feat: Helm chart and Dockerfile for Kubernetes deployment

Adds a Helm chart at `deploy/helm/postgresql-trino-gateway/` and a
multi-stage Dockerfile at `docker/Dockerfile`. Patterned on the
`stackable-ui` chart layout (the closest sibling — this is an app,
not a CRD-bearing operator).

Chart highlights:

- Service is ClusterIP/TCP/5432; PG protocol is L4, so no ingress
  template (the README documents port-forward, LoadBalancer, and
  L4-aware ingress as the three exposure paths).
- Probes are TCP socket against the listening port — the gateway
  has no HTTP health endpoint.
- Listener TLS is sourced from either a Stackable SecretClass
  (`tls.secretClass`, mounted via secret-operator ephemeral volume)
  or a pre-existing `kubernetes.io/tls` Secret (`tls.existingSecret`).
  Setting both is rejected at template time.
- Five `fail` pre-checks reject misconfigurations at template-time
  rather than as a CrashLoopBackOff: missing trino.host, both TLS
  sources set, auth.enabled without TLS, auth.enabled=false without
  allowInsecureListener (the pod IP is non-loopback in K8s),
  auth.enabled=true with HTTP Trino but no allowPlaintextAuth.
- `shutdownDrainTimeoutSecs=25` < `terminationGracePeriodSeconds=30`
  so the gateway can abort stuck connections before the kubelet
  sends SIGKILL.
- `helm lint` clean; `helm template` rendering verified for the
  default, secret-operator, and existing-Secret paths.

Dockerfile builds the release binary in a vanilla Rust 1.93 image
and packages it into UBI 10 minimal with a non-root stackable user
(uid 782252253, gid 574654813 — the SDP convention). The builder
image is overridable via `--build-arg BUILDER_IMAGE=` so internal
SDP CI can swap in `oci.stackable.tech/sdp/ubi9-rust-builder:latest`.

Author: lfrancke

deploy/helm/postgresql-trino-gateway/.helmignore

@@ -0,0 +1,24 @@
+# Patterns to ignore when building packages.
+# Uses the same syntax as .gitignore.
+
+# Common backups, editor leftovers, OS noise.
+.DS_Store
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+*.swp
+*.bak
+*.tmp
+*.orig
+*~
+# Helm itself.
+.project
+.idea/
+*.tmproj
+.vscode/
+# Per-chart README sources, if any.
+README.md.gotmpl

deploy/helm/postgresql-trino-gateway/Chart.yaml

@@ -0,0 +1,20 @@
+---
+apiVersion: v2
+name: postgresql-trino-gateway
+description: PostgreSQL wire-protocol gateway in front of Trino, enabling Power BI DirectQuery and other PG-only clients.
+type: application
+version: 0.0.0-dev
+appVersion: "0.0.0-dev"
+home: https://stackable.tech
+sources:
+  - https://github.com/stackabletech/postgresql-trino-gateway
+maintainers:
+  - name: Stackable GmbH
+    email: info@stackable.tech
+    url: https://stackable.tech
+keywords:
+  - stackable
+  - trino
+  - postgresql
+  - gateway
+  - powerbi

