feat(ci-deploy): pg_dump snapshots verify TLS with the application's CA ConfigMap by khaliqgant · Pull Request #244 · AgentWorkforce/infra

khaliqgant · 2026-11-11T22:25:58Z

Prod (agentrelay-prod) snapshots its Control database on Supabase with pg_dump before every apply. The URL uses sslmode=verify-full, but the CodeBuild job has no Supabase CA. A pg_dump database entry can now name ca: {configMap, key}, in the same namespace. That CA, the one relay-control already trusts (supabase-ca), becomes PGSSLROOTCERT for the dump.

New test included (30 pass); shellcheck is clean.

🤖 Generated with Claude Code

^{Open in [code]smith · Need help on this PR? Tag @codesmith-bot with what you need.}

Summary by cubic

Allows pg_dump snapshot entries to specify a CA ConfigMap, so database URLs with sslmode=verify-full (like Supabase poolers) dump using the same trust anchor the application uses.

Adds an optional ca: {configMap, key} field to a pg_dump database entry; when present, that CA is written to a file and exported as PGSSLROOTCERT for the dump, then unset per entry.
When the URL itself has an sslrootcert (often a pod-only path), the configured CA replaces it, since libpq favors the URL value over PGSSLROOTCERT, while preserving the URL's percent-encoding.
Documents the new field and includes tests covering CA-based verification, URL sslrootcert replacement, and preserved percent-encoding.

^{Written for commit 15aa78e. Summary will update on new commits.}

…CA ConfigMap A pg_dump database entry may name {configMap, key}; its CA becomes PGSSLROOTCERT, so sslmode=verify-full URLs (Supabase pooler) dump with the same trust the application uses. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

chatgpt-codex-connector · 2026-11-11T22:26:07Z

Codex Review Summary: ✅ Completed

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-11T22:27:49.581813Z	`726ff68`	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

coderabbitai · 2026-11-11T22:26:19Z

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 47 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

Run configuration

Source mode: Auto
Repository: Unavailable
Branch: Unavailable
File: No configuration file from this repository applied
Commit: Unavailable
Layers: Organization UI
Review profile: CHILL
Plan: Advanced
Run ID: 5adf47d2-bc2f-4f83-8c0a-e9725dabfe91

Commits

Reviewing files that changed from the base of the PR and between 726ff68 and 15aa78e.

Files selected for processing: 2

scripts/selfhost/ci-deploy.sh
scripts/selfhost/tests/test_ci_deploy.py

No actionable comments were generated in the recent review.

Walkthrough

The PostgreSQL snapshot flow now supports an optional CA certificate from a same-namespace ConfigMap. The script passes the certificate file to pg_dump through PGSSLROOTCERT. The documentation and test cover this configuration.

Changes: Snapshot CA Configuration

Layer / File(s)	Summary
Configure and use the snapshot CA `docs/selfhost-ci-deploy.md`, `scripts/selfhost/ci-deploy.sh`, `scripts/selfhost/tests/test_ci_deploy.py`	The script clears inherited `PGSSLROOTCERT` for each database. When a database config supplies `ca`, it fetches the configured ConfigMap key into a temporary file, fails if the file is missing or empty, and sets `PGSSLROOTCERT` for the dump. The guide documents this setup, and the test checks that the dump receives the CA file.

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Feature

Sequence Diagram(s)

sequenceDiagram
  participant DeployScript as ci-deploy.sh
  participant kubectl
  participant pgDump as pg_dump
  DeployScript->>kubectl: Get configured ConfigMap key
  kubectl-->>DeployScript: Return CA certificate data
  DeployScript->>pgDump: Run dump with PGSSLROOTCERT

Possibly related PRs

AgentWorkforce/infra#241: Introduces the per-database PostgreSQL snapshot flow that this change extends.

Merge Risk: Minimal · previous review 726ff

This change lets pg_dump snapshots verify TLS against a CA stored in a same-namespace ConfigMap. No merge-blocking risk was found. Real TLS verification was exercised only through mocks.

Pre-merge checks: 4

Check name	Status	Explanation
Title check		The title names the main change: pg_dump snapshots can verify TLS against the application's CA, supplied from a ConfigMap. The raw summary confirms the script adds an optional per-database CA that is …
Description check		The description explains the problem: production snapshots use sslmode=verify-full, but the CodeBuild job lacks the Supabase CA. It states the new ca: {configMap, key} setting for pg_dump entries, whi…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Title check

Explanation

The title names the main change: pg_dump snapshots can verify TLS against the application's CA, supplied from a ConfigMap. The raw summary confirms the script adds an optional per-database CA that is exported as PGSSLROOTCERT for pg_dump. The title is specific and matches the changeset. It is conventional in form and under 100 characters.

Full details: Description check

Explanation

The description explains the problem: production snapshots use sslmode=verify-full, but the CodeBuild job lacks the Supabase CA. It states the new ca: {configMap, key} setting for pg_dump entries, which is exported as PGSSLROOTCERT. This matches the script and documentation changes in the summary. It also mentions the new test and shellcheck results.

Finishing Touches

Generate unit tests (beta)

Commit to this branch
Create a new PR

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

_{A rabbit checks the CA key
Then sets the path for dumps to see
The ConfigMap shares its root
pg_dump gets the certificate route
And snapshots hop along securely.}

Recent review info

Run configuration

Source mode: Auto

Repository: Unavailable

Branch: Unavailable

File: No configuration file from this repository applied

Commit: Unavailable

Layers: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: `37dd6c0d-7edb-4bec-aabb-1b1188a8cffa`

Commits

Reviewing files that changed from the base of the PR and between `adf958a` and `726ff68`.

Files selected for processing: 3

`docs/selfhost-ci-deploy.md`

`scripts/selfhost/ci-deploy.sh`

`scripts/selfhost/tests/test_ci_deploy.py`

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

devin-ai-integration

Devin Review found 2 potential issues.

1 flag not posted on this PR by your GitHub settings — view it in Devin Review. (Configure)

devin-ai-integration · 2026-11-11T22:27:25Z

native_control

+        if [ -n "$ca" ]; then
+          kubectl -n "$ns" get configmap "${ca%%/*}" -o json | jq -j --arg k "${ca#*/}" '.data[$k] // empty' > "$WORK/pg-ca-$name.crt"
+          [ -s "$WORK/pg-ca-$name.crt" ] || die "snapshot $name: CA ConfigMap $ca is empty or missing"
+          export PGSSLROOTCERT="$WORK/pg-ca-$name.crt"


🟡 Database URL overrides configured snapshot CA

When a database URL contains a pod-only sslrootcert path, PGSSLROOTCERT cannot override it. Libpq prioritizes URL parameters, so pg_dump fails to read the CA and blocks the apply.

Learn more

A snapshot URL can include an explicit sslrootcert option, as native_control constructs for an application pod. Libpq uses explicit connection-string options before environment defaults. CodeBuild does not mount the application's /etc/postgres-ca/ca.crt, so setting PGSSLROOTCERT to the downloaded ConfigMap file does not help that URL. The snapshot fails before the Helm upgrade.

Example: A Secret holds postgresql://user:pass@db.example.test/app?sslmode=verify-full&sslrootcert=/etc/postgres-ca/ca.crt. The ConfigMap CA is downloaded to a temporary file, but pg_dump still opens /etc/postgres-ca/ca.crt and exits instead of completing the snapshot.

Recommended fix: For a database entry with ca, use a connection string for pg_dump that removes or replaces any explicit sslrootcert parameter with the downloaded path, without logging or exposing the URL. Add a test with an explicit pod-only sslrootcert URL.

Was this helpful? React with 👍 or 👎 to provide feedback.

devin-ai-integration · 2026-11-11T22:27:26Z

+    def test_pg_dump_uses_configured_ca(self):
+        self.render({"a": 2}, DEPLOY)
+        self.config({"type": "pg_dump", "databases": [{"label": "control", "namespace": "ns", "secret": "db", "key": "url",
+                                                        "ca": {"configMap": "supabase-ca", "key": "ca.crt"}}]})


🟡 Production CA identifier committed in test

The new fixture names supabase-ca, the production CA ConfigMap, rather than an obviously fake resource. Repository contribution rules prohibit production identifiers in tests.

