@rulebricks/cli 2.3.1 → 2.3.2

package/dist/lib/helmValues.js

@@ -8,8 +8,15 @@ import YAML from "yaml";
 // Names of the Kubernetes Secrets the CLI creates in k8s secret mode. Shared by
 // the value generator (which sets the secretRef fields) and src/lib/secrets.ts
 // (which creates the Secrets) so they always agree.
+//
+// The base MUST be the Helm release name, not config.name. Most chart consumers
+// read the secretRef *value* (name-agnostic), but a few templates hardcode the
+// canonical <release>-* name — e.g. templates/migration-job.yaml derives
+// DB_PASSWORD from `{{ .Release.Name }}-supabase-db`. Naming these secrets with
+// the release name keeps the CLI a faithful drop-in for the unmodified chart so
+// we never have to customize the chart to match the CLI.
 export function deploymentSecretNames(config) {
-    const base = config.name;
+    const base = getReleaseName(config.name);
     return {
         app: `${base}-app-secrets`,
         db: `${base}-supabase-db`,
@@ -2075,7 +2082,19 @@ export function buildHelmValues(config, options = {}) {
                             ingress: {
                                 enabled: true,
                                 className: "traefik",
-                                annotations: {},
+                                // The supabase subchart's kong ingress does NOT emit Traefik's
+                                // router.entrypoints/router.tls annotations the way the app
+                                // ingress does — without them Traefik only builds a web (HTTP)
+                                // router, so https://supabase.<domain> 404s and the app can't
+                                // reach Supabase. Inject them via the subchart's annotations
+                                // passthrough (kong/ingress.yaml ranges over these), matching
+                                // charts/rulebricks/templates/ingress.yaml.
+                                annotations: {
+                                    "traefik.ingress.kubernetes.io/router.entrypoints": tlsEnabled ? "websecure" : "web",
+                                    "traefik.ingress.kubernetes.io/router.tls": tlsEnabled
+                                        ? "true"
+                                        : "false",
+                                },
                             },
                         },
                         studio: {
@@ -2247,6 +2266,35 @@ export function buildHelmValues(config, options = {}) {
                 enabled: false,
             },
     };
+    // The managed-Postgres migration hook (templates/migration-job.yaml) reads the
+    // DB host/port from .Values.migrations.externalDb — a SEPARATE seam from
+    // supabase.externalDatabase.* — and its `pg_isready -h $DB_HOST` loop hangs
+    // forever (empty host) if it is unset. Wire it for external Postgres. We only
+    // set host/port: DB_PASSWORD falls back to the <release>-supabase-db secret and
+    // DB_USER/DB_NAME default to "postgres", which match deploymentSecretNames()
+    // and the bootstrap app role.
+    const migrationsPgExt = config.database.type === "self-hosted" &&
+        config.externalServices?.postgres?.mode === "external"
+        ? config.externalServices.postgres.external
+        : undefined;
+    if (migrationsPgExt) {
+        values.migrations = {
+            externalDb: {
+                host: migrationsPgExt.host ?? "",
+                // Chart schema requires a string here (the template quotes it).
+                port: String(migrationsPgExt.port ?? 5432),
+                // Run migrations as the master/app_role. The bootstrap hook creates the
+                // service login roles (authenticator, supabase_auth_admin, …) with the
+                // service password but deliberately does NOT change the master's
+                // password (bootstrap.sql runs "as the master user (named postgres)").
+                // So the migrate hook must authenticate with the MASTER credential, not
+                // the service password in <release>-supabase-db (that would 401). Point
+                // DB_PASSWORD at the bootstrap Secret's master-password.
+                existingSecret: deploymentSecretNames(config).dbBootstrap,
+                existingSecretKey: "master-password",
+            },
+        };
+    }
     // In k8s secret mode, the CLI creates Kubernetes Secrets and the chart reads
     // them by reference. Point the chart's secretRef seams at those Secrets and
     // strip every plaintext secret out of the generated values.
@@ -2277,7 +2325,13 @@ export function redactSecretsToRefs(values, config) {
     }
     if (global.supabase) {
         delete global.supabase.jwtSecret;
-        delete global.supabase.anonKey;
+        // NOTE: anonKey is intentionally NOT stripped. It is the *public* Supabase
+        // key that app-configmap.yaml embeds into the Next.js client bundle
+        // (SUPABASE_PUBLIC_KEY / NEXT_PUBLIC_SUPABASE_PUBLIC_KEY). That ConfigMap
+        // reads global.supabase.anonKey at TEMPLATE time and there is no secretRef
+        // seam for it, so stripping it leaves the browser client with an empty key.
+        // It is a public token (safe in a ConfigMap by design) and never appears in
+        // the k8s-mode secret-leak checks.
         delete global.supabase.serviceKey;
         delete global.supabase.accessToken;
     }
@@ -2287,7 +2341,16 @@ export function redactSecretsToRefs(values, config) {
         delete global.sso.clientId;
         delete global.sso.clientSecret;
     }
-    delete global.licenseKey;
+    // NOTE: licenseKey is intentionally NOT stripped. The (standard) chart builds
+    // the image-pull secret <release>-regcred from inline global.licenseKey at
+    // TEMPLATE time (templates/registry-secret.yaml -> imagePullSecret helper). A
+    // Kubernetes imagePullSecret cannot be sourced from a secretRef, so the chart
+    // has no k8s-mode seam for it — stripping it makes the chart fall back to the
+    // "evaluation" placeholder -> dckr_pat_evaluation -> 401 on every private
+    // rulebricks/* image. Standalone chart users set global.licenseKey in their own
+    // values for exactly this reason; the CLI must do the same to stay compatible
+    // with the unmodified chart. It is a Docker Hub read-only PAT and already lives
+    // in the deployment's config.yaml, so keeping it inline adds no new exposure.
     // Supabase subchart: replace each inline secret block with a secretRef.
     if (supabase.secret) {
         const dbSecret = { secretRef: names.db };
@@ -2381,6 +2444,22 @@ export async function updateHelmValuesForTLS(deploymentName, tlsEnabled) {
                 }
             }
         }
+        // Keep the supabase kong ingress on the right Traefik entrypoint. The
+        // subchart doesn't emit router.entrypoints/tls itself, so on the TLS-toggle
+        // path (not a full regen) HTTPS to supabase.<domain> would 404 without this.
+        // Mirrors what buildHelmValues sets on the kong ingress annotations.
+        const supabase = values.supabase;
+        const kongIngress = supabase?.kong
+            ?.ingress;
+        if (kongIngress && typeof kongIngress === "object") {
+            kongIngress.annotations = {
+                ...kongIngress.annotations,
+                "traefik.ingress.kubernetes.io/router.entrypoints": tlsEnabled
+                    ? "websecure"
+                    : "web",
+                "traefik.ingress.kubernetes.io/router.tls": tlsEnabled ? "true" : "false",
+            };
+        }
         // Save updated values
         await fs.writeFile(valuesPath, YAML.stringify(values), "utf8");
     }

package/dist/lib/helmValues.test.js

@@ -723,7 +723,7 @@ test("external Postgres k8s secret mode keeps compatibility and uses secret refs
     // the Secret keys below.
     assert.equal(sb.externalDatabase.host, "db.cluster-xxxx.us-east-1.rds.amazonaws.com");
     assert.equal(sb.externalDatabase.port, 5432);
-    assert.equal(sb.externalDatabase.secretRef, `${config.name}-supabase-db`);
+    assert.equal(sb.externalDatabase.secretRef, `${getReleaseName(config.name)}-supabase-db`);
     assert.deepEqual(sb.externalDatabase.secretRefKey, {
         host: "host",
         port: "port",
@@ -731,9 +731,9 @@ test("external Postgres k8s secret mode keeps compatibility and uses secret refs
         password: "password",
         database: "database",
     });
-    assert.equal(sb.externalDatabase.bootstrap.secretRef, `${config.name}-supabase-db-bootstrap`);
+    assert.equal(sb.externalDatabase.bootstrap.secretRef, `${getReleaseName(config.name)}-supabase-db-bootstrap`);
     assert.equal(sb.externalDatabase.bootstrap.masterPassword, undefined);
-    assert.equal(sb.secret.db.secretRef, `${config.name}-supabase-db`);
+    assert.equal(sb.secret.db.secretRef, `${getReleaseName(config.name)}-supabase-db`);
     assert.deepEqual(sb.secret.db.secretRefKey, {
         host: "host",
         port: "port",
@@ -750,7 +750,7 @@ test("embedded Postgres still deploys the bundled database", () => {
 });
 import { buildDeploymentSecrets } from "./secrets.js";
 import { deriveRealtimeSecrets } from "./helmValues.js";
-test("k8s secret mode: secretRefs set, zero plaintext secrets in values", () => {
+test("k8s secret mode: secretRefs set, app secrets kept out of values (license stays inline for the pull secret)", () => {