deploy/helm/postgresql-trino-gateway/README.md

@@ -0,0 +1,103 @@
+# PostgreSQL-Trino Gateway Helm Chart
+
+Deploys the [PostgreSQL-Trino Gateway](https://github.com/stackabletech/postgresql-trino-gateway) on Kubernetes.
+
+## Quick start
+
+```bash
+# Minimal install — gateway forwards to Trino at trino.example.com:8443
+helm install gw ./deploy/helm/postgresql-trino-gateway \
+    --set trino.host=trino.example.com \
+    --set trino.port=8443
+
+# Verify
+kubectl get svc -l app.kubernetes.io/name=postgresql-trino-gateway
+
+# Connect via port-forward
+kubectl port-forward svc/gw-postgresql-trino-gateway 5432:5432
+psql -h 127.0.0.1 -p 5432 -U trino -d memory
+```
+
+## Auth and TLS postures
+
+The gateway has two security planes — a listener side (PG clients →
+gateway) and a Trino side (gateway → Trino). The chart exposes the same
+matrix the binary's `--auth` / TLS flags do.
+
+| Listener auth | Listener TLS | Posture | When to use |
+|---|---|---|---|
+| off | n/a | `auth.allowInsecureListener=true` (default) | Trusted network, NetworkPolicy gates access, or Trino itself authenticates |
+| on  | required | `auth.enabled=true` plus `tls.secretClass` or `tls.existingSecret` | Production; cleartext passwords are forwarded to Trino as Basic auth over TLS |
+| on  | not set | refused at startup | Chart-level pre-check fails |
+
+Listener TLS materials can come from one of:
+
+- `tls.secretClass` — a Stackable SecretClass; the secret-operator
+  provisions a per-pod cert at `/stackable/listener-tls/{tls.crt,tls.key}`.
+- `tls.existingSecret` — a pre-existing `kubernetes.io/tls` Secret
+  (with `tls.crt` and `tls.key` keys), mounted at the same path.
+
+Set at most one. Setting both is rejected at template time.
+
+### Trino-side TLS
+
+`trino.ssl=true` connects to Trino over HTTPS using the system trust
+store. For private CAs, either set `trino.tlsNoVerify=true` (skips
+verification entirely) or rebuild the image with the CA injected into
+`/etc/pki/ca-trust/source/anchors/`. First-class custom-CA support is
+not configured here.
+
+`trino.allowPlaintextAuth=true` is required when `auth.enabled=true`
+and `trino.ssl=false` (cleartext password forwarded to Trino over plain
+HTTP). Use only with a loopback or otherwise-trusted Trino.
+
+## Connectivity
+
+The Service is `ClusterIP` on TCP/5432 by default. PG protocol is not
+HTTP, so a standard ingress controller does not apply. Three ways to
+expose the gateway outside the cluster:
+
+1. `kubectl port-forward` — for development or ad-hoc Power BI Desktop.
+2. `service.type=LoadBalancer` — gives the Service an external L4 IP.
+3. An L4-aware ingress (e.g. nginx with `tcp-services`) or a
+   `Gateway` resource using a TCPRoute.
+
+## Probes
+
+Both readiness and liveness use TCP socket probes against the listening
+port. The gateway has no HTTP health endpoint — it speaks only PG wire
+protocol.
+
+## Graceful shutdown
+
+`terminationGracePeriodSeconds` controls how long Kubernetes waits
+after SIGTERM before SIGKILL. `shutdownDrainTimeoutSecs` controls how
+long the gateway itself waits for in-flight queries to complete before
+aborting them. The chart defaults are 30 and 25 respectively, leaving a
+5-second safety margin under the kubelet's SIGKILL.
+
+## Values reference
+
+See `values.yaml` for the full list. Notable groups:
+
+- `image.*` — registry, repo, tag, pull policy, pull secrets.
+- `service.*` — type, port, target port, annotations.
+- `resources.*` — CPU/memory requests and limits.
+- `trino.*` — backend host, port, catalog, schema, user, SSL/auth flags.
+- `auth.*` — listener-side authentication enable, insecure-listener opt-in.
+- `tls.*` — listener TLS source (secretClass or existingSecret).
+- `livenessProbe`, `readinessProbe`, `startupProbe` — TCP socket probes.
+- `podSecurityContext`, `securityContext` — non-root, read-only root FS,
+  drop ALL capabilities.
+- `maxConnections` — concurrent connection cap.
+- `logLevel` — `RUST_LOG` value (e.g. `postgresql_trino_gateway=debug`).
+
+## Uninstall
+
+```bash
+helm uninstall gw
+```
+
+The chart creates only namespaced resources (Deployment, Service,
+ServiceAccount, optional Secret pull-through). No CRDs, no
+cluster-scoped resources.