Suggested change

"ca": {"configMap": "supabase-ca", "key": "ca.crt"}}]})

"ca": {"configMap": "example-test-ca", "key": "ca.crt"}}]})

Was this helpful? React with 👍 or 👎 to provide feedback.

greptile-apps · 2026-11-11T22:28:21Z

Confidence Score: 5/5

[Medium impact] The PR appears safe to merge; no blocking findings remain.

Summary

Adds an optional CA ConfigMap for pg_dump snapshots and replaces pod-only sslrootcert paths.

Postgres snapshots can use a ConfigMap CA to verify TLS.

_{Reviews (3) · Last reviewed commit: "fix(ci-deploy): balance the URL rewrite ..." · Reviewed by Greptile}

… tests libpq prefers a URL sslrootcert over PGSSLROOTCERT, so a pod-only path in the URL would have defeated the configured CA. Tests use a fake ConfigMap name and assert the exact PEM bytes. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

devin-ai-integration Bot reviewed Nov 11, 2026

View reviewed changes

greptile-apps Bot reviewed Nov 11, 2026

View reviewed changes

Comment thread scripts/selfhost/tests/test_ci_deploy.py Resolved

greptile-apps Bot reviewed Nov 11, 2026

View reviewed changes

Comment thread scripts/selfhost/ci-deploy.sh Resolved

khaliqgant and others added 2 commits November 11, 2026 14:37

fix(ci-deploy): keep percent-encoding when rewriting the snapshot URL

ca098bd

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

fix(ci-deploy): balance the URL rewrite expression

15aa78e

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

greptile-apps Bot reviewed Nov 11, 2026

View reviewed changes

Comment thread scripts/selfhost/ci-deploy.sh Resolved

khaliqgant merged commit 63300f0 into main Nov 11, 2026
9 checks passed

Navigation Menu

Repository navigation

feat(ci-deploy): pg_dump snapshots verify TLS with the application's CA ConfigMap - #244

feat(ci-deploy): pg_dump snapshots verify TLS with the application's CA ConfigMap#244
khaliqgant merged 4 commits into
mainfrom
feat/ci-deploy-pgdump-ca

khaliqgant commented Nov 11, 2026 •

edited by cubic-dev-ai Bot

Loading

Uh oh!

chatgpt-codex-connector Bot commented Nov 11, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Nov 11, 2026 •

edited

Loading

Review limit reached

Sequence Diagram(s)

Uh oh!

devin-ai-integration Bot left a comment

Uh oh!

devin-ai-integration Bot Nov 11, 2026

Uh oh!

devin-ai-integration Bot Nov 11, 2026

Uh oh!

greptile-apps Bot commented Nov 11, 2026 •

edited

Loading

Summary

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

	"ca": {"configMap": "supabase-ca", "key": "ca.crt"}}]})
	"ca": {"configMap": "example-test-ca", "key": "ca.crt"}}]})

Conversation

khaliqgant commented Nov 11, 2026 • edited by cubic-dev-ai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by cubic

Uh oh!

chatgpt-codex-connector Bot commented Nov 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coderabbitai Bot commented Nov 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review limit reached

Sequence Diagram(s)

Uh oh!

devin-ai-integration Bot left a comment

Choose a reason for hiding this comment

Uh oh!

devin-ai-integration Bot Nov 11, 2026

Choose a reason for hiding this comment

Uh oh!

devin-ai-integration Bot Nov 11, 2026

Choose a reason for hiding this comment

Uh oh!

greptile-apps Bot commented Nov 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Confidence Score: 5/5

Summary

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

khaliqgant commented Nov 11, 2026 •

edited by cubic-dev-ai Bot

Loading

chatgpt-codex-connector Bot commented Nov 11, 2026 •

edited

Loading

coderabbitai Bot commented Nov 11, 2026 •

edited

Loading

greptile-apps Bot commented Nov 11, 2026 •

edited

Loading