     const config = cloneFixture("aws-self-hosted-minimal");
     config.features.ai = {
         enabled: true,
@@ -765,22 +765,27 @@ test("k8s secret mode: secretRefs set, zero plaintext secrets in values", () =>
     const schemaResult = validateHelmValues(values);
     assert.ok(schemaResult.valid, `k8s secret-mode values should satisfy chart schema:\n${schemaResult.errors.join("\n")}`);
     // secretRef seams point at the CLI-created Secrets
-    assert.equal(values.global.secrets.secretRef, `${config.name}-app-secrets`);
-    assert.equal(values.supabase.secret.db.secretRef, `${config.name}-supabase-db`);
-    assert.equal(values.supabase.secret.jwt.secretRef, `${config.name}-supabase-jwt`);
-    assert.equal(values.supabase.secret.dashboard.secretRef, `${config.name}-supabase-dashboard`);
-    assert.equal(values.supabase.secret.realtime.secretRef, `${config.name}-supabase-realtime`);
-    // inline plaintext stripped
+    assert.equal(values.global.secrets.secretRef, `${getReleaseName(config.name)}-app-secrets`);
+    assert.equal(values.supabase.secret.db.secretRef, `${getReleaseName(config.name)}-supabase-db`);
+    assert.equal(values.supabase.secret.jwt.secretRef, `${getReleaseName(config.name)}-supabase-jwt`);
+    assert.equal(values.supabase.secret.dashboard.secretRef, `${getReleaseName(config.name)}-supabase-dashboard`);
+    assert.equal(values.supabase.secret.realtime.secretRef, `${getReleaseName(config.name)}-supabase-realtime`);
+    // Genuinely-sensitive app secrets are stripped (delivered via secretRef).
     assert.equal(values.global.supabase.jwtSecret, undefined);
     assert.equal(values.global.ai.openaiApiKey, undefined);
-    assert.equal(values.global.licenseKey, undefined);
-    // no secret value appears anywhere in the generated values
+    // These two MUST stay inline: the standard (unmodified) chart consumes them at
+    // Helm TEMPLATE time with no secretRef seam.
+    //  - licenseKey -> registry-secret.yaml builds the <release>-regcred pull
+    //    secret. Stripping it => dckr_pat_evaluation => 401 on every private image.
+    //  - anonKey (public) -> app-configmap.yaml NEXT_PUBLIC_SUPABASE_PUBLIC_KEY.
+    assert.equal(values.global.licenseKey, license);
+    assert.ok(values.global.supabase.anonKey, "public anonKey must remain inline in k8s mode for the app ConfigMap");
+    // The genuinely-sensitive app secrets never appear in the generated values.
     const dump = JSON.stringify(values);
     for (const [label, secret] of [
         ["db password", dbPw],
         ["jwt secret", jwt],
         ["dashboard password", dashPw],
-        ["license key", license],
         ["openai key", openai],
     ]) {
         assert.ok(!dump.includes(secret), `${label} leaked into k8s-mode values`);
@@ -797,7 +802,7 @@ test("k8s secret mode: SSO + AI configs validate against the chart schema", () =
     assert.equal(values.global.sso.clientId, undefined);
     assert.equal(values.global.sso.clientSecret, undefined);
     assert.equal(values.global.ai.openaiApiKey, undefined);
-    assert.equal(values.global.secrets.secretRef, `${config.name}-app-secrets`);
+    assert.equal(values.global.secrets.secretRef, `${getReleaseName(config.name)}-app-secrets`);
 });
 test("k8s secret mode: managed Supabase config validates against the chart schema", () => {
     // Managed (Supabase Cloud) redacts the access token into the app Secret; the
@@ -808,7 +813,7 @@ test("k8s secret mode: managed Supabase config validates against the chart schem
     assert.ok(result.valid, `k8s-mode managed-Supabase values should satisfy the chart schema:\n${result.errors.join("\n")}`);
     assert.equal(values.global.supabase.accessToken, undefined);
     assert.ok(values.global.supabase.url);
-    assert.equal(values.global.secrets.secretRef, `${config.name}-app-secrets`);
+    assert.equal(values.global.secrets.secretRef, `${getReleaseName(config.name)}-app-secrets`);
 });
 test("inline secret mode keeps secrets in values (dev path)", () => {
     const config = cloneFixture("aws-self-hosted-minimal");
@@ -824,7 +829,7 @@ test("buildDeploymentSecrets: app + supabase secrets with JWT-derived keys", ()
     const config = cloneFixture("aws-self-hosted-minimal");
     const jwt = config.database.supabaseJwtSecret;