deploy/helm/postgresql-trino-gateway/templates/NOTES.txt

@@ -0,0 +1,38 @@
+{{ .Chart.Name }} {{ .Chart.AppVersion }} installed as release {{ .Release.Name }}.
+
+Gateway is listening on port {{ .Values.service.port }}, forwarding to:
+  Trino:    {{ if .Values.trino.ssl }}https{{ else }}http{{ end }}://{{ .Values.trino.host }}:{{ .Values.trino.port }}
+  Catalog:  {{ .Values.trino.catalog }}
+  Schema:   {{ .Values.trino.schema }}
+
+Auth posture:
+{{- if .Values.auth.enabled }}
+  - Cleartext password challenge to PG clients, forwarded to Trino as Basic auth.
+  {{- if eq (include "postgresql-trino-gateway.tlsEnabled" .) "true" }}
+  - Listener TLS: enabled (plaintext clients refused at handshake).
+  {{- else }}
+  - Listener TLS: NOT configured. The gateway will refuse to start.
+  {{- end }}
+{{- else }}
+  - No client auth. Every connection runs as Trino user "{{ .Values.trino.user }}".
+  - Restrict access via NetworkPolicy in this posture.
+{{- end }}
+
+Connect from inside the cluster:
+
+  psql -h {{ include "postgresql-trino-gateway.fullname" . }}.{{ .Release.Namespace }}.svc.cluster.local \
+       -p {{ .Values.service.port }} \
+       -U {{ .Values.trino.user }} \
+       -d {{ .Values.trino.catalog }}
+
+Connect from outside (port-forward):
+
+  kubectl --namespace {{ .Release.Namespace }} port-forward svc/{{ include "postgresql-trino-gateway.fullname" . }} {{ .Values.service.port }}:{{ .Values.service.port }}
+  psql -h 127.0.0.1 -p {{ .Values.service.port }} -U {{ .Values.trino.user }} -d {{ .Values.trino.catalog }}
+
+For Power BI Report Server in DirectQuery mode, point the PostgreSQL
+connector at the Service host/port above (or expose via an L4
+LoadBalancer if Power BI runs outside the cluster).
+
+Enable verbose logging by setting `logLevel=postgresql_trino_gateway=debug`
+or `=trace` in values.yaml.

deploy/helm/postgresql-trino-gateway/templates/_helpers.tpl

@@ -0,0 +1,83 @@
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "postgresql-trino-gateway.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited
+to this (by the DNS naming spec).
+*/}}
+{{- define "postgresql-trino-gateway.fullname" -}}
+{{- if .Values.fullnameOverride }}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- $name := default .Chart.Name .Values.nameOverride }}
+{{- if contains $name .Release.Name }}
+{{- .Release.Name | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end }}
+{{- end }}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "postgresql-trino-gateway.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Common labels
+*/}}
+{{- define "postgresql-trino-gateway.labels" -}}
+helm.sh/chart: {{ include "postgresql-trino-gateway.chart" . }}
+{{ include "postgresql-trino-gateway.selectorLabels" . }}
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+stackable.tech/vendor: stackable
+{{- end }}
+
+{{/*
+Selector labels
+*/}}
+{{- define "postgresql-trino-gateway.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "postgresql-trino-gateway.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+app.kubernetes.io/component: gateway
+{{- end }}
+
+{{/*
+Service account name to use.
+*/}}
+{{- define "postgresql-trino-gateway.serviceAccountName" -}}
+{{- if .Values.serviceAccount.create }}
+{{- default (include "postgresql-trino-gateway.fullname" .) .Values.serviceAccount.name }}
+{{- else }}
+{{- default "default" .Values.serviceAccount.name }}
+{{- end }}
+{{- end }}
+
+{{/*
+Container image reference.
+*/}}
+{{- define "postgresql-trino-gateway.image" -}}
+{{- if .Values.image.registry }}
+{{- printf "%s/%s:%s" .Values.image.registry .Values.image.repository (.Values.image.tag | default .Chart.AppVersion) }}
+{{- else }}
+{{- printf "%s:%s" .Values.image.repository (.Values.image.tag | default .Chart.AppVersion) }}
+{{- end }}
+{{- end }}
+
+{{/*
+True iff a listener TLS source is configured. Used to gate volume,
+mount, and CLI-flag rendering on a single decision.
+*/}}
+{{- define "postgresql-trino-gateway.tlsEnabled" -}}
+{{- if or .Values.tls.secretClass .Values.tls.existingSecret -}}true{{- end -}}
+{{- end }}