Connection string parameters break the init container

[reknih]

Describe the bug

When connecting to an externally managed database over an encrypted connection, the parameters ?sslmode=require&ssl=true are necessary at the end of the connection string. However, when specifying them, the awk string replacement in the init script fails. This leads to the perpetually repeating error message pg_isready: error: invalid connection option "plausible_db?sslmode".

Version of Helm, Kubernetes and the plausible-analytics chart:

$ kubectl version  
Client Version: v1.29.1
Kustomize Version: v5.0.4-0.20230601165947-6ce0bf390ce3
Server Version: v1.28.5

$ helm version
version.BuildInfo{Version:"v3.13.2", GitCommit:"2a2fb3b98829f1e0be6fb18af2f6599e0f4e8243", GitTreeState:"clean", GoVersion:"go1.21.4"}

I used version 0.2.4 of the plausible-analytics chart

What happened:

Startup of plausible-analytics pods fails if the init-container is enabled.

What you expected to happen:

The connection string parameters should be honored in the wait-for-postgres script (or at least they should not be included in the database name). Connections to external databases forcing encryption should be possible.

How to reproduce it (as minimally and precisely as possible):

helm upgrade plausible imio/plausible-analytics --set "databaseURL=postgres://postgres:postgres@your.external.postgres.example.com:5432/plausible_db?sslmode=require&ssl=true,postgresql.enabled=false"

Anything else we need to know:

The error is here:

helm-plausible-analytics/templates/configmap.yaml

Line 16 in 9217da3

db=$(echo $info | awk -F[@:/] '{print $5}')

[grohmio]

a workaround could be adding these to your values.yaml:

  values:
    databaseURL: "postgres://postgres:postgres@plausible-postgresql.<your_namespace>.svc.cluster.local:5432/plausible_db"
    clickhouseDatabaseURL: "http://clickhouse:password@plausible-clickhouse.<your_namespace>.svc.cluster.local:8123/plausible_events_db"

that uses the internal service urls from K8s.

Hope that helps!?

[vittoriocanilli]

Hello @reknih,

I am using the version 0.4.0 of the chart and thanks to your PR I was able to solve the issue with the following values:

databaseCA: true

secret:
  create: false
  existingSecret: "my-plausible-secret"

postgresql:
  enabled: false

My externally managed database is on Azure and the CA is formed by the 3 certificates on their documentation page that I needed to convert in PEM format and concatenate in one file.

As you can see I did not want to have credentials or certificates on my values file, so everything is stored in a Kubernetes secret:

---
apiVersion: v1
data:
  DATABASE_URL: base64 of postgres://<psql_user>:<psql_password>@<psql_host_on_azure>:5432/<psql_database> 
  DATABASE_CA: base64 of the 3 concatenated Azure certificates in PEM format
kind: Secret
metadata:
  name: my-plausible-secret
  namespace: my-plausible-namespace
type: Opaque

I hope it helps you or someone else finding this issue as I did! Thanks again for your PR!