     const byName = Object.fromEntries(buildDeploymentSecrets(config).map((s) => [s.name, s.stringData]));
-    const base = config.name;
+    const base = getReleaseName(config.name);
     assert.equal(byName[`${base}-app-secrets`].LICENSE_KEY, config.licenseKey);
     assert.equal(byName[`${base}-supabase-db`].password, config.database.supabaseDbPassword);
     assert.equal(byName[`${base}-supabase-jwt`].anonKey, signSupabaseJwt("anon", jwt));
@@ -837,7 +842,7 @@ test("buildDeploymentSecrets: app + supabase secrets with JWT-derived keys", ()
 test("buildDeploymentSecrets includes external Postgres host/port and bootstrap creds", () => {
     const config = cloneFixture("aws-external-postgres");
     const byName = Object.fromEntries(buildDeploymentSecrets(config).map((s) => [s.name, s.stringData]));
-    const base = config.name;
+    const base = getReleaseName(config.name);
     assert.deepEqual(byName[`${base}-supabase-db`], {
         username: "postgres",
         password: config.database.supabaseDbPassword,
@@ -851,6 +856,47 @@ test("buildDeploymentSecrets includes external Postgres host/port and bootstrap
         "service-password": config.database.supabaseDbPassword,
     });
 });
+test("external Postgres wires migrations.externalDb host/port for the migration hook", () => {
+    // templates/migration-job.yaml reads DB_HOST from .Values.migrations.externalDb
+    // (not supabase.externalDatabase). If unset, pg_isready gets an empty host and
+    // the migrate hook hangs until Helm times out. Guards that regression.
+    const config = cloneFixture("aws-external-postgres");
+    const values = buildHelmValues(config, { secretMode: "k8s" });
+    assert.ok(values.migrations?.externalDb, "migrations.externalDb must be set for external Postgres");
+    assert.ok(values.migrations.externalDb.host, "migration-hook DB_HOST must be non-empty");
+    assert.equal(values.migrations.externalDb.host, values.supabase.externalDatabase.host);
+    assert.equal(values.migrations.externalDb.port, "5432");
+    // Migrations run as the master (bootstrap only sets service-role passwords, not
+    // the master's), so DB_PASSWORD must come from the bootstrap Secret's
+    // master-password, NOT the service password in <release>-supabase-db.
+    assert.equal(values.migrations.externalDb.existingSecret, `${getReleaseName(config.name)}-supabase-db-bootstrap`);
+    assert.equal(values.migrations.externalDb.existingSecretKey, "master-password");
+    // Bundled-Postgres deploys must NOT set it (chart uses the internal service).
+    const internal = buildHelmValues(cloneFixture("aws-self-hosted-minimal"), {
+        secretMode: "k8s",
+    });
+    assert.equal(internal.migrations?.externalDb, undefined);
+});
+test("supabase kong ingress carries Traefik websecure router annotations under TLS", () => {
+    // The supabase subchart's kong ingress doesn't emit router.entrypoints/tls
+    // itself, so Traefik only builds a web router and https://supabase.<domain>
+    // 404s. The CLI must inject them (via the subchart's annotations passthrough).
+    const config = cloneFixture("aws-self-hosted-minimal");
+    const tls = buildHelmValues(config, {
+        tlsEnabled: true,
+        secretMode: "k8s",
+    });
+    const a = tls.supabase.kong.ingress.annotations;
+    assert.equal(a["traefik.ingress.kubernetes.io/router.entrypoints"], "websecure");
+    assert.equal(a["traefik.ingress.kubernetes.io/router.tls"], "true");
+    const notls = buildHelmValues(config, {
+        tlsEnabled: false,
+        secretMode: "k8s",
+    });
+    const b = notls.supabase.kong.ingress.annotations;
+    assert.equal(b["traefik.ingress.kubernetes.io/router.entrypoints"], "web");
+    assert.equal(b["traefik.ingress.kubernetes.io/router.tls"], "false");
+});
 // ===========================================================================
 // Image registry / digest pinning (docker.io/rulebricks/* + global.imageRegistry)
 // ===========================================================================

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rulebricks/cli",
-  "version": "2.3.1",
+  "version": "2.3.2",
   "description": "CLI for deploying and managing private Rulebricks instances",
   "type": "module",
   "bin": {