Open
Conversation
…als, unleash init-db) Made-with: Cursor
…als, DB init) Add and wire production overlay resources and patches for deploying the Ambient Code Platform on OpenShift (e.g. chadsno2026) with LVM Storage, restricted SCC, and shared PostgreSQL. Storage (LVM) - Add PVC patches for backend, postgresql, minio, and ambient-api-server-db to use storageClassName: lvms-vg1 (LVM Storage) instead of default. - See README-storage.md for LVMCluster and volume setup. Credentials - postgresql-credentials: db.host=postgresql, postgres/postgres123, db.name=postgres. - minio-credentials: MinIO credentials for state sync. - unleash-credentials: DATABASE_URL to shared postgresql/unleash, API tokens, default admin password, database-ssl. ServiceAccounts and SCC (nonroot) - postgresql-sa, minio-sa, ambient-api-server-db-sa: dedicated SAs for stateful workloads so they can use nonroot SCC (no seccomp in patch; nonroot forbids it). - postgresql-fsgroup-patch, minio-fsgroup-patch: fsGroup and runAsUser for RHEL compatibility and volume permissions. - ambient-api-server-db-scc-patch: runAsUser and securityContext for ambient-api-server-db to run under nonroot. - README-SCC.md: oc adm policy add-scc-to-user nonroot and rollout restart steps. ambient-api-server - ambient-api-server-wait-db-patch: add wait-for-db init container (pg_isready loop) and keep migration init so API server starts only after DB is ready. Unleash - unleash-init-db-patch: init container (RHEL postgresql-16 image) that waits for shared PostgreSQL, creates database "unleash" if missing, then verifies connectivity to the unleash database (retries) before main container starts. - kustomization: register credentials resources and all patches (PVC, SA, SCC, wait-db, fsgroup, unleash-init-db); postgresql-json-patch removed (use postgres:16 with fsGroup/runAsUser instead of RHEL image for shared Postgres). Docs - README-vertex.md: Vertex/Google Cloud notes (unchanged from existing content). Files changed (18) README-SCC.md, README-vertex.md, *-sa, *-scc-patch, *-wait-db-patch, kustomization.yaml, *-credentials, *-fsgroup-patch, pvc-patch-*, unleash-init-db-patch.yaml. Made-with: Cursor
Contributor
Review Queue — Blockers Found
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Security overlay for OpenShift
Details
Updates to run securely on openshift
Ensure you have lvmoperator properly configured
Ensure that init containers wait for database to come online and retry up to 5 times
Add and wire production overlay resources and patches for deploying the
Ambient Code Platform on OpenShift with LVM Storage,
restricted SCC, and shared PostgreSQL.
Storage (LVM)
to use
storageClassName: lvms-vg1(LVM Storage) instead of default.Credentials
default admin password, database-ssl.
ServiceAccounts and SCC (nonroot)
workloads so they can use nonroot SCC (no seccomp in patch; nonroot forbids it).
compatibility and volume permissions.
ambient-api-server-db to run under nonroot.
oc adm policy add-scc-to-user nonrootand rollout restart steps.ambient-api-server
loop) and keep migration init so API server starts only after DB is ready.
Unleash
for shared PostgreSQL, creates database "unleash" if missing, then verifies
connectivity to the unleash database (retries) before main container starts.
wait-db, fsgroup, unleash-init-db); postgresql-json-patch removed (use
postgres:16 with fsGroup/runAsUser instead of RHEL image for shared Postgres).
Docs
Files changed (18)
README-SCC.md, README-vertex.md, *-sa, *-scc-patch, *-wait-db-patch,
kustomization.yaml, *-credentials, -fsgroup-patch, pvc-patch-,
unleash-init-db-patch.yaml.
ASSISTED BY CURSOR/CLAUDE AI