fix: reconcile the assistant->agents postgres rename on existing volumes#659
Merged
Conversation
The agents subsystem rename left the init script creating agents_db / agents_user, but init-databases.sh only runs on a fresh PGDATA. On the live Frankfurt volume the database and role were still named assistant_db and assistant_user, so agents-api could not reach jdbc:.../agents_db and postgres itself crash-looped once secret/platform/postgres gained the agents.* keys the deployment template now references. A one-shot reconcile Job renames the role and database in place, preserving all data, resets the role password from secret/platform/postgres, and falls back to creating the objects when neither name exists (fresh cluster). It is idempotent: a second run is a no-op.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
The assistant subsystem was renamed to agents (#657).
init-databases.shwas updated to create
agents_db/agents_user, and the postgresdeployment template now sources
agents.user/agents.passwordfromsecret/platform/postgres. Two pieces of live state did not follow:secret/platform/postgresstill heldassistant.user/assistant.passwordand no
agents.*keys, soAGENTS_DB_PASSWORDrendered empty and the. /vault/secrets/postgres.envsource failed withsyntax error: unexpected newline. Postgres crash-looped, which cascaded into auth-api, knowledge-apiand n8n (all
Connection refusedtopostgres:5432).init-databases.shonly runs on a fresh PGDATA, so the Frankfurt volumestill carried
assistant_db/assistant_user. Even with postgres healthy,agents-api could not reach
jdbc:postgresql://.../agents_db.The Vault KV keys were added out-of-band. This PR closes the database half.
Change
A one-shot reconcile Job (modelled on
postgres-wolfmanager-reconcile)renames
assistant_user->agents_userandassistant_db->agents_dbin place, preserving all data and the Flyway history. It resets the role
password from
secret/platform/postgres(covering the md5 RENAME edge case)and falls back to creating the objects when neither name exists, so a fresh
cluster where the init script already created
agents_dbis a no-op. Re-runsare idempotent.
Verification
ALTER ROLE+ALTER DATABASEsucceeded; agents-api's vault-agent-init now authenticates and renders.
node --testinplatform/tests: 55/55 pass.kubectl kustomize platform/cluster/flux/clusters/productionbuilds clean.