Reintroduce bundled database to the chart by nikolasmatt · Pull Request #365 · agentregistry-dev/agentregistry

nikolasmatt · 2026-03-18T00:37:05Z

Resolves #358

Description

Reintroduces a bundled PostgreSQL instance to the Helm chart and restructures the database values key to align with kagent PR #1527.

What changed:

Bundled PostgreSQL on by default — postgres:18 is deployed alongside Agent Registry when database.postgres.bundled.enabled=true (the default). Intended for development and evaluation only; a warning is shown in NOTES.txt.
Restructured database values — replaced the old database.bundled.* / database.external.* split with a flat database.postgres.* structure:
- database.postgres.url / database.postgres.urlFile — external connection string (urlFile takes precedence)
- database.postgres.bundled.* — bundled instance config (image, storage, resources)
- database.postgres.vectorEnabled — enables AGENT_REGISTRY_EMBEDDINGS_ENABLED and AGENT_REGISTRY_DATABASE_VECTOR_ENABLED on the app pod
Default image is postgres:18 (official, plain). Users who want semantic search can opt in via database.postgres.vectorEnabled=true with their own pgvector-capable PostgreSQL instance.
Conditional vector migrations — base schema no longer requires pgvector. Vector schema (embedding columns, HNSW indexes) is applied in a separate migration set, only when DatabaseVectorEnabled=true.
URL file support — AGENT_REGISTRY_DATABASE_URL_FILE env var / database.postgres.urlFile value reads the database URL from a file at startup.
Separate PostgreSQL Secret — bundled DB password lives in its own {release}-postgresql Secret, decoupled from the JWT key Secret.
Init container only when needed — the wait-for-postgres init container is skipped when url or urlFile is set, even if bundled.enabled=true.
Simplified helpers — removed agentregistry.secretName, agentregistry.passwordSecretName, and agentregistry.databaseUrl; logic inlined into templates. Removed global.existingSecret.
Updated docs — README.md, DEVELOPMENT.md, chart README.md.gotmpl, and NOTES.txt updated for accuracy.
Helm unit tests — new postgresql_test.yaml suite; deployment_test.yaml, secrets_test.yaml, and validation_test.yaml updated for the new values structure.

Change Type

/kind feature
/kind install

Changelog

Reintroduces a bundled PostgreSQL database option to the Helm chart with a new database.postgres.* values structure. The bundled database (postgres:18) is enabled by default for development and evaluation. Set database.postgres.bundled.enabled=false and supply database.postgres.url for production.

README.md

charts/agentregistry/templates/postgresql.yaml

charts/agentregistry/values.yaml

Copilot

Pull request overview

This PR reintroduces a bundled PostgreSQL instance into the agentregistry Helm chart (enabled by default) and reshapes chart values under database.postgres.*, updating Kind tooling, docs, and Helm unit tests accordingly.

Changes:

Adds bundled PostgreSQL templates (+ separate DB Secret) and updates the main Deployment to wire DB config and a wait initContainer.
Restructures Helm values to database.postgres.* and updates helpers/validation/tests to match.
Updates Kind/Makefile workflows and documentation to reflect the bundled DB approach.

Reviewed changes

Copilot reviewed 19 out of 19 changed files in this pull request and generated 13 comments.

