Add PostgreSQL database backend option to OpenShift getting started guide

[ChristianZaccaria]

Summary

• Adds a database backend choice (SQLite or external PostgreSQL) to the Helm Installation section of the OpenShift getting started guide, presented as two clear options before installing.
• Adds a common/postgresql.yaml manifest for quickly deploying a test PostgreSQL instance on the cluster, with a note that production use cases should use a managed service. - These manifests had been created by @r3v5 :)
• Adds a uri key to the PostgreSQL credentials Secret so OpenShell can read the connection string directly without a second Secret.

Jira: RHAIENG-6587

Test plan

• Follow Option B with the provided common/postgresql.yaml manifest and verify the gateway starts with PostgreSQL.
• Confirm helm get values shows externalDbSecret and workload.kind=deployment when using Option B.

Summary by CodeRabbit

New Features

• Added Kubernetes resources for a persistent PostgreSQL database with pgvector support.
• Added secure database credentials, persistent storage, deployment, and service configuration.

Documentation

• Expanded the OpenShift setup guide with SQLite and external PostgreSQL installation options.
• Clarified prerequisites, permissions, credential setup, TLS verification, deployment modes, and connection checks.
• Added guidance for sandbox startup, inference configuration, policy testing, troubleshooting, and uninstallation.

[coderabbitai]

📝 Walkthrough

Walkthrough

Adds Kubernetes resources for a single-replica PostgreSQL 16 deployment with pgvector, persistent storage, credentials, and an internal service. Updates the OpenShift guide with SQLite and external PostgreSQL installation paths, provider configuration, verification steps, usage guidance, and troubleshooting details.

Estimated code review effort: 3 (Moderate) | ~20 minutes

🚥 Pre-merge checks | ✅ 9 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
No Hardcoded Secrets	⚠️ Warning	New common/postgresql.yaml stores POSTGRESQL_PASSWORD as openshell and embeds it in the URI; this is a functional hardcoded credential (CWE-798), not a placeholder.	Use generated or externally supplied credentials and construct the URI from Secret references; do not commit a usable password or credential-bearing URL.

✅ Passed checks (9 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes the primary change: adding a PostgreSQL database backend option to the OpenShift getting-started guide.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Contribution Quality And Spam Detection	✅ Passed	The diff is a specific PostgreSQL/docs feature, links Jira RHAIENG-6587, and shows no security-theater or code-quality signal; the author has five repository commits.
No Weak Cryptography	✅ Passed	PR diff adds no MD5, SHA-1, DES, RC4, Blowfish, ECB, custom crypto, or secret comparisons; TLS references do not select a weak primitive (CWE-327).
No Injection Vectors	✅ Passed	Changed files are YAML and Markdown; scans found no SQL interpolation, shell=True/os.system, eval/exec, unsafe deserialization, or HTML sink (CWE-78/89/94/502/79).
No Privileged Containers	✅ Passed	The new Deployment sets runAsNonRoot: true and adds no prohibited security fields; the privileged SCC command already existed in base and remains test-only documented. No CWE-250 condition was intr...
No Sensitive Data In Logs	✅ Passed	The diff adds no logging statement that emits sensitive data; the only log example shows github.com and policy metadata, while PostgreSQL credentials are manifest Secret data.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 7

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@common/postgresql.yaml`:
- Around line 6-10: Remove the hard-coded PostgreSQL Secret data, including
POSTGRESQL_USER, POSTGRESQL_PASSWORD, POSTGRESQL_DATABASE, and uri, from
common/postgresql.yaml. In guides/getting-started-openshell-openshift.md,
replace the direct application of the credential-bearing manifest with
instructions to generate and provision the PostgreSQL credential through
protected Secret management.
- Around line 40-60: Add PostgreSQL readiness and startup probes using
pg_isready to the postgresql container in common/postgresql.yaml, configured
against the container’s database and credentials. Update
guides/getting-started-openshell-openshift.md lines 115-123 to wait for and
verify the pod’s Ready condition instead of treating Running as sufficient.
- Around line 65-75: The PostgreSQL Service currently has no network-level
ingress restriction. Add a Kubernetes NetworkPolicy for the PostgreSQL pods
selected by the Service’s app label, allowing ingress on TCP port 5432 only from
the verified gateway/app pod labels, while denying other ingress and preserving
the existing Service configuration.
- Around line 38-42: Harden the PostgreSQL pod defined by the postgresql
container securityContext by setting container-level allowPrivilegeEscalation to
false, dropping all Linux capabilities, and disabling automatic service account
token mounting. Preserve runAsNonRoot and apply the restricted-profile settings
at the appropriate pod/container scope so Checkov CKV_K8S_20 passes.

In `@guides/getting-started-openshell-openshift.md`:
- Around line 95-96: Replace the inline PostgreSQL URI in the kubectl command
with secure interactive secret creation: use a mode-0600 temporary file, read
the URI silently into DB_URI, write it to the file, create the Secret with
--from-file=uri, then unset DB_URI and remove the temporary file via an EXIT
trap. Include an exploit scenario describing exposure through shell history or
process inspection and retain the required remediation commands in the guide.
- Line 74: Remove server.auth.allowUnauthenticatedUsers=true from both
installation examples, including the occurrence near the referenced second
location, so the chart retains authenticated gateway access by default. Update
the OpenShift guidance to require explicit OIDC/UserIdentityProvider
authorization instead of unauthenticated Route access.
- Line 87: The external PostgreSQL manifest is not fully pinned. Update
guides/getting-started-openshell-openshift.md:87 to reference a reviewed
commit-SHA raw URL, replace the mutable quay.io/mcampbel/pgvector:pg16 image in
common/postgresql.yaml:42 with its reviewed digest, and pin or migrate any other
remote helper artifact referenced at
guides/getting-started-openshell-openshift.md:19.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Central YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: f1102138-81d6-4a2a-bd57-b2320a05555b

📥 Commits

Reviewing files that changed from the base of the PR and between b375431 and ce874f7.

📒 Files selected for processing (2)

• common/postgresql.yaml
• guides/getting-started-openshell-openshift.md

[chtyler]

Several issues noted with the diff changes.

Also, noticed numerous issues with the non-diffed changes that could be fixed in this PR, or in a separate PR.

[ChristianZaccaria]

Hi @chtyler, thank you so much for the thorough review and advise. I've reviewed and addressed all comments, please have a look when you have a chance. Thank you!

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@guides/getting-started-openshell-openshift.md`:
- Line 124: Update the gateway pod verification guidance to replace the stale
“Namespace Setup” reference with the existing “Create the OpenShell namespace”
section, preserving the SCC troubleshooting context.
- Around line 85-91: Add an explicit warning immediately before the `oc apply`
command in the OpenShell PostgreSQL setup instructions, stating that the bundled
manifest is for isolated test clusters only, uses known credentials, and lacks
PostgreSQL TLS; require unique credentials and TLS via a managed PostgreSQL
service for shared or production clusters.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Central YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: ede9307e-2a25-4fa6-8981-c04f6d6a2596

📥 Commits

Reviewing files that changed from the base of the PR and between ce874f7 and 80af83f.

📒 Files selected for processing (1)

• guides/getting-started-openshell-openshift.md

[chtyler]

I approve these changes.

[Ygnas]

/lgtm

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: chtyler, Ygnas

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [Ygnas]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment