fix(rest-api): fix make kind-reset for local development

[pbreton]

Ensure make kind-reset is able to run and bring rest-api for local development.

Type of Change

• Add - New feature or capability
• Change - Changes in existing functionality
• Fix - Bug fixes
• Remove - Removed features or deprecated functionality
• Internal - Internal changes (refactoring, tests, docs, etc.)

Breaking Changes

• This PR contains breaking changes

Testing

• Unit tests added/updated
• Integration tests added/updated
• Manual testing performed
• No testing required (docs, internal refactor, etc.)

[coderabbitai]

Walkthrough

This PR adds HELM_SET_DB Helm overrides for the REST API chart and updates helm-template/helm-deploy to use them. It also changes Temporal namespace setup to retry describe/create until cloud and site are confirmed.

Changes

Rest API Makefile Changes

Layer / File(s)	Summary
HELM_SET_DB override wiring rest-api/Makefile	Adds HELM_SET_DB with --set overrides for nico-rest-db.db.* and nico-rest-api.config.db.*, pointing to postgres.postgres, and includes it in both the helm template and helm upgrade --install invocations.
Temporal namespace retry and verification rest-api/Makefile	Replaces the one-shot `temporal operator namespace create

Estimated code review effort: 3 (Moderate) | ~20 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly reflects the main change: fixing kind-reset for local development in rest-api.
Description check	✅ Passed	The description matches the changeset and accurately states that make kind-reset should work for local development.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

🔍 Container Scan Summary

Service	Total	Critical	High	Medium	Low	Other
nico-flow	12	1	2	2	0	7
nico-nsm	4	0	0	4	0	0
nico-psm	12	1	2	2	0	7
nico-rest-api	12	1	2	2	0	7
nico-rest-cert-manager	12	1	2	2	0	7
nico-rest-db	12	1	2	2	0	7
nico-rest-site-agent	12	1	2	2	0	7
nico-rest-site-manager	12	1	2	2	0	7
nico-rest-workflow	12	1	2	2	0	7
TOTAL	100	8	16	20	0	56

Per-CVE detail lives in the per-service grype-* artifacts (JSON + SARIF). Severity counts only — no CVE IDs published here.

[coderabbitai]

Actionable comments posted: 1

🧹 Nitpick comments (1)

rest-api/Makefile (1)

512-541: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Consider hoisting the repeated TLS/address flags into a variable.

The frontend address plus the four --tls-* flags are duplicated across all three temporal operator namespace invocations. A shared Make variable would keep them in lockstep and reduce the recipe noise.

♻️ Optional — extract shared connection flags

TEMPORAL_ADMIN_FLAGS := --address temporal-frontend.temporal:7233 \
	--tls-cert-path /var/secrets/temporal/certs/server-interservice/tls.crt \
	--tls-key-path /var/secrets/temporal/certs/server-interservice/tls.key \
	--tls-ca-path /var/secrets/temporal/certs/server-interservice/ca.crt \
	--tls-server-name interservice.server.temporal.local

Then each call collapses to temporal operator namespace describe --namespace $$ns $(TEMPORAL_ADMIN_FLAGS).

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@rest-api/Makefile` around lines 512 - 541, The Temporal namespace
registration recipe repeats the same frontend address and TLS flags across the
describe, create, and verify calls, so hoist that shared connection
configuration into a Make variable in the Makefile. Update the commands in the
namespace loop to reuse that variable with the `temporal operator namespace`
invocations so the settings stay consistent and the recipe is easier to
maintain.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@rest-api/Makefile`:
- Around line 533-541: The final namespace verification in the Makefile is still
a single-shot `kubectl ... temporal operator namespace describe` check, so it
can fail during Temporal propagation lag. Update the namespace-check block that
iterates over `cloud` and `site` to use the same bounded retry behavior as the
create loop, or fold the describe into that existing retry path, so transient
`NOT_FOUND` responses are retried before failing.

---

Nitpick comments:
In `@rest-api/Makefile`:
- Around line 512-541: The Temporal namespace registration recipe repeats the
same frontend address and TLS flags across the describe, create, and verify
calls, so hoist that shared connection configuration into a Make variable in the
Makefile. Update the commands in the namespace loop to reuse that variable with
the `temporal operator namespace` invocations so the settings stay consistent
and the recipe is easier to maintain.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: d0084632-b4c1-421c-aaa2-0286ace1f10e

📥 Commits

Reviewing files that changed from the base of the PR and between 2c015f1 and 09acf6d.

📒 Files selected for processing (1)

• rest-api/Makefile

[github-actions]

🔐 TruffleHog Secret Scan

✅ No secrets or credentials found!

Your code has been scanned for 700+ types of secrets and credentials. All clear! 🎉

🔗 View scan details

_{🕐 Last updated: 2026-07-08 01:00:46 UTC | Commit: 09acf6d}

[hwadekar-nv]

Thanks @pbreton

[thossain-nv]

Thanks @pbreton for the improvement.