From a07b2c30b0366e44a469fa85960674a32c79c1af Mon Sep 17 00:00:00 2001 From: "devin-ai-integration[bot]" <158243242+devin-ai-integration[bot]@users.noreply.github.com> Date: Thu, 20 Aug 2026 16:03:32 -0700 Subject: [PATCH] feat(helm): compose DATABASE_URL_READ_REPLICA from a reader host secret key (#37109) * feat(helm): compose DATABASE_URL_READ_REPLICA from a reader host secret key Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> * test(helm): cover reader host composition and readReplicaUrlKey precedence Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> * fix(helm): suppress unused reader host env when readReplicaUrlKey is set Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> * fix(helm): emit reader host only when readReplicaUrl composition is active Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> --------- Co-authored-by: milan Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> Co-authored-by: Yassin Kortam --- helm/litellm-helm/templates/deployment.yaml | 7 ++ helm/litellm-helm/tests/deployment_tests.yaml | 90 +++++++++++++++++++ helm/litellm-helm/values.yaml | 8 ++ 3 files changed, 105 insertions(+) diff --git a/helm/litellm-helm/templates/deployment.yaml b/helm/litellm-helm/templates/deployment.yaml index 32bfa4b2647..52ffd117535 100644 --- a/helm/litellm-helm/templates/deployment.yaml +++ b/helm/litellm-helm/templates/deployment.yaml @@ -100,6 +100,13 @@ spec: - name: DATABASE_URL value: {{ .Values.db.url | quote }} {{- end }} + {{- if and .Values.db.useExisting .Values.db.readReplicaUrl .Values.db.secret.readReplicaEndpointKey (not .Values.db.secret.readReplicaUrlKey) }} + - name: DATABASE_READER_HOST + valueFrom: + secretKeyRef: + name: {{ .Values.db.secret.name }} + key: {{ .Values.db.secret.readReplicaEndpointKey }} + {{- end }} {{- if and .Values.db.useExisting .Values.db.secret.readReplicaUrlKey }} - name: DATABASE_URL_READ_REPLICA valueFrom: diff --git a/helm/litellm-helm/tests/deployment_tests.yaml b/helm/litellm-helm/tests/deployment_tests.yaml index b11c445889e..ee946038202 100644 --- a/helm/litellm-helm/tests/deployment_tests.yaml +++ b/helm/litellm-helm/tests/deployment_tests.yaml @@ -80,6 +80,96 @@ tests: secretKeyRef: name: my-secret key: my-key + - it: should inject DATABASE_READER_HOST from readReplicaEndpointKey before DATABASE_URL_READ_REPLICA + template: deployment.yaml + set: + db: + deployStandalone: false + useExisting: true + secret: + name: postgres + usernameKey: username + passwordKey: password + readReplicaEndpointKey: reader-host + readReplicaUrl: postgresql://$(DATABASE_USERNAME):$(DATABASE_PASSWORD)@$(DATABASE_READER_HOST):5432/$(DATABASE_NAME)?sslmode=require + asserts: + - contains: + path: spec.template.spec.containers[0].env + content: + name: DATABASE_READER_HOST + valueFrom: + secretKeyRef: + name: postgres + key: reader-host + - contains: + path: spec.template.spec.containers[0].env + content: + name: DATABASE_URL_READ_REPLICA + value: postgresql://$(DATABASE_USERNAME):$(DATABASE_PASSWORD)@$(DATABASE_READER_HOST):5432/$(DATABASE_NAME)?sslmode=require + # $(VAR) interpolation only resolves vars defined EARLIER in the env + # array, so the reader host must precede the composed URL + - equal: + path: spec.template.spec.containers[0].env[7].name + value: DATABASE_READER_HOST + - equal: + path: spec.template.spec.containers[0].env[8].name + value: DATABASE_URL_READ_REPLICA + - it: should omit reader host when readReplicaUrl is unset + template: deployment.yaml + set: + db: + deployStandalone: false + useExisting: true + secret: + name: postgres + usernameKey: username + passwordKey: password + readReplicaEndpointKey: reader-host + asserts: + - notContains: + path: spec.template.spec.containers[0].env + content: + name: DATABASE_READER_HOST + valueFrom: + secretKeyRef: + name: postgres + key: reader-host + - it: should prefer readReplicaUrlKey over readReplicaEndpointKey composition + template: deployment.yaml + set: + db: + useExisting: true + secret: + name: postgres + usernameKey: username + passwordKey: password + readReplicaUrlKey: reader-url + readReplicaEndpointKey: reader-host + readReplicaUrl: postgresql://ignored + asserts: + - contains: + path: spec.template.spec.containers[0].env + content: + name: DATABASE_URL_READ_REPLICA + valueFrom: + secretKeyRef: + name: postgres + key: reader-url + - notContains: + path: spec.template.spec.containers[0].env + content: + name: DATABASE_URL_READ_REPLICA + value: postgresql://ignored + # the unused reader-host secret ref must be suppressed so a missing + # key can't fail pod creation + - notContains: + path: spec.template.spec.containers[0].env + content: + name: DATABASE_READER_HOST + valueFrom: + secretKeyRef: + name: postgres + key: reader-host - it: should work with extraEnvVars template: deployment.yaml set: diff --git a/helm/litellm-helm/values.yaml b/helm/litellm-helm/values.yaml index 4ef8fc97b27..f8df98de102 100644 --- a/helm/litellm-helm/values.yaml +++ b/helm/litellm-helm/values.yaml @@ -277,6 +277,14 @@ db: # written to db.readReplicaUrl ends up visible in the rendered pod spec # and the Helm release secret. readReplicaUrlKey: "" + # Optional: when set, a DATABASE_READER_HOST env var is sourced from this + # secret key, so db.readReplicaUrl can compose the reader URL from + # individual secret components, e.g. + # postgresql://$(DATABASE_USERNAME):$(DATABASE_PASSWORD)@$(DATABASE_READER_HOST):5432/$(DATABASE_NAME) + # Use this when your secret store holds the bare reader hostname rather + # than a full connection URL. Only takes effect when readReplicaUrl is + # set; ignored when readReplicaUrlKey is set. + readReplicaEndpointKey: "" # Optional read-replica routing. When set, the proxy sends read-only # queries (find_*, count, group_by, query_raw/_first) to this URL while