Add PGSSLMODE and PGSSLROOTCERT env vars to OGX container#119
Conversation
OGX's PostgresSqlStoreConfig does not support ssl_mode or ca_cert_path fields yet (ogx-ai/ogx#5978). Configure asyncpg via standard libpq environment variables to enforce TLS with full certificate verification, achieving parity with lightspeed-stack's PostgreSQL connection security.
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
| // Postgres password for ${env.POSTGRES_PASSWORD} substitution in llama-stack config | ||
| envVars = append(envVars, buildPostgresPasswordEnvVar()) | ||
|
|
||
| // PostgreSQL SSL configuration for OGX (llama-stack). |
There was a problem hiding this comment.
nit (non-blocking): It's usually a good practice to add these things as FIXME or TODO, but I know you already opened a ticket on Jira for the follow up so we won't forget
There was a problem hiding this comment.
I hope it is ok. I'm going to /lgtm since this is non-blocking. I guess we can do a quick follow up PR if we want:).
There was a problem hiding this comment.
I will quickly add a todo
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: lpiwowar, omkarjoshi0304, umago The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-merge-bot
Bot
merged commit 651fae6
into
openstack-lightspeed:lcore-migration
3 participants
Title: Secure OGX-to-PostgreSQL connection with TLS certificate verification
Body:
Summary
PGSSLMODE=verify-fullandPGSSLROOTCERTenvironment variables to the OGX (llama-stack) container to enforce TLS with full certificate verification on the PostgreSQL connection.ssl_mode: verify-full.Why env vars instead of config fields?
OGX's
PostgresSqlStoreConfigdoes not supportssl_modeorca_cert_pathfields yet (ogx-ai/ogx#5978). There is an open upstream PR to add support (ogx-ai/ogx#5996), but it has unresolved review feedback.asyncpg(the PostgreSQL driver OGX uses) readsPGSSLMODEandPGSSLROOTCERTas fallbacks when SSL isn't configured via params directly — verified in the asyncpg source. The CA bundle is already mounted into the container.Follow-up
Once ogx-ai/ogx#5996 merges, a follow-up ticket will replace the env var workaround with native
ssl_modeandca_cert_pathconfig fields inllama_stack_config.go.Summary by CodeRabbit