chore: additional docs wrt replicas and clean up of some conditions

Author: sweb

deploy/helm/postgresql-trino-gateway/README.md

@@ -62,6 +62,17 @@ expose the gateway outside the cluster:
 3. An L4-aware ingress (e.g. nginx with `tcp-services`) or a
    `Gateway` resource using a TCPRoute.
 
+## Scaling
+
+`replicaCount` defaults to `1` and should not be raised without solving
+sticky routing first. The cancel registry and other per-connection
+state are in-memory per pod; a PG `CancelRequest` must land on the same
+replica as the original connection to work, and the plain `ClusterIP`
+Service this chart creates does not guarantee that (no
+`sessionAffinity`, round-robin by default). Running multiple replicas
+today means query cancellation silently no-ops for connections routed
+to the wrong pod.
+
 ## Probes
 
 Both readiness and liveness use TCP socket probes against the listening

deploy/helm/postgresql-trino-gateway/templates/NOTES.txt

@@ -1,3 +1,4 @@
+{{- $tlsEnabled := include "postgresql-trino-gateway.tlsEnabled" . }}
 {{ .Chart.Name }} {{ .Chart.AppVersion }} installed as release {{ .Release.Name }}.
 
 Gateway is listening on port {{ .Values.service.port }}, forwarding to:
@@ -8,7 +9,7 @@ Gateway is listening on port {{ .Values.service.port }}, forwarding to:
 Auth posture:
 {{- if .Values.auth.enabled }}
   - Cleartext password challenge to PG clients, forwarded to Trino as Basic auth.
-  {{- if eq (include "postgresql-trino-gateway.tlsEnabled" .) "true" }}
+  {{- if $tlsEnabled }}
   - Listener TLS: enabled (plaintext clients refused at handshake).
   {{- else }}
   - Listener TLS: NOT configured. The gateway will refuse to start.
@@ -20,15 +21,15 @@ Auth posture:
 
 Connect from inside the cluster:
 
-  psql -h {{ include "postgresql-trino-gateway.fullname" . }}.{{ .Release.Namespace }}.svc.cluster.local \
+  {{ if $tlsEnabled }}PGSSLMODE=require {{ end }}psql -h {{ include "postgresql-trino-gateway.fullname" . }}.{{ .Release.Namespace }}.svc.cluster.local \
        -p {{ .Values.service.port }} \
        -U {{ .Values.trino.user }} \
        -d {{ .Values.trino.catalog }}
 
 Connect from outside (port-forward):
 
   kubectl --namespace {{ .Release.Namespace }} port-forward svc/{{ include "postgresql-trino-gateway.fullname" . }} {{ .Values.service.port }}:{{ .Values.service.port }}
-  psql -h 127.0.0.1 -p {{ .Values.service.port }} -U {{ .Values.trino.user }} -d {{ .Values.trino.catalog }}
+  {{ if $tlsEnabled }}PGSSLMODE=require {{ end }}psql -h 127.0.0.1 -p {{ .Values.service.port }} -U {{ .Values.trino.user }} -d {{ .Values.trino.catalog }}
 
 For Power BI Report Server in DirectQuery mode, point the PostgreSQL
 connector at the Service host/port above (or expose via an L4

deploy/helm/postgresql-trino-gateway/templates/deployment.yaml

@@ -70,10 +70,10 @@ spec:
             {{- if .Values.auth.enabled }}
             - --auth
             {{- end }}
-            {{- if and (not .Values.auth.enabled) .Values.auth.allowInsecureListener }}
+            {{- if not .Values.auth.enabled }}
             - --allow-insecure-listener
             {{- end }}
-            {{- if eq (include "postgresql-trino-gateway.tlsEnabled" .) "true" }}
+            {{- if include "postgresql-trino-gateway.tlsEnabled" . }}
             - --tls-cert=/stackable/listener-tls/tls.crt
             - --tls-key=/stackable/listener-tls/tls.key
             {{- end }}
@@ -96,13 +96,13 @@ spec:
           {{- end }}
           resources:
             {{- toYaml .Values.resources | nindent 12 }}
-          {{- if eq (include "postgresql-trino-gateway.tlsEnabled" .) "true" }}
+          {{- if include "postgresql-trino-gateway.tlsEnabled" . }}
           volumeMounts:
             - name: listener-tls
               mountPath: /stackable/listener-tls
               readOnly: true
           {{- end }}
-      {{- if eq (include "postgresql-trino-gateway.tlsEnabled" .) "true" }}
+      {{- if include "postgresql-trino-gateway.tlsEnabled" . }}
       volumes:
         - name: listener-tls
           {{- if .Values.tls.secretClass }}

deploy/helm/postgresql-trino-gateway/values.yaml

@@ -1,6 +1,11 @@
 ---
 # Default values for postgresql-trino-gateway.
 
+# The cancel registry and per-connection state are in-memory (see the
+# project README). Running more than one replica requires sticky-by-
+# connection routing AND the PG CancelRequest landing on the same
+# replica as the original connection — the Service alone does not
+# guarantee this. Do not raise this without also solving that.
 replicaCount: 1
 
 image: