Skip to content
This repository was archived by the owner on Jul 13, 2026. It is now read-only.

Add PGSSLMODE and PGSSLROOTCERT env vars to OGX container #119

Merged
openshift-merge-bot merged 1 commit into from
Jun 24, 2026
Merged

Add PGSSLMODE and PGSSLROOTCERT env vars to OGX container #119

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 13 additions & 0 deletions internal/controller/lcore_deployment.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -549,6 +549,19 @@ func buildLlamaStackEnvVars(h *common_helper.Helper, ctx context.Context, instan
// Postgres password for ${env.POSTGRES_PASSWORD} substitution in llama-stack config
envVars = append(envVars, buildPostgresPasswordEnvVar())

// PostgreSQL SSL configuration for OGX (llama-stack).

@umago umago Jun 23, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nit (non-blocking): It's usually a good practice to add these things as FIXME or TODO, but I know you already opened a ticket on Jira for the follow up so we won't forget

@lpiwowar lpiwowar Jun 24, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I hope it is ok. I'm going to /lgtm since this is non-blocking. I guess we can do a quick follow up PR if we want:).

@omkarjoshi0304 omkarjoshi0304 Jun 24, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I will quickly add a todo

// OGX's PostgresSqlStoreConfig does not support ssl_mode/ca_cert_path fields yet
// (ogx-ai/ogx#5978), so we configure asyncpg via standard libpq environment
// variables to enforce TLS with full certificate verification.
envVars = append(envVars, corev1.EnvVar{
Name: "PGSSLMODE",
Value: PostgresDefaultSSLMode,
})
envVars = append(envVars, corev1.EnvVar{
Name: "PGSSLROOTCERT",
Value: CABundleMountPath,
})

// Logging configuration - set both for compatibility with llama-stack and OGX
ogxLogLevel := getOGXLogLevel(instance)
envVars = append(envVars, corev1.EnvVar{
Expand Down
4 changes: 4 additions & 0 deletions test/kuttl/common/openstack-lightspeed-instance/assert-openstack-lightspeed-instance.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -189,6 +189,10 @@ spec:
secretKeyRef:
key: password
name: lightspeed-postgres-secret
- name: PGSSLMODE
value: verify-full
- name: PGSSLROOTCERT
value: /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem
- name: LLAMA_STACK_LOGGING
value: all=debug
- name: OGX_LOGGING
Expand Down
4 changes: 4 additions & 0 deletions test/kuttl/tests/okp-configuration/03-assert-okp-instance.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -72,6 +72,10 @@ spec:
secretKeyRef:
key: password
name: lightspeed-postgres-secret
- name: PGSSLMODE
value: verify-full
- name: PGSSLROOTCERT
value: /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem
- name: LLAMA_STACK_LOGGING
value: all=debug
- name: OGX_LOGGING
Expand Down
4 changes: 4 additions & 0 deletions test/kuttl/tests/update-openstacklightspeed/08-assert-openstacklightspeed-update.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -106,6 +106,10 @@ spec:
secretKeyRef:
key: password
name: lightspeed-postgres-secret
- name: PGSSLMODE
value: verify-full
- name: PGSSLROOTCERT
value: /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem
- name: LLAMA_STACK_LOGGING
value: core=debug,providers=info
- name: OGX_LOGGING
Expand Down
Loading