fix: restore jd01 platform database runtime

config/hwlab-node-lanes.yaml

@@ -968,7 +968,7 @@ lanes:
           renderDir: runtime-v03
         runtimeStore:
           postgres:
-            mode: local-k3s
+            mode: platform-service
             secretName: hwlab-v03-postgres
             statefulSet: hwlab-v03-postgres
             serviceName: hwlab-v03-postgres
@@ -1219,6 +1219,30 @@ lanes:
             email: ops@pikapython.com
             tls: auto
             responseHeaderTimeoutSeconds: 600
+        externalPostgres:
+          provider: PK01
+          configRef: config/platform-db/postgres-pk01.yaml
+          serviceName: jd01-pk01-platform-postgres
+          endpointAddress: 82.156.23.220
+          port: 5432
+          runtimeAccess:
+            endpointAddress: 82.156.23.220
+            port: 5432
+          sslmode: require
+          database: hwlab_jd01_v03
+          cloudApi:
+            secretName: hwlab-cloud-api-v03-db
+            secretKey: database-url
+            sourceRef: hwlab/jd01-v03-cloud-api-db.env
+            envKey: DATABASE_URL
+            role: hwlab_jd01_v03_app
+          openfga:
+            secretName: hwlab-v03-openfga
+            secretKey: datastore-uri
+            sourceRef: hwlab/jd01-v03-openfga-db.env
+            envKey: DATASTORE_URI
+            authnKey: authn-preshared-key
+            role: hwlab_jd01_v03_app
 
 networkProfiles:
   node-ci-egress:

config/platform-db/postgres-pk01.yaml

@@ -316,6 +316,36 @@ postgres:
         user: hwlab_d601_v03_app
         address: 74.48.78.17/32
         method: scram-sha-256
+      - type: hostssl
+        database: hwlab_jd01_v03
+        user: hwlab_jd01_v03_app
+        address: 10.0.8.0/22
+        method: scram-sha-256
+      - type: hostssl
+        database: postgres
+        user: hwlab_jd01_v03_app
+        address: 10.0.8.0/22
+        method: scram-sha-256
+      - type: hostssl
+        database: hwlab_jd01_v03
+        user: hwlab_jd01_v03_app
+        address: 117.72.122.178/32
+        method: scram-sha-256
+      - type: hostssl
+        database: postgres
+        user: hwlab_jd01_v03_app
+        address: 117.72.122.178/32
+        method: scram-sha-256
+      - type: hostssl
+        database: hwlab_jd01_v03
+        user: hwlab_jd01_v03_app
+        address: 74.48.78.17/32
+        method: scram-sha-256
+      - type: hostssl
+        database: postgres
+        user: hwlab_jd01_v03_app
+        address: 74.48.78.17/32
+        method: scram-sha-256
 
 secrets:
   source: master-local
@@ -405,6 +435,20 @@ secrets:
           HWLAB_D601_V03_DB_NAME: hwlab_d601_v03
         randomHex:
           HWLAB_D601_V03_DB_PASSWORD: 32
+    - name: hwlab-jd01-v03-db-credentials
+      sourceRef: platform-db/hwlab-jd01-v03-db.env
+      type: env
+      requiredKeys:
+        - HWLAB_JD01_V03_DB_USER
+        - HWLAB_JD01_V03_DB_PASSWORD
+        - HWLAB_JD01_V03_DB_NAME
+      createIfMissing:
+        enabled: true
+        values:
+          HWLAB_JD01_V03_DB_USER: hwlab_jd01_v03_app
+          HWLAB_JD01_V03_DB_NAME: hwlab_jd01_v03
+        randomHex:
+          HWLAB_JD01_V03_DB_PASSWORD: 32
 objects:
   roles:
     - name: sub2api
@@ -461,6 +505,15 @@ objects:
         createdb: false
         createrole: false
         superuser: false
+    - name: hwlab_jd01_v03_app
+      passwordRef:
+        sourceRef: platform-db/hwlab-jd01-v03-db.env
+        key: HWLAB_JD01_V03_DB_PASSWORD
+      login: true
+      attributes:
+        createdb: false
+        createrole: false
+        superuser: false
   databases:
     - name: sub2api
       owner: sub2api
@@ -492,6 +545,11 @@ objects:
       encoding: UTF8
       locale: C.UTF-8
       extensions: []
+    - name: hwlab_jd01_v03
+      owner: hwlab_jd01_v03_app
+      encoding: UTF8
+      locale: C.UTF-8
+      extensions: []
 