Show a summary per file

File	Description
scripts/kind/setup-kind.sh	Adjusts `mktemp` usage for Kind config temp file creation.
scripts/kind/README.md	Updates local Kind workflow/docs to reflect chart-bundled DB.
examples/postgres-pgvector.yaml	Removes standalone Postgres/pgvector manifest (now chart-bundled).
charts/agentregistry/values.yaml	Introduces `database.postgres.*` structure and bundled Postgres defaults.
charts/agentregistry/templates/postgresql.yaml	Adds PVC/Deployment/Service for bundled PostgreSQL.
charts/agentregistry/templates/postgresql-secret.yaml	Adds separate Secret for bundled DB password.
charts/agentregistry/templates/deployment.yaml	Wires DB env vars, adds initContainer, and adds checksum for DB Secret.
charts/agentregistry/templates/secrets.yaml	Simplifies JWT Secret creation logic (JWT-only).
charts/agentregistry/templates/_helpers.tpl	Removes old secret/db/resource helpers; adds bundled Postgres helpers and updates validation logic.
charts/agentregistry/templates/NOTES.txt	Adds bundled DB warning/note messaging in install notes.
charts/agentregistry/tests/postgresql_test.yaml	Adds Helm unit tests for bundled Postgres resources.
charts/agentregistry/tests/deployment_test.yaml	Updates deployment tests for new env var wiring and secrets.
charts/agentregistry/tests/secrets_test.yaml	Updates secret tests for JWT-only secret behavior.
charts/agentregistry/tests/validation_test.yaml	Updates validation tests for new DB/JWT value structure.
charts/agentregistry/README.md.gotmpl	Updates chart documentation for bundled DB + new values layout.
charts/agentregistry/Chart-template.yaml	Adds bundled Postgres image to Artifact Hub images list.
README.md	Updates install instructions to chart-bundled DB and new values layout.
Makefile	Removes standalone Postgres install target; updates Kind install flags/overrides.
DEVELOPMENT.md	Updates local dev docs to reflect new Kind + chart-bundled DB workflow.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

charts/agentregistry/templates/deployment.yaml

charts/agentregistry/templates/postgresql.yaml

Copilot · 2026-03-20T00:15:17Z

charts/agentregistry/templates/postgresql-secret.yaml

+data:
+  POSTGRES_PASSWORD: {{ "agentregistry" | b64enc | quote }}


The bundled PostgreSQL password is hardcoded to a known value (agentregistry). Even for dev/eval, this makes accidental exposure more likely and prevents users from rotating the credential. Consider generating a random password by default (and/or allowing a user-provided password / existing Secret override) while still keeping a simple path for local Kind development overrides.

this is intentional for now

charts/agentregistry/values.yaml

charts/agentregistry/templates/deployment.yaml

charts/agentregistry/values.yaml

README.md

charts/agentregistry/README.md.gotmpl

charts/agentregistry/templates/NOTES.txt

timflannagan · 2026-03-20T18:01:27Z

internal/registry/database/testutil.go

+
+// WithVector enables vector migrations (adds semantic_embedding columns) on the test database.
+// Use for tests that exercise pgvector/embeddings functionality.
+func WithVector() testDBOption {


nit: Typically the functions pattern would uses a function type vs. a struct:

type testDBOption func(*testDBConfig) type testDBConfig struct { vectorEnabled bool } func WithVector() testDBOption { return func(cfg *testDBConfig) { cfg.vectorEnabled = true } } ... var cfg testDBConfig for _, o := range opts { o(&cfg) }

scripts/kind/README.md

timflannagan · 2026-03-20T18:16:16Z

charts/agentregistry/values.yaml

+    # -- Enable vector schema migrations and embeddings/semantic search (sets AGENT_REGISTRY_DATABASE_VECTOR_ENABLED and AGENT_REGISTRY_EMBEDDINGS_ENABLED). Requires a pgvector-capable PostgreSQL instance.
+    vectorEnabled: false


This field living under the postgres section is a bit confusing to me. It's effectively configuring fields that live on the server (vs. configuring the postgres instance) and tells it to run vector migrations on startup + enable semantic search functionality. WYDT?

I think we can also remove the AGENT_* envvar references here. Leaks implementation details.

This field living under the postgres section is a bit confusing to me. It's effectively configuring fields that live on the server (vs. configuring the postgres instance) and tells it to run vector migrations on startup + enable semantic search functionality. WYDT?

the url field doesn't configure the database either, it configures the registry. The discussion we had offline was to think about this as informational on what the DB is capable and then turn the features that depend on the capability on or off accordingly instead of controlling individual features.

I think we can also remove the AGENT_* envvar references here. Leaks implementation details.

👍

timflannagan · 2026-03-20T18:16:47Z

charts/agentregistry/values.yaml

+        # -- Bundled PostgreSQL image pull policy
+        pullPolicy: IfNotPresent
+      # -- DB name, user, and password are hardcoded ("agentregistry") for the bundled instance.
+      # -- PersistentVolumeClaim size for the bundled PostgreSQL data directory


Do we need to expose the ability toggle the class name too? Right now it uses the default class in the cluster, which is probably sufficient for now.

