fix: deploy safe postgres credential diagnostics #69

Merged

morten-olsen merged 1 commit from fix/20ca7f9d-postgres-logging into main

2026-10-25 09:39:48 +01:00

morten-olsen commented

2026-10-24 21:36:07 +02:00

Owner

Summary

- postgres operator 0.0.19 / homelab-core 0.1.8
+ postgres operator 0.0.20 / homelab-core 0.1.9

Deploy postgres-operator #2, which removes credential SQL and raw driver errors from operator diagnostics. Morten approved publication and deployment.

Evidence

Before: production ran the password-bearing CREATE USER failure branch in 0.0.19.
After: actual operator uses published 0.0.20 image index sha256:4a1f2b026b92c3f322b14b987cc69ab0395a986efa5031702c1d61eb3db785c8, one ready replica/zero restarts; all 15 databases Ready and same PVC Bound.
Helm lint/render tests and cluster server dry-run pass. Woodpecker PR #148, push #147 and main #151 succeeded. Chart publication 40177514942 succeeded at 5988cf3; downloaded core 0.1.9 pins postgres 0.0.20.
Forgejo mirror current/error-free; ArgoCD core 5988cf3 and postgres 0.0.20 Synced/Healthy. Current operator log/status scan has zero credential SQL. Synthetic tests prove failure paths; no production failure injection. Final task health check HEALTHY, 82/82 Applications Synced/Healthy.

Merge danger

Door: one-way
Published Helm artifacts persist. Deployment pin is reversible. Publication/deployment explicitly approved.

Blast radius: app
One operator rollout; no credential, schema, PVC, permission or resource-limit change. Separate server-log exposure remains HIGH in HOMEIT-433.

Rollback and verification

Roll back: restore previously verified 0.0.19 image digest from HOMEIT-427; mutable tags may have rebuilt during approved recovery. Unsafe logging returns and historical logs remain.
Verify after rollout: compare actual digest, revision, replica/restarts, all 15 database phases, Bound PVC and count-only logs/status. Completed, with evidence on HOMEIT-427 and base #59.
Reviewers: Security Engineer completed HOMEIT-435, no blocking code finding. Residual server-log exposure/rotation remains HOMEIT-433; no risk accepted or rotation performed.

## Summary ```diff - postgres operator 0.0.19 / homelab-core 0.1.8 + postgres operator 0.0.20 / homelab-core 0.1.9 ``` Deploy [postgres-operator #2](https://code.olsen.cloud/homelab/postgres-operator/pulls/2), which removes credential SQL and raw driver errors from operator diagnostics. Morten approved publication and deployment. ## Evidence - **Before:** production ran the password-bearing CREATE USER failure branch in 0.0.19. **After:** actual operator uses published 0.0.20 image index `sha256:4a1f2b026b92c3f322b14b987cc69ab0395a986efa5031702c1d61eb3db785c8`, one ready replica/zero restarts; all 15 databases Ready and same PVC Bound. - Helm lint/render tests and cluster server dry-run pass. Woodpecker PR #148, push #147 and [main #151](https://woodpecker.olsen.cloud/repos/6/pipeline/151) succeeded. [Chart publication 40177514942](https://github.com/morten-olsen/homelab-core/actions/runs/40177514942) succeeded at 5988cf3; downloaded core 0.1.9 pins postgres 0.0.20. - Forgejo mirror current/error-free; ArgoCD core 5988cf3 and postgres 0.0.20 Synced/Healthy. Current operator log/status scan has zero credential SQL. Synthetic tests prove failure paths; no production failure injection. Final task health check HEALTHY, 82/82 Applications Synced/Healthy. ## Merge danger **Door:** one-way Published Helm artifacts persist. Deployment pin is reversible. Publication/deployment explicitly approved. **Blast radius:** app One operator rollout; no credential, schema, PVC, permission or resource-limit change. Separate server-log exposure remains HIGH in HOMEIT-433. ## Rollback and verification - **Roll back:** restore previously verified 0.0.19 image digest from HOMEIT-427; mutable tags may have rebuilt during approved recovery. Unsafe logging returns and historical logs remain. - **Verify after rollout:** compare actual digest, revision, replica/restarts, all 15 database phases, Bound PVC and count-only logs/status. Completed, with evidence on HOMEIT-427 and base #59. - **Reviewers:** Security Engineer completed HOMEIT-435, no blocking code finding. Residual server-log exposure/rotation remains HOMEIT-433; no risk accepted or rotation performed.

morten-olsen added 1 commit

2026-10-24 21:36:07 +02:00