From 8ea9eecaac602210c1f342dbc300bb2911a30dca Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Florian=20M=C3=BCller?= Date: Wed, 1 Jul 2026 16:20:18 +0200 Subject: [PATCH 1/2] chore: additional docs wrt replicas and clean up of some conditions --- deploy/helm/postgresql-trino-gateway/README.md | 11 +++++++++++ .../helm/postgresql-trino-gateway/templates/NOTES.txt | 7 ++++--- .../templates/deployment.yaml | 8 ++++---- deploy/helm/postgresql-trino-gateway/values.yaml | 5 +++++ 4 files changed, 24 insertions(+), 7 deletions(-) diff --git a/deploy/helm/postgresql-trino-gateway/README.md b/deploy/helm/postgresql-trino-gateway/README.md index 3ed7761..d40d614 100644 --- a/deploy/helm/postgresql-trino-gateway/README.md +++ b/deploy/helm/postgresql-trino-gateway/README.md @@ -62,6 +62,17 @@ expose the gateway outside the cluster: 3. An L4-aware ingress (e.g. nginx with `tcp-services`) or a `Gateway` resource using a TCPRoute. +## Scaling + +`replicaCount` defaults to `1` and should not be raised without solving +sticky routing first. The cancel registry and other per-connection +state are in-memory per pod; a PG `CancelRequest` must land on the same +replica as the original connection to work, and the plain `ClusterIP` +Service this chart creates does not guarantee that (no +`sessionAffinity`, round-robin by default). Running multiple replicas +today means query cancellation silently no-ops for connections routed +to the wrong pod. + ## Probes Both readiness and liveness use TCP socket probes against the listening diff --git a/deploy/helm/postgresql-trino-gateway/templates/NOTES.txt b/deploy/helm/postgresql-trino-gateway/templates/NOTES.txt index 8d35ae0..ed07524 100644 --- a/deploy/helm/postgresql-trino-gateway/templates/NOTES.txt +++ b/deploy/helm/postgresql-trino-gateway/templates/NOTES.txt @@ -1,3 +1,4 @@ +{{- $tlsEnabled := include "postgresql-trino-gateway.tlsEnabled" . }} {{ .Chart.Name }} {{ .Chart.AppVersion }} installed as release {{ .Release.Name }}. Gateway is listening on port {{ .Values.service.port }}, forwarding to: @@ -8,7 +9,7 @@ Gateway is listening on port {{ .Values.service.port }}, forwarding to: Auth posture: {{- if .Values.auth.enabled }} - Cleartext password challenge to PG clients, forwarded to Trino as Basic auth. - {{- if eq (include "postgresql-trino-gateway.tlsEnabled" .) "true" }} + {{- if $tlsEnabled }} - Listener TLS: enabled (plaintext clients refused at handshake). {{- else }} - Listener TLS: NOT configured. The gateway will refuse to start. @@ -20,7 +21,7 @@ Auth posture: Connect from inside the cluster: - psql -h {{ include "postgresql-trino-gateway.fullname" . }}.{{ .Release.Namespace }}.svc.cluster.local \ + {{ if $tlsEnabled }}PGSSLMODE=require {{ end }}psql -h {{ include "postgresql-trino-gateway.fullname" . }}.{{ .Release.Namespace }}.svc.cluster.local \ -p {{ .Values.service.port }} \ -U {{ .Values.trino.user }} \ -d {{ .Values.trino.catalog }} @@ -28,7 +29,7 @@ Connect from inside the cluster: Connect from outside (port-forward): kubectl --namespace {{ .Release.Namespace }} port-forward svc/{{ include "postgresql-trino-gateway.fullname" . }} {{ .Values.service.port }}:{{ .Values.service.port }} - psql -h 127.0.0.1 -p {{ .Values.service.port }} -U {{ .Values.trino.user }} -d {{ .Values.trino.catalog }} + {{ if $tlsEnabled }}PGSSLMODE=require {{ end }}psql -h 127.0.0.1 -p {{ .Values.service.port }} -U {{ .Values.trino.user }} -d {{ .Values.trino.catalog }} For Power BI Report Server in DirectQuery mode, point the PostgreSQL connector at the Service host/port above (or expose via an L4 diff --git a/deploy/helm/postgresql-trino-gateway/templates/deployment.yaml b/deploy/helm/postgresql-trino-gateway/templates/deployment.yaml index 3481409..6e03469 100644 --- a/deploy/helm/postgresql-trino-gateway/templates/deployment.yaml +++ b/deploy/helm/postgresql-trino-gateway/templates/deployment.yaml @@ -70,10 +70,10 @@ spec: {{- if .Values.auth.enabled }} - --auth {{- end }} - {{- if and (not .Values.auth.enabled) .Values.auth.allowInsecureListener }} + {{- if not .Values.auth.enabled }} - --allow-insecure-listener {{- end }} - {{- if eq (include "postgresql-trino-gateway.tlsEnabled" .) "true" }} + {{- if include "postgresql-trino-gateway.tlsEnabled" . }} - --tls-cert=/stackable/listener-tls/tls.crt - --tls-key=/stackable/listener-tls/tls.key {{- end }} @@ -96,13 +96,13 @@ spec: {{- end }} resources: {{- toYaml .Values.resources | nindent 12 }} - {{- if eq (include "postgresql-trino-gateway.tlsEnabled" .) "true" }} + {{- if include "postgresql-trino-gateway.tlsEnabled" . }} volumeMounts: - name: listener-tls mountPath: /stackable/listener-tls readOnly: true {{- end }} - {{- if eq (include "postgresql-trino-gateway.tlsEnabled" .) "true" }} + {{- if include "postgresql-trino-gateway.tlsEnabled" . }} volumes: - name: listener-tls {{- if .Values.tls.secretClass }} diff --git a/deploy/helm/postgresql-trino-gateway/values.yaml b/deploy/helm/postgresql-trino-gateway/values.yaml index 2f8b80a..4f02234 100644 --- a/deploy/helm/postgresql-trino-gateway/values.yaml +++ b/deploy/helm/postgresql-trino-gateway/values.yaml @@ -1,6 +1,11 @@ --- # Default values for postgresql-trino-gateway. +# The cancel registry and per-connection state are in-memory (see the +# project README). Running more than one replica requires sticky-by- +# connection routing AND the PG CancelRequest landing on the same +# replica as the original connection — the Service alone does not +# guarantee this. Do not raise this without also solving that. replicaCount: 1 image: From badf3dfbc7407aae3f69131ae6368749a97e95f8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Florian=20M=C3=BCller?= Date: Wed, 1 Jul 2026 16:56:10 +0200 Subject: [PATCH 2/2] chore: bump --- Cargo.lock | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index 494f245..4549667 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -83,9 +83,9 @@ dependencies = [ [[package]] name = "anyhow" -version = "1.0.102" +version = "1.0.103" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "7f202df86484c868dbad7eaa557ef785d5c66295e41b460ef922eca0723b842c" +checksum = "2a4385e2e34eb35d6b3efe798b9eb88096925d87726c0798709bf56d9ed84af3" [[package]] name = "ar_archive_writer"