From d6e3a0b03eb58130197346aca1727a39ba01de90 Mon Sep 17 00:00:00 2001
From: Omkar Joshi <103182931+omkarjoshi0304@users.noreply.github.com>
Date: Tue, 23 Jun 2026 15:11:31 +0100
Subject: [PATCH] Add PGSSLMODE and PGSSLROOTCERT env vars to OGX container

OGX's PostgresSqlStoreConfig does not support ssl_mode or ca_cert_path
fields yet (ogx-ai/ogx#5978). Configure asyncpg via standard libpq
environment variables to enforce TLS with full certificate verification,
achieving parity with lightspeed-stack's PostgreSQL connection security.
---
 internal/controller/lcore_deployment.go             | 13 +++++++++++++
 .../assert-openstack-lightspeed-instance.yaml       |  4 ++++
 .../okp-configuration/03-assert-okp-instance.yaml   |  4 ++++
 .../08-assert-openstacklightspeed-update.yaml       |  4 ++++
 4 files changed, 25 insertions(+)

diff --git a/internal/controller/lcore_deployment.go b/internal/controller/lcore_deployment.go
index e5ac3bb..3d2159a 100644
--- a/internal/controller/lcore_deployment.go
+++ b/internal/controller/lcore_deployment.go
@@ -549,6 +549,19 @@ func buildLlamaStackEnvVars(h *common_helper.Helper, ctx context.Context, instan
 	// Postgres password for ${env.POSTGRES_PASSWORD} substitution in llama-stack config
 	envVars = append(envVars, buildPostgresPasswordEnvVar())
 
+	// PostgreSQL SSL configuration for OGX (llama-stack).
+	// OGX's PostgresSqlStoreConfig does not support ssl_mode/ca_cert_path fields yet
+	// (ogx-ai/ogx#5978), so we configure asyncpg via standard libpq environment
+	// variables to enforce TLS with full certificate verification.
+	envVars = append(envVars, corev1.EnvVar{
+		Name:  "PGSSLMODE",
+		Value: PostgresDefaultSSLMode,
+	})
+	envVars = append(envVars, corev1.EnvVar{
+		Name:  "PGSSLROOTCERT",
+		Value: CABundleMountPath,
+	})
+
 	// Logging configuration - set both for compatibility with llama-stack and OGX
 	ogxLogLevel := getOGXLogLevel(instance)
 	envVars = append(envVars, corev1.EnvVar{
diff --git a/test/kuttl/common/openstack-lightspeed-instance/assert-openstack-lightspeed-instance.yaml b/test/kuttl/common/openstack-lightspeed-instance/assert-openstack-lightspeed-instance.yaml
index bafcc90..96bb932 100644
--- a/test/kuttl/common/openstack-lightspeed-instance/assert-openstack-lightspeed-instance.yaml
+++ b/test/kuttl/common/openstack-lightspeed-instance/assert-openstack-lightspeed-instance.yaml
@@ -189,6 +189,10 @@ spec:
                 secretKeyRef:
                   key: password
                   name: lightspeed-postgres-secret
+            - name: PGSSLMODE
+              value: verify-full
+            - name: PGSSLROOTCERT
+              value: /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem
             - name: LLAMA_STACK_LOGGING
               value: all=debug
             - name: OGX_LOGGING
diff --git a/test/kuttl/tests/okp-configuration/03-assert-okp-instance.yaml b/test/kuttl/tests/okp-configuration/03-assert-okp-instance.yaml
index 5b816b4..8bf83cc 100644
--- a/test/kuttl/tests/okp-configuration/03-assert-okp-instance.yaml
+++ b/test/kuttl/tests/okp-configuration/03-assert-okp-instance.yaml
@@ -72,6 +72,10 @@ spec:
                 secretKeyRef:
                   key: password
                   name: lightspeed-postgres-secret
+            - name: PGSSLMODE
+              value: verify-full
+            - name: PGSSLROOTCERT
+              value: /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem
             - name: LLAMA_STACK_LOGGING
               value: all=debug
             - name: OGX_LOGGING
diff --git a/test/kuttl/tests/update-openstacklightspeed/08-assert-openstacklightspeed-update.yaml b/test/kuttl/tests/update-openstacklightspeed/08-assert-openstacklightspeed-update.yaml
index 95af137..9bdbf12 100644
--- a/test/kuttl/tests/update-openstacklightspeed/08-assert-openstacklightspeed-update.yaml
+++ b/test/kuttl/tests/update-openstacklightspeed/08-assert-openstacklightspeed-update.yaml
@@ -106,6 +106,10 @@ spec:
                 secretKeyRef:
                   key: password
                   name: lightspeed-postgres-secret
+            - name: PGSSLMODE
+              value: verify-full
+            - name: PGSSLROOTCERT
+              value: /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem
             - name: LLAMA_STACK_LOGGING
               value: core=debug,providers=info
             - name: OGX_LOGGING