fix: auto-create mlflow-db-credentials from existing postgresql-credentials

Instead of failing when the mlflow-db-credentials secret is missing,
construct it from the existing postgresql-credentials secret in the
ambient-code namespace. This avoids requiring manual secret setup on
each cluster.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: Ambient Code Bot

.github/workflows/components-build-deploy.yml

@@ -294,13 +294,20 @@ jobs:
           || oc exec -n ambient-code deploy/postgresql -- \
             psql -U postgres -c "CREATE DATABASE mlflow"
 
-      - name: Verify mlflow-db-credentials secret exists
+      - name: Ensure mlflow-db-credentials secret exists
         run: |
-          if ! oc get secret mlflow-db-credentials -n redhat-ods-applications &>/dev/null; then
-            echo "::error::Secret mlflow-db-credentials not found in redhat-ods-applications."
-            echo "::error::Create it before applying the MLflow resource."
-            echo "::error::See components/manifests/base/mlflow-db-credentials-secret.yaml.example"
-            exit 1
+          if oc get secret mlflow-db-credentials -n redhat-ods-applications &>/dev/null; then
+            echo "Secret already exists"
+          else
+            echo "Creating mlflow-db-credentials from postgresql-credentials..."
+            DB_USER=$(oc get secret postgresql-credentials -n ambient-code -o jsonpath='{.data.db\.user}' | base64 -d)
+            DB_PASS=$(oc get secret postgresql-credentials -n ambient-code -o jsonpath='{.data.db\.password}' | base64 -d)
+            DB_HOST=$(oc get secret postgresql-credentials -n ambient-code -o jsonpath='{.data.db\.host}' | base64 -d)
+            DB_PORT=$(oc get secret postgresql-credentials -n ambient-code -o jsonpath='{.data.db\.port}' | base64 -d)
+            oc create namespace redhat-ods-applications --dry-run=client -o yaml | oc apply -f -
+            oc create secret generic mlflow-db-credentials \
+              -n redhat-ods-applications \
+              --from-literal=uri="postgresql://${DB_USER}:${DB_PASS}@${DB_HOST}.ambient-code.svc.cluster.local:${DB_PORT}/mlflow?sslmode=disable"
           fi
 
       - name: Deploy MLflow instance

.github/workflows/prod-release-deploy.yaml

@@ -433,13 +433,20 @@ jobs:
           || oc exec -n ambient-code deploy/postgresql -- \
             psql -U postgres -c "CREATE DATABASE mlflow"
 
-      - name: Verify mlflow-db-credentials secret exists
+      - name: Ensure mlflow-db-credentials secret exists
         run: |
-          if ! oc get secret mlflow-db-credentials -n redhat-ods-applications &>/dev/null; then
-            echo "::error::Secret mlflow-db-credentials not found in redhat-ods-applications."
-            echo "::error::Create it before applying the MLflow resource."
-            echo "::error::See components/manifests/base/mlflow-db-credentials-secret.yaml.example"
-            exit 1
+          if oc get secret mlflow-db-credentials -n redhat-ods-applications &>/dev/null; then
+            echo "Secret already exists"
+          else
+            echo "Creating mlflow-db-credentials from postgresql-credentials..."
+            DB_USER=$(oc get secret postgresql-credentials -n ambient-code -o jsonpath='{.data.db\.user}' | base64 -d)
+            DB_PASS=$(oc get secret postgresql-credentials -n ambient-code -o jsonpath='{.data.db\.password}' | base64 -d)
+            DB_HOST=$(oc get secret postgresql-credentials -n ambient-code -o jsonpath='{.data.db\.host}' | base64 -d)
+            DB_PORT=$(oc get secret postgresql-credentials -n ambient-code -o jsonpath='{.data.db\.port}' | base64 -d)
+            oc create namespace redhat-ods-applications --dry-run=client -o yaml | oc apply -f -
+            oc create secret generic mlflow-db-credentials \
+              -n redhat-ods-applications \
+              --from-literal=uri="postgresql://${DB_USER}:${DB_PASS}@${DB_HOST}.ambient-code.svc.cluster.local:${DB_PORT}/mlflow?sslmode=disable"
           fi
 
       - name: Deploy MLflow instance