feat: read_write_split on user

.github/workflows/test.yml

@@ -59,11 +59,11 @@ jobs:
           for values_file in test/values-*.yaml; do
             name=$(basename "$values_file" .yaml | sed 's/values-//')
             echo "==> Validating config for $name..."
-            rm -f /tmp/pgdog.toml
-            ./test/generate-config.sh "$values_file" /tmp/pgdog.toml
+            ./test/generate-config.sh "$values_file" /tmp/pgdog.toml /tmp/users.toml
             docker run --rm \
               -v /tmp/pgdog.toml:/tmp/pgdog.toml:ro \
+              -v /tmp/users.toml:/tmp/users.toml:ro \
               "$PGDOG_IMAGE" \
-              /usr/local/bin/pgdog --config=/tmp/pgdog.toml configcheck
+              /usr/local/bin/pgdog --config=/tmp/pgdog.toml --users=/tmp/users.toml configcheck
           done
           echo "==> All configs valid!"

Chart.yaml

@@ -1,4 +1,4 @@
 apiVersion: v1
 name: pgdog
-version: v0.93
-appVersion: "v0.1.61"
+version: v0.94
+appVersion: "v0.1.63"

README.md

@@ -100,9 +100,6 @@ users:
     password: "hunter2" # See ExternalSecrets for secure storage
 ```
 
-Set `authType` on a user to override the general `authType` setting. It accepts
-the same values and renders as `auth_type` in `users.toml`.
-
 **⚠️ For production**: Use ExternalSecrets instead of plain text
 passwords (see ExternalSecrets section below).
 

templates/secrets.yaml

@@ -47,6 +47,9 @@ idle_timeout = {{ .idleTimeout }}
 {{- if .readOnly }}
 read_only = {{ .readOnly }}
 {{- end }}
+{{- if hasKey . "readWriteSplit" }}
+read_write_split = {{ .readWriteSplit | quote }}
+{{- end }}
 {{- if hasKey . "schemaAdmin" }}
 schema_admin = {{ .schemaAdmin }}
 {{- end }}

test/generate-config.sh

@@ -5,18 +5,26 @@ TEST_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 CHART_DIR="$TEST_DIR/.."
 
 if [ -z "$1" ]; then
-  echo "Usage: $0 <values-file> [output-file]"
-  echo "Example: $0 values-full.yaml pgdog.toml"
+  echo "Usage: $0 <values-file> [output-file] [users-output-file]"
+  echo "Example: $0 values-full.yaml pgdog.toml users.toml"
   exit 1
 fi
 
 VALUES_FILE="$1"
 
-output=$(helm template pgdog "$CHART_DIR" -f "$VALUES_FILE" \
+rendered=$(helm template pgdog "$CHART_DIR" -f "$VALUES_FILE")
+output=$(echo "$rendered" \
   | yq -r 'select(.kind == "ConfigMap" and .metadata.name == "pgdog") | .data["pgdog.toml"]')
 
 if [ -z "$2" ]; then
   echo "$output"
 else
   echo "$output" > "$2"
 fi
+
+if [ -n "$3" ]; then
+  # An absent Secret (e.g. externally managed users) produces an empty users file.
+  echo "$rendered" \
+    | yq -r 'select(.kind == "Secret" and .metadata.name == "pgdog") | .data["users.toml"] // ""' \
+    | base64 -d > "$3"
+fi

test/values-control.yaml

@@ -18,5 +18,6 @@ databases:
     port: 5432
 
 users:
-  - username: app_user
+  - name: app_user
+    database: primary
     password: secret123

test/values-full.yaml

@@ -93,10 +93,13 @@ databases:
     shard: 1
 
 users:
-  - username: app_user
+  - name: app_user
+    database: primary
     password: secret123
-    poolMode: transaction
-  - username: admin_user
+    poolerMode: transaction
+    readWriteSplit: exclude_primary
+  - name: admin_user
+    database: primary
     password: admin123
 
 shardedTables:

test/values-rewrite.yaml

@@ -12,5 +12,6 @@ databases:
     port: 5432
 
 users:
-  - username: app_user
+  - name: app_user
+    database: primary
     password: secret123

values.yaml

@@ -253,6 +253,7 @@ databases: []
 # camelCase format.
 # Set identity on a user to match the identity in its client TLS certificate.
 # Set authType on a user to override the general authType setting.
+# Set readWriteSplit on a user to render read_write_split in users.toml (optional).
 # Set serverIamRegion to the AWS region for RDS IAM authentication
 # when serverAuth is rds_iam.
 # Set serverIamAssumeRole to an IAM role ARN to assume for RDS IAM authentication