[HYPERSHELL-35] fix: restore self-managed gateway database fallback

[jsell-rh]

Incident

Production gateway creation returns HTTP 400 when database_id is blank and zero or multiple ManagedDatabase records exist:

database_id is required: zero or multiple ManagedDatabases exist

The deployed gateways still use their legacy per-gateway PostgreSQL workloads, so making the new CNPG assignment mandatory blocked new gateway creation before that cutover was operational.

Focused fix

This PR does not revert #154.

• The API still auto-assigns a ManagedDatabase when exactly one eligible record exists.
• If none or multiple exist, it preserves a blank database_id instead of rejecting the request.
• A blank database_id selects a narrowly scoped legacy fallback in the controller: per-gateway PostgreSQL PVC, Deployment, Service, credentials, and NetworkPolicy.
• An explicit database_id continues through the existing CNPG path unchanged.
• Legacy credentials expose both uri and url; existing passwords are preserved.
• The controller waits for the fallback database Deployment before starting the gateway.
• Credential rotation fails closed on the fallback path instead of partially rotating it.

All CNPG platform manifests, operators, APIs, database models, generated clients, and architecture from #154 remain. There are no platform database changes, schema migrations, or generated API/SDK changes in this PR.

Rollout safety

1. Deploy the control plane and wait for it to become Ready.
2. Deploy the API server and wait for it to become Ready.

Controller-first prevents the API from accepting a blank assignment before the fallback reconciler is available. Existing Running, Provisioning, and Degraded gateways remain phase-gated and are not automatically reprovisioned. Rolling back should use the reverse order: API first, then controller.

Verification

Read-only production audit

• No production mutations were made.
• The failing request was confirmed at the API boundary.
• Existing gateways retain ready per-gateway PostgreSQL Deployments, bound 5 Gi PVCs, Services, and credential Secrets.
• CNPG gateway resources are not currently available in the affected deployment.

Local Kind E2E

A gateway was created in a fleet with no ManagedDatabase, using a blank database_id.

• API create succeeded and persisted database_id: "".
• Final API state: Running / Healthy.
• Gateway, console, and PostgreSQL Deployments became Ready.
• PostgreSQL PVC bound at 5 Gi.
• Credential Secret contains POSTGRES_USER, POSTGRES_PASSWORD, POSTGRES_DB, uri, and url.
• No CNPG Cluster, Database, or DatabaseRole was created for the gateway.
• Console pod reached 2/2 Ready and its routed URL returned the expected OIDC redirect.
• Authenticated OpenShell status returned connected against gateway version 0.0.109.
• Sandbox create, readiness, command execution (fallback-sandbox-ok), and delete all succeeded.

Kind was running through its documented no-sudo high-port fallback. The local controller issuer was adjusted to include :34339; that fixture-only change is not part of this PR. Routed API, console, and authenticated gateway status were exercised directly. The sandbox lifecycle used an explicit gateway Service port-forward because the local Envoy path truncated the long-lived gRPC watch trailer.

Automated checks

• go test ./... — control plane
• go vet ./... — API server and control plane
• golangci-lint v2.12.2 — API server and control plane, 0 issues
• API gateway test package compiles with the focused tests
• git diff --check
• repository pre-push policy checks

The full API integration harness is blocked locally during shared TestMain setup by PostgreSQL password authentication, before the focused tests run.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Repository: openshift-online/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 3af3750b-eaef-4e64-81b2-da84e190362b

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}