I would push that to a future improvement. We need to figure out how configurable this bundled DB needs to be. For now less is better.

charts/agentregistry/values.yaml

timflannagan · 2026-03-20T19:01:41Z

scripts/kind/README.md

 ## Database Details

-The local PostgreSQL instance is configured as follows:
+PostgreSQL/pgvector is bundled in the Helm chart and deployed automatically. The default configuration is:


PostgreSQL/pgvector is bundled in the Helm chart and deployed automatically

Accurate in the context of this scripts' README, but a bit misleading for the default values.yaml?

timflannagan · 2026-03-20T19:08:04Z

README.md

  --set config.jwtPrivateKey=$(openssl rand -hex 32)
 ```

+> **Semantic search** requires a vector-enabled PostgreSQL instance. Add `--set database.postgres.vectorEnabled=true` when your database has vector support. The bundled database does not include vector support — semantic search will not be available when using it.


This is buried within the Kubernetes section, but this commentary is also applicable to the registry hosted in docker flow as well.

Should we align the chart & internal/daemon/docker-compose.yml defaults here then?

charts/agentregistry/templates/postgresql-secret.yaml

timflannagan · 2026-03-20T19:11:17Z

charts/agentregistry/values.yaml

-  existingSecret: ""
-  # -- External database SSL mode (require, verify-ca, verify-full, disable). Defaults to require for encrypted connections.
-  sslMode: "require"
+  postgres:


I'd still advocate for a mode-based pattern here:

database: mode: bundled external: { ... } bundled: { ... }

Fine for now; this was already discussed offline.

internal/registry/config/config.go

nikolasmatt added 4 commits March 17, 2026 13:17

reintroduce managed db

7924c48

some cleanup

124bd18

image

ed9c34c

update local setup to use the bundled DB

70d57ad

github-actions bot added kind/feature release-note kind/install labels Mar 18, 2026

nits

7b6ebfc

iplay88keys reviewed Mar 18, 2026

View reviewed changes

README.md Outdated Show resolved Hide resolved

iplay88keys reviewed Mar 18, 2026

View reviewed changes

charts/agentregistry/templates/postgresql.yaml Show resolved Hide resolved

iplay88keys reviewed Mar 18, 2026

View reviewed changes

charts/agentregistry/values.yaml Outdated Show resolved Hide resolved

iplay88keys reviewed Mar 18, 2026

View reviewed changes

charts/agentregistry/values.yaml Outdated Show resolved Hide resolved

iplay88keys reviewed Mar 18, 2026

View reviewed changes

charts/agentregistry/values.yaml Outdated Show resolved Hide resolved

nikolasmatt added 4 commits March 19, 2026 16:07

update based on feedback

8718987

fixes

b12a33c

update postgres 16 -> 18

973f054

Merge branch 'main' into reintroduce-managed-database

567369b

nikolasmatt marked this pull request as ready for review March 20, 2026 00:07

Copilot AI review requested due to automatic review settings March 20, 2026 00:07

Copilot started reviewing on behalf of nikolasmatt March 20, 2026 00:08 View session

Copilot AI reviewed Mar 20, 2026

View reviewed changes

nikolasmatt added 5 commits March 19, 2026 17:26

nits

1f3221e

copilot feedback

ca8d895

fix integration tests that depend on vector DB

85b3ecc

migration dir fix

d3e5604

Merge branch 'main' into reintroduce-managed-database

1b7af22

timflannagan approved these changes Mar 20, 2026

View reviewed changes

nikolasmatt added 2 commits March 20, 2026 12:21

remove urlFile option, will introduce secure option in followup work

c29857d

address feedback

4dd5872

timflannagan approved these changes Mar 20, 2026

View reviewed changes

		data:
		POSTGRES_PASSWORD: {{ "agentregistry" \| b64enc \| quote }}

		# -- Enable vector schema migrations and embeddings/semantic search (sets AGENT_REGISTRY_DATABASE_VECTOR_ENABLED and AGENT_REGISTRY_EMBEDDINGS_ENABLED). Requires a pgvector-capable PostgreSQL instance.
		vectorEnabled: false

Conversation

nikolasmatt commented Mar 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Change Type

Changelog

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI Mar 20, 2026

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

nikolasmatt commented Mar 18, 2026 •

edited

Loading