 exports:
   connectionStrings:
@@ -602,6 +660,38 @@ exports:
         - scope: hwlab-d601-v03
           secret: hwlab-v03-openfga
           key: DATASTORE_URI
+    - name: hwlab-jd01-v03-cloud-api-database-url
+      sourceSecretRef: platform-db/hwlab-jd01-v03-db.env
+      render:
+        envKey: DATABASE_URL
+        format: postgresql://$(HWLAB_JD01_V03_DB_USER):$(HWLAB_JD01_V03_DB_PASSWORD)@$(PGHOST):$(PGPORT)/$(HWLAB_JD01_V03_DB_NAME)?sslmode=require
+        variables:
+          PGHOST: 82.156.23.220
+          PGPORT: "5432"
+      writeToSecretSource:
+        sourceRef: hwlab/jd01-v03-cloud-api-db.env
+        key: DATABASE_URL
+        mode: update-or-insert
+      consumers:
+        - scope: hwlab-jd01-v03
+          secret: hwlab-cloud-api-v03-db
+          key: DATABASE_URL
+    - name: hwlab-jd01-v03-openfga-datastore-uri
+      sourceSecretRef: platform-db/hwlab-jd01-v03-db.env
+      render:
+        envKey: DATASTORE_URI
+        format: postgres://$(HWLAB_JD01_V03_DB_USER):$(HWLAB_JD01_V03_DB_PASSWORD)@$(PGHOST):$(PGPORT)/$(HWLAB_JD01_V03_DB_NAME)?sslmode=require
+        variables:
+          PGHOST: 82.156.23.220
+          PGPORT: "5432"
+      writeToSecretSource:
+        sourceRef: hwlab/jd01-v03-openfga-db.env
+        key: DATASTORE_URI
+        mode: update-or-insert
+      consumers:
+        - scope: hwlab-jd01-v03
+          secret: hwlab-v03-openfga
+          key: DATASTORE_URI
 
 backup:
   phase: minimum-restoreable

scripts/src/hwlab-node/render.ts

@@ -215,21 +215,25 @@ export function nodeRuntimeControlPlaneStatus(scoped: ReturnType<typeof parseNod
   const workloadsReady = workloadReadiness.length > 0 && workloadReadiness.every((item) => item.ready);
   const localPostgresExpectedAbsent = nodeRuntimeLocalPostgresExpectedAbsent(spec);
   const localPostgresReady = localPostgresExpectedAbsent ? localPostgresObjects.length === 0 : localPostgresObjects.length > 0;
-  const runtimeReady = namespaceExists && localPostgresReady && workloadsReady && (activeExternalPostgres === undefined || (bridge.ready && secrets.ready)) && codeAgentRuntime.ready === true;
+  const postgresReady = activeExternalPostgres === undefined
+    ? localPostgresReady
+    : bridge.ready === true && secrets.ready === true;
+  const runtimeReady = namespaceExists && postgresReady && workloadsReady && codeAgentRuntime.ready === true;
   const codeAgentRuntimeDegradedReason = typeof codeAgentRuntime.degradedReason === "string" ? codeAgentRuntime.degradedReason : null;
-  const runtimeDegradedReason = !namespaceExists
-    ? "runtime-namespace-missing"
-    : !localPostgresReady
-      ? "runtime-local-postgres-not-ready"
-      : !workloadsReady
-        ? "runtime-workloads-not-ready"
-        : activeExternalPostgres !== undefined && bridge.ready !== true
-          ? "external-postgres-bridge-not-ready"
-          : activeExternalPostgres !== undefined && secrets.ready !== true
-            ? "external-postgres-secrets-not-ready"
-            : codeAgentRuntime.ready !== true
-              ? codeAgentRuntimeDegradedReason ?? "code-agent-runtime-not-ready"
-              : "runtime-not-ready";
+  let runtimeDegradedReason = "runtime-not-ready";
+  if (!namespaceExists) {
+    runtimeDegradedReason = "runtime-namespace-missing";
+  } else if (activeExternalPostgres !== undefined && bridge.ready !== true) {
+    runtimeDegradedReason = "external-postgres-bridge-not-ready";
+  } else if (activeExternalPostgres !== undefined && secrets.ready !== true) {
+    runtimeDegradedReason = "external-postgres-secrets-not-ready";
+  } else if (activeExternalPostgres === undefined && !localPostgresReady) {
+    runtimeDegradedReason = "runtime-local-postgres-not-ready";
+  } else if (!workloadsReady) {
+    runtimeDegradedReason = "runtime-workloads-not-ready";
+  } else if (codeAgentRuntime.ready !== true) {
+    runtimeDegradedReason = codeAgentRuntimeDegradedReason ?? "code-agent-runtime-not-ready";
+  }
   const argoReady = argo.exitCode === 0 && repoURL === spec.argoRepoUrl && targetRevision === spec.gitopsBranch && path === spec.runtimePath && syncStatus === "Synced" && health === "Healthy";
   const argoDiagnostics = argo.exitCode === 0 && !argoReady
     ? nodeRuntimeArgoDiagnostics(spec, probeTimeoutSeconds)