You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This pull-request has been approved by: Once this PR has been reviewed and has the lgtm label, please assign rm3l for approval. For more information see the Code Review Process.
The full list of commands accepted by this bot can be found here.
Details
Needs approval from an approver in each of these files:
Update the RHDH Operator configuration to deploy PostgreSQL 16 for the integrated database.
Ensure new Operator deployments create a PostgreSQL 16 database by default.
Non-compliant requirements:
Document the configuration changes in the PR.
Requires further human verification:
Ensure existing deployments continue to work (backward compatibility).
⏱️ Estimated effort to review: 3 🔵🔵🔵⚪⚪
🔒 Security concerns
Supply-chain risk: several new references use quay.io/fedora/postgresql-16:latest (a floating tag). Using :latest increases the risk of unintentionally pulling changed/unvetted content over time. Prefer an immutable digest (or at minimum a specific version tag) and ensure the final shipped manifests/CSV point to the supported Red Hat image source.
The ticket goal is to use the Red Hat supported PostgreSQL 16 image, but the operator RELATED_IMAGE_postgresql and relatedImages are set to quay.io/fedora/postgresql-16:latest. Validate that release artifacts substitute this to registry.redhat.io/rhel9/postgresql-16 (or an approved internal mirror) and that the CSV ends up referencing the supported image for disconnected/restricted environments.
Multiple manifests pin PostgreSQL via the floating :latest tag, which can break reproducibility and upgrades and may violate operator bundle best practices (relatedImages typically should be immutable/digest-pinned). Consider using a versioned tag and/or digest pinning for RELATED_IMAGE_postgresql and all rendered statefulsets/jobs that reference the image.
The PR incorrectly uses a Fedora community PostgreSQL image. It should be updated to use the official Red Hat supported image (registry.redhat.io/rhel9/postgresql-16) as required by the ticket.
image: quay.io/fedora/postgresql-16:latest # will be replaced with the actual image
Solution Walkthrough:
Before:
# In various YAML configuration files:
...
spec:
containers:
- name: postgresql# The PR uses a Fedora community imageimage: quay.io/fedora/postgresql-16:latest
...
# In the ClusterServiceVersion:relatedImages:
- image: quay.io/fedora/postgresql-16:latestname: postgresql
...
After:
# In various YAML configuration files:
...
spec:
containers:
- name: postgresql# Should use the official Red Hat supported imageimage: registry.redhat.io/rhel9/postgresql-16
...
# In the ClusterServiceVersion:relatedImages:
- image: registry.redhat.io/rhel9/postgresql-16name: postgresql
...
Suggestion importance[1-10]: 10
__
Why: This suggestion addresses a critical flaw where the PR uses an unsupported community image instead of the required Red Hat supported image, directly contradicting the core requirement of the associated ticket.
High
Security
Harden psql container security
Add a securityContext to the psql container in bundle/rhdh/manifests/rhdh-plugin-deps_v1_configmap.yaml to enforce runAsNonRoot: true and allowPrivilegeEscalation: false for security hardening.
Why: This suggestion provides a significant security improvement by proposing to run the psql container as a non-root user and preventing privilege escalation, which is a critical security best practice.
Medium
General
Pin image version instead of latest
Replace the :latest tag with a specific version tag (e.g., :16) for the postgresql-16 image to ensure predictable deployments. This should be applied across all relevant YAML files.
-image: quay.io/fedora/postgresql-16:latest # will be replaced with the actual image+image: quay.io/fedora/postgresql-16:16 # will be replaced with the actual image
Apply / Chat
Suggestion importance[1-10]: 6
__
Why: The suggestion correctly points out that using the :latest tag is a bad practice for deployment stability. Pinning to a specific version like :16 improves reproducibility, which is a valuable improvement.
Low
Parameterize Postgres version
In .rhdh/scripts/prepare-restricted-environment.sh, define a variable for the PostgreSQL version (e.g., PG_VERSION=16) and use it to construct image source URLs, simplifying future upgrades.
Why: This is a good suggestion for improving the maintainability of the shell script by using a variable for the PostgreSQL version, making future updates easier and less error-prone.
Low
Organization best practice
Quote interpolated shell variables
Quote the expanded registry URL so unexpected characters/spaces in registry_url_internal cannot break the generated YAML.
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Upgrade the integrated PostgreSQL from version 15 to 16.
Which issue(s) does this PR fix or relate to
PR acceptance criteria
How to test changes / Special notes to the reviewer