Route lag-tolerant reads to an optional Postgres read replica (#2084)

Signed-off-by: Tyler Longwell <tlongwell@block.xyz>
Co-authored-by: npub1qyvc0c5kl4gqv2fd97fsk46tu378sqgy35vc83rvgfwne90sel7s0ed67d <011987e296fd5006292d2f930b574be47c7801048d1983c46c425d3c95f0cffd@sprout-oss.stage.blox.sqprod.co>
Co-authored-by: Tyler Longwell <tlongwell@block.xyz>

deploy/charts/buzz/examples/secret-sample.yaml

@@ -8,6 +8,7 @@
 #   BUZZ_RELAY_PRIVATE_KEY        — 64-char hex; relay identity (do NOT rotate)
 #   BUZZ_GIT_HOOK_HMAC_SECRET     — 32+ chars; required when replicaCount > 1
 #   DATABASE_URL                  — postgres://...
+#   READ_DATABASE_URL             — postgres://... (optional read-replica; omit to disable read routing)
 #   REDIS_URL                     — redis://...  (required when replicaCount > 1)
 #   BUZZ_S3_ACCESS_KEY
 #   BUZZ_S3_SECRET_KEY

deploy/charts/buzz/templates/deployment.yaml

@@ -173,6 +173,12 @@ spec:
                 secretKeyRef:
                   name: {{ include "buzz.envSecretName" . }}
                   key: DATABASE_URL
+            - name: READ_DATABASE_URL
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "buzz.envSecretName" . }}
+                  key: READ_DATABASE_URL
+                  optional: true
             - name: REDIS_URL
               valueFrom:
                 secretKeyRef:

deploy/charts/buzz/tests/secrets_test.yaml

@@ -59,6 +59,47 @@ tests:
                 optional: true
         template: templates/deployment.yaml
 
+  - it: Deployment env points READ_DATABASE_URL at existingSecret as optional
+    set:
+      relayUrl: wss://buzz.example.com
+      ownerPubkey: "0000000000000000000000000000000000000000000000000000000000000000"
+      externalPostgresql.url: postgres://u:p@h:5432/d
+      s3.endpoint: http://minio:9000
+      s3.accessKey: a
+      s3.secretKey: s
+      secrets.existingSecret: "buzz-secrets"
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: READ_DATABASE_URL
+            valueFrom:
+              secretKeyRef:
+                name: buzz-secrets
+                key: READ_DATABASE_URL
+                optional: true
+        template: templates/deployment.yaml
+
+  - it: READ_DATABASE_URL stays optional against the chart-managed Secret
+    set:
+      relayUrl: wss://buzz.example.com
+      ownerPubkey: "0000000000000000000000000000000000000000000000000000000000000000"
+      externalPostgresql.url: postgres://u:p@h:5432/d
+      s3.endpoint: http://minio:9000
+      s3.accessKey: a
+      s3.secretKey: s
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: READ_DATABASE_URL
+            valueFrom:
+              secretKeyRef:
+                name: RELEASE-NAME-buzz-relay
+                key: READ_DATABASE_URL
+                optional: true
+        template: templates/deployment.yaml
+
   - it: RELAY_OWNER_PUBKEY env is set (not BUZZ_RELAY_OWNER_PUBKEY)
     set:
       relayUrl: wss://buzz.example.com

deploy/charts/buzz/values.yaml

@@ -89,6 +89,7 @@ ownerPubkey: ""
 #   BUZZ_RELAY_PRIVATE_KEY        — 64-char hex; relay identity (rotation = identity change)
 #   BUZZ_GIT_HOOK_HMAC_SECRET     — 32+ chars; required when replicaCount > 1
 #   DATABASE_URL                  — full Postgres URL (preferred over externalPostgresql.url)
+#   READ_DATABASE_URL             — optional Postgres read-replica URL; omit to keep all reads on the writer
 #   REDIS_URL                     — full Redis URL with auth
 #   BUZZ_S3_ACCESS_KEY            — S3 access key
 #   BUZZ_S3_SECRET_KEY            — S3 secret key