From f6815156cc044ce688542603eb9082c7f03e72be Mon Sep 17 00:00:00 2001 From: Lev Kokotov Date: Wed, 4 Nov 2026 15:07:43 -0800 Subject: [PATCH 1/4] feat: read_write_split on user --- Chart.yaml | 4 ++-- README.md | 3 +++ templates/secrets.yaml | 3 +++ values.yaml | 1 + 4 files changed, 9 insertions(+), 2 deletions(-) diff --git a/Chart.yaml b/Chart.yaml index c31ed3a..ce74342 100644 --- a/Chart.yaml +++ b/Chart.yaml @@ -1,4 +1,4 @@ apiVersion: v1 name: pgdog -version: v0.93 -appVersion: "v0.1.61" +version: v0.94 +appVersion: "v0.1.63" diff --git a/README.md b/README.md index 0c1476c..5510344 100644 --- a/README.md +++ b/README.md @@ -103,6 +103,9 @@ users: Set `authType` on a user to override the general `authType` setting. It accepts the same values and renders as `auth_type` in `users.toml`. +Set `readWriteSplit` on a user to render `read_write_split` in `users.toml`. +It is omitted when unset. + **⚠️ For production**: Use ExternalSecrets instead of plain text passwords (see ExternalSecrets section below). diff --git a/templates/secrets.yaml b/templates/secrets.yaml index 03d8ed1..e9ccb63 100644 --- a/templates/secrets.yaml +++ b/templates/secrets.yaml @@ -47,6 +47,9 @@ idle_timeout = {{ .idleTimeout }} {{- if .readOnly }} read_only = {{ .readOnly }} {{- end }} +{{- if hasKey . "readWriteSplit" }} +read_write_split = {{ .readWriteSplit | quote }} +{{- end }} {{- if hasKey . "schemaAdmin" }} schema_admin = {{ .schemaAdmin }} {{- end }} diff --git a/values.yaml b/values.yaml index 200ee51..fc7f8d9 100644 --- a/values.yaml +++ b/values.yaml @@ -253,6 +253,7 @@ databases: [] # camelCase format. # Set identity on a user to match the identity in its client TLS certificate. # Set authType on a user to override the general authType setting. +# Set readWriteSplit on a user to render read_write_split in users.toml (optional). # Set serverIamRegion to the AWS region for RDS IAM authentication # when serverAuth is rds_iam. # Set serverIamAssumeRole to an IAM role ARN to assume for RDS IAM authentication From 6ab5cfaad37f4144ecb998c4fcee89fa7866c1d5 Mon Sep 17 00:00:00 2001 From: Lev Kokotov Date: Wed, 4 Nov 2026 15:08:29 -0800 Subject: [PATCH 2/4] remove slop --- README.md | 6 ------ 1 file changed, 6 deletions(-) diff --git a/README.md b/README.md index 5510344..26a306f 100644 --- a/README.md +++ b/README.md @@ -100,12 +100,6 @@ users: password: "hunter2" # See ExternalSecrets for secure storage ``` -Set `authType` on a user to override the general `authType` setting. It accepts -the same values and renders as `auth_type` in `users.toml`. - -Set `readWriteSplit` on a user to render `read_write_split` in `users.toml`. -It is omitted when unset. - **⚠️ For production**: Use ExternalSecrets instead of plain text passwords (see ExternalSecrets section below). From 3121e852c29aaaa98ac6e2b34a0e355c6ef703e2 Mon Sep 17 00:00:00 2001 From: Lev Kokotov Date: Wed, 4 Nov 2026 15:09:47 -0800 Subject: [PATCH 3/4] save --- test/values-full.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/test/values-full.yaml b/test/values-full.yaml index adc8a73..6931f99 100644 --- a/test/values-full.yaml +++ b/test/values-full.yaml @@ -96,6 +96,7 @@ users: - username: app_user password: secret123 poolMode: transaction + readWriteSplit: exclude_primary - username: admin_user password: admin123 From 7baa7b962de44faa1e0fb1caca5e6864ed9a0839 Mon Sep 17 00:00:00 2001 From: Lev Kokotov Date: Wed, 4 Nov 2026 15:24:37 -0800 Subject: [PATCH 4/4] fixtures were not testing users.toml --- .github/workflows/test.yml | 6 +++--- test/generate-config.sh | 14 +++++++++++--- test/values-control.yaml | 3 ++- test/values-full.yaml | 8 +++++--- test/values-rewrite.yaml | 3 ++- 5 files changed, 23 insertions(+), 11 deletions(-) diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 231d696..e521308 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -59,11 +59,11 @@ jobs: for values_file in test/values-*.yaml; do name=$(basename "$values_file" .yaml | sed 's/values-//') echo "==> Validating config for $name..." - rm -f /tmp/pgdog.toml - ./test/generate-config.sh "$values_file" /tmp/pgdog.toml + ./test/generate-config.sh "$values_file" /tmp/pgdog.toml /tmp/users.toml docker run --rm \ -v /tmp/pgdog.toml:/tmp/pgdog.toml:ro \ + -v /tmp/users.toml:/tmp/users.toml:ro \ "$PGDOG_IMAGE" \ - /usr/local/bin/pgdog --config=/tmp/pgdog.toml configcheck + /usr/local/bin/pgdog --config=/tmp/pgdog.toml --users=/tmp/users.toml configcheck done echo "==> All configs valid!" diff --git a/test/generate-config.sh b/test/generate-config.sh index b3b8725..cf01bb6 100755 --- a/test/generate-config.sh +++ b/test/generate-config.sh @@ -5,14 +5,15 @@ TEST_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" CHART_DIR="$TEST_DIR/.." if [ -z "$1" ]; then - echo "Usage: $0 [output-file]" - echo "Example: $0 values-full.yaml pgdog.toml" + echo "Usage: $0 [output-file] [users-output-file]" + echo "Example: $0 values-full.yaml pgdog.toml users.toml" exit 1 fi VALUES_FILE="$1" -output=$(helm template pgdog "$CHART_DIR" -f "$VALUES_FILE" \ +rendered=$(helm template pgdog "$CHART_DIR" -f "$VALUES_FILE") +output=$(echo "$rendered" \ | yq -r 'select(.kind == "ConfigMap" and .metadata.name == "pgdog") | .data["pgdog.toml"]') if [ -z "$2" ]; then @@ -20,3 +21,10 @@ if [ -z "$2" ]; then else echo "$output" > "$2" fi + +if [ -n "$3" ]; then + # An absent Secret (e.g. externally managed users) produces an empty users file. + echo "$rendered" \ + | yq -r 'select(.kind == "Secret" and .metadata.name == "pgdog") | .data["users.toml"] // ""' \ + | base64 -d > "$3" +fi diff --git a/test/values-control.yaml b/test/values-control.yaml index e1236f0..ee26ed9 100644 --- a/test/values-control.yaml +++ b/test/values-control.yaml @@ -18,5 +18,6 @@ databases: port: 5432 users: - - username: app_user + - name: app_user + database: primary password: secret123 diff --git a/test/values-full.yaml b/test/values-full.yaml index 6931f99..e085874 100644 --- a/test/values-full.yaml +++ b/test/values-full.yaml @@ -93,11 +93,13 @@ databases: shard: 1 users: - - username: app_user + - name: app_user + database: primary password: secret123 - poolMode: transaction + poolerMode: transaction readWriteSplit: exclude_primary - - username: admin_user + - name: admin_user + database: primary password: admin123 shardedTables: diff --git a/test/values-rewrite.yaml b/test/values-rewrite.yaml index fde42ed..bb42a75 100644 --- a/test/values-rewrite.yaml +++ b/test/values-rewrite.yaml @@ -12,5 +12,6 @@ databases: port: 5432 users: - - username: app_user + - name: app_user + database: primary password: secret123