GeezerVison

The World Wide Web, restored to 800 pixels of glory.

GeezerVison is showing github.com — docs: explain how to rotate the database password by jyotshnayaparla-00 · Pull Request #7792 · feldera/feldera

Conversation

jyotshnayaparla-00 commented Nov 2, 2026

Copy link

Copy Markdown

Contributor

This adds a "Rotate the database password" section to helm-guide.md. It also covers what to do if the ALTER ROLE step fails, and what to do for an external database.

Tested the ALTER ROLE steps on postgres:16.0 and the kubectl create secret command with a dry run. I didn't test the full flow on a Helm install.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

jyotshnayaparla-00 self-assigned this

Nov 2, 2026

jyotshnayaparla-00 requested a review from gz

November 2, 2026 21:31

mythical-fred-oss Bot reviewed

Nov 2, 2026

View reviewed changes

Comment thread

docs.feldera.com/docs/get-started/enterprise/helm-guide.md Resolved

Uh oh!

There was an error while loading. Please reload this page.

mythical-fred-oss Bot reviewed

Nov 2, 2026

View reviewed changes

Comment thread

docs.feldera.com/docs/get-started/enterprise/helm-guide.md Outdated

Comment on lines +265 to +267

		If step 2 fails, nothing has changed yet, and the components still use the old
		password. If you use an external database, change the password there, update
		`.connection_url` in the secret, and do step 4.

mythical-fred-oss Bot Nov 2, 2026

Copy link

Copy Markdown

Contributor

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

missing (medium): this explains how to recover when step 2 fails, but not when step 3 or 4 fails or stalls (e.g. a pod stuck in CrashLoopBackOff with auth errors). Step 3 overwrites the old password, so there is no rollback path. Suggest saving it before step 2 (OLD_PASSWORD=$(kubectl get secret ... -o jsonpath='{.data.\.password}' | base64 -d)) and documenting the rollback: run ALTER ROLE back to the old password, then re-apply the old secret.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

mythical-fred-oss Bot commented Nov 2, 2026

Copy link

Copy Markdown

Contributor

Docs-only PR (Helm guide: rotate the database password).

What I ran

Check	Result
`pre-commit run --files helm-guide.md`	pass
`kubectl create secret ... --dry-run=client -o yaml` (step 3)	produces the `.user`/`.password` data keys the chart expects
Password generator + `printf` SQL in step 1/2	32 alphanumeric chars, valid statement
Resource names (`feldera-db-0`, `feldera-api-server`, `feldera-kubernetes-runner`, `statefulset/feldera-compiler-server`, `feldera-compiler-artifact-server`)	match the rest of this guide and `parallel-compilation.md`
`ALTER ROLE` over the local socket	not run (no Postgres here). The author ran it on postgres:16.0

Gates: no behaviour change, so the test gates don't apply. The commit message is good. The full flow wasn't tested on a Helm install, as the description says.

Not covered yet (details inline): how to roll back if step 3 or 4 fails, and cases where the old secret value comes back (GitOps re-apply, ESO refresh delay, the chart-owned insecure default secret). Otherwise LGTM.

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

gz approved these changes

Nov 3, 2026

View reviewed changes

Comment thread

docs.feldera.com/docs/get-started/enterprise/helm-guide.md Outdated


		### Rotate the database password

		You can change the password of the bundled database without losing any data.

gz Nov 3, 2026

Copy link

Copy Markdown

Contributor

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I would hope so

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

Comment thread

docs.feldera.com/docs/get-started/enterprise/helm-guide.md Outdated

		kubectl exec -i -n feldera feldera-db-0 -- sh -c 'psql -U "$POSTGRES_USER" -d postgres -v ON_ERROR_STOP=1'
		```
		It should print `ALTER ROLE`. From now on, new connections with the old password
		fail. Connections that are already open stay up, so continue with the next steps

gz Nov 3, 2026

Copy link

Copy Markdown

Contributor

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change

	fail. Connections that are already open stay up, so continue with the next steps
	fail. Connections that are already open continue to work, so do the next steps

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

Comment thread

docs.feldera.com/docs/get-started/enterprise/helm-guide.md Outdated


		If step 2 fails, nothing has changed yet, and the components still use the old
		password. If you use an external database, change the password there, update
		`.connection_url` in the secret, and do step 4.

gz Nov 3, 2026

Copy link

Copy Markdown

Contributor

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change

	`.connection_url` in the secret, and do step 4.
	`.connection_url` in the secret, and proceed to step 4.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

jyotshnayaparla-00 added 2 commits

November 3, 2026 09:44


          docs: explain how to rotate the database password

56854a3

Changing the database secret alone does not change the password of an
existing Postgres volume, and the Feldera components only read it at
startup. Describe how to rotate it with ALTER ROLE without data loss.


          docs: address review comments on the password rotation section

fddd417

jyotshnayaparla-00 force-pushed the docs/rotate-db-password branch from 7b690e6 to fddd417 Compare

November 3, 2026 15:45

jyotshnayaparla-00 enabled auto-merge

November 3, 2026 15:53

jyotshnayaparla-00 disabled auto-merge

November 3, 2026 15:53

jyotshnayaparla-00 added this pull request to the merge queue

Nov 3, 2026

Merged via the queue into main with commit d0a8a12

Nov 3, 2026

1 check passed

Uh oh!

There was an error while loading. Please reload this page.

jyotshnayaparla-00 deleted the docs/rotate-db-password branch

November 3, 2026 17:15

Reviewers

mythical-fred-oss[bot]

mythical-fred-oss[bot] left review comments

gz approved these changes

Uh oh!

There was an error while loading. Please reload this page.

Assignees

jyotshnayaparla-00

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

2 participants

Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.

You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.