add to the deprecation schedule
  • Add type/experimental label & add to the experimental features tracker

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

credentialsSecret: split in multiple parts, make admin user optional

1 participant