Skip to content

ROSAENG-130 - feat: add database SSL mode configuration to helm chart #99

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
cdoan1 wants to merge 1 commit into
base: main
Choose a base branch
from
+7 −1
Open

ROSAENG-130 - feat: add database SSL mode configuration to helm chart #99

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 2 additions & 1 deletion charts/templates/deployment.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -49,7 +49,7 @@ spec:
- name: db-migrate
image: "{{ .Values.image.registry }}/{{ .Values.image.repository }}:{{ .Values.image.tag }}"
imagePullPolicy: {{ .Values.image.pullPolicy }}
command: ["/app/hyperfleet-api", "migrate"]
command: ["/app/hyperfleet-api", "migrate", "--db-sslmode={{ .Values.database.sslMode | default "prefer" }}"]
env:
# Config file from ConfigMap
- name: HYPERFLEET_CONFIG
Expand All @@ -71,6 +71,7 @@ spec:
# Simple command - configuration via ConfigMap and environment variables
args:
- serve
- --db-sslmode={{ .Values.database.sslMode | default "prefer" }}
ports:
- name: http
containerPort: {{ .Values.ports.api | default 8000 }}
Expand Down
5 changes: 5 additions & 0 deletions charts/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -215,6 +215,11 @@ database:
# For DEVELOPMENT: Use built-in PostgreSQL pod
# Set postgresql.enabled=true (default)

# SSL mode for database connections
# Options: disable, allow, prefer, require, verify-ca, verify-full
# For production, use "require" or higher
sslMode: "prefer"

Comment on lines +218 to +222
Copy link
Copy Markdown

@coderabbitai coderabbitai bot Mar 31, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

Set a secure default for database.sslMode.

Line 221 sets sslMode: "prefer", which can downgrade to non-TLS if the server allows it. For a production-safe baseline, this should default to "require".

Suggested change 
-  sslMode: "prefer"
+  sslMode: "require"
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
# SSL mode for database connections
# Options: disable, allow, prefer, require, verify-ca, verify-full
# For production, use "require" or higher
sslMode: "prefer"
# SSL mode for database connections
# Options: disable, allow, prefer, require, verify-ca, verify-full
# For production, use "require" or higher
sslMode: "require"
🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In `@charts/values.yaml` around lines 218 - 222, The default database SSL mode
currently set by the value sslMode: "prefer" is insecure for production because
it can fall back to plaintext; change the default value for the configuration
key named sslMode under database to "require" (one of the allowed options:
disable, allow, prefer, require, verify-ca, verify-full) so connections must use
TLS by default; update any related documentation lines or comments near the
sslMode key to reflect the new secure default.

# External database configuration (production)
external:
enabled: false
Expand Down