devin-ai-integration[bot] b5bf09d22d fix(db): carry DATABASE_SSLMODE/DATABASE_SSLROOTCERT into the assembled writer and reader URLs (#40815) ... * fix(db): carry DATABASE_SSLMODE/DATABASE_SSLROOTCERT into the assembled writer and reader URLs The componentized gateway supervisor starts the in-container PgBouncer from the DATABASE_URL assembled out of the discrete DATABASE_* vars before config.yaml is read, so an IAM URL had no way to request verified TLS: PgBouncer dialed the server with server_tls_sslmode = prefer (no SNI, no verification) and public RDS endpoints rejected the handshake. Two new env vars, exposed by the chart as database.writer.sslMode / sslRootCert, are appended as libpq sslmode/sslrootcert to every writer and reader URL the settings assemble (never to a pinned URL), then translated for Prisma as before. Token refresh now also carries Prisma's sslmode/sslcert/sslaccept over into the re-minted URL Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> * fix(db): keep TLS params on the CLI password URL and the initial IAM reader mint Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> * fix(db): treat DATABASE_SSLROOTCERT on its own as verify-full and cover collector and migrations TLS env Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> * test(db): type the reader mint TLS test double and drop its mutable capture Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> --------- Co-authored-by: yassin <yassin@berri.ai> Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>		2026-09-12 02:14:39 +00:00
..
litellm	fix(db): carry DATABASE_SSLMODE/DATABASE_SSLROOTCERT into the assembled writer and reader URLs (#40815)	2026-09-12 02:14:39 +00:00
litellm-helm	fix(helm): give the collector sidecar the pod PgBouncer env when database.connectionPool is enabled (#40660)	2026-09-11 02:07:04 +00:00