fix(hwlab): bootstrap local postgres runtime secrets (#728)

Co-authored-by: Codex <codex@noreply.local>
2026-06-23 09:44:36 +08:00
parent 1b3af54fba
commit 0e85857965
5 changed files with 364 additions and 6 deletions
@@ -85,6 +85,8 @@ export interface HwlabRuntimePostgresStoreSpec {
  readonly statefulSet?: string;
  readonly serviceName?: string;
  readonly adminUser?: string;
+  readonly adminPasswordSourceRef?: string;
+  readonly adminPasswordSourceKey?: string;
  readonly cloudApi?: HwlabRuntimePostgresStoreComponentSpec;
  readonly openfga?: HwlabRuntimePostgresStoreComponentSpec;
  readonly poolMax: number;
@@ -650,6 +652,8 @@ function runtimeStoreConfig(value: unknown, path: string): HwlabRuntimeStoreSpec
            ...(postgres.statefulSet === undefined ? {} : { statefulSet: stringField(postgres, "statefulSet", `${path}.postgres`) }),
            ...(postgres.serviceName === undefined ? {} : { serviceName: stringField(postgres, "serviceName", `${path}.postgres`) }),
            ...(postgres.adminUser === undefined ? {} : { adminUser: stringField(postgres, "adminUser", `${path}.postgres`) }),
+            ...(postgres.adminPasswordSourceRef === undefined ? {} : { adminPasswordSourceRef: stringField(postgres, "adminPasswordSourceRef", `${path}.postgres`) }),
+            ...(postgres.adminPasswordSourceKey === undefined ? {} : { adminPasswordSourceKey: secretKeyField(postgres, "adminPasswordSourceKey", `${path}.postgres`) }),
            ...(postgres.cloudApi === undefined ? {} : { cloudApi: runtimeStorePostgresComponentConfig(postgres.cloudApi, `${path}.postgres.cloudApi`) }),
            ...(postgres.openfga === undefined ? {} : { openfga: runtimeStorePostgresComponentConfig(postgres.openfga, `${path}.postgres.openfga`) }),
            poolMax: numberField(postgres, "poolMax", `${path}.postgres`),