PMM-15238: Expose the built-in PostgreSQL to SEP

[ademidoff]

Ticket number: PMM-15238

Feature build: Percona-Lab/pmm-submodules#4495

Lets SEP, running in a side container on a shared Docker bridge network, use PMM's embedded PostgreSQL for its persistence layer. Entirely opt-in — with PMM_ENABLE_SEP unset, nothing about PMM changes.

What it does

When PMM_ENABLE_SEP=1 and PMM_SEP_POSTGRES_PASSWORD are set, the entrypoint runs a new helper (build/ansible/roles/postgres/files/postgres-sep) before supervisord starts. It:

• appends a marker-delimited block to postgresql.conf setting listen_addresses = '*' — this only covers the container's own network namespace, nothing is published on the host;
• appends a marker-delimited block to pg_hba.conf with one scram-sha-256 rule per attached Docker subnet (derived from ip -o -4 route show scope link), scoped to the sep database and sep user only;
• provisions a non-superuser sep role (NOSUPERUSER NOCREATEROLE NOCREATEDB) owning a dedicated sep database.

The postgres, pmm-managed and grafana accounts stay unreachable over the network — Postgres rejects them with no pg_hba.conf entry.

Both config blocks are delimited by # BEGIN PMM SEP / # END PMM SEP and rewritten on every start, so the operation is idempotent. Unsetting PMM_ENABLE_SEP strips them on the next start and returns Postgres to loopback-only; the sep role and database are deliberately left in place, since a config flag should not destroy data.

Drive-by: PG version literals

/srv/postgres14, /srv/.postgres_password and /usr/pgsql-14/bin were duplicated across the entrypoint and postgres-migration. They are now declared once in build/docker/server/entrypoint.sh and passed to both helper scripts via a subshell-scoped export, so they do not leak into the environment supervisord and its children inherit (verified across every /proc/*/environ). Each script aborts with a named message if one is missing.

psql now resolves through $POSTGRES_BIN_DIR rather than /usr/bin/psql, which is an alternatives symlink — fine today, but it resolves to whichever version alternatives prefers, exactly the wrong property during a 14 → 18 migration with both installed.

Still pinned to 14 and out of scope here: build/ansible/roles/supervisord/files/pmm.ini, managed/services/supervisord/pmm_config.go, and the build/ansible/roles/postgres/tasks/*.yml playbooks.

Testing

Verified against percona/pmm-server:3.8.1 with the scripts bind-mounted, using a psql client container on a shared bridge network.

Scenario	Result
Fresh volume, SEP enabled	sep@sep connects, DDL/DML works, pg_stat_statements created
sep → pmm-managed / postgres superuser / grafana over the network	all rejected, no pg_hba.conf entry
Wrong password	authentication failed
Role attributes	rolsuper, rolcreatedb, rolcreaterole all false
Restart, password rotated	one marker block per file, old password rejected, new accepted
Restart with PMM_ENABLE_SEP unset	blocks removed, loopback-only, connection refused, sep role and database survive
Missing PMM_SEP_POSTGRES_PASSWORD	container exits 1 with an actionable message
With PMM_DISABLE_BUILTIN_POSTGRES=1 / PMM_HA_ENABLE=1	warns and starts normally
Two bridge networks attached	one host rule per subnet, connects from both
Existing volume SEP-off, and brand-new volume never SEP-enabled	start clean, readyz OK, health=healthy
POSTGRES_* in supervisord and all children	absent

shellcheck clean on all three scripts; go test ./managed/utils/envvars/... passes.

Notes

• Docker only — the AMI and OVF distributions do not run this entrypoint.
• Traffic on the bridge network is not TLS-encrypted; acceptable container-to-container on a dedicated network, would need revisiting if SEP ever connects from another host.
• PG 18 migration: SEP data now lives in PMM's cluster. A future 14 → 18 migration must carry over all databases, not just pmm-managed and grafana, or the sep database will be silently dropped — nothing in PMM's code references it, so the omission would not be caught.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 45.19%. Comparing base (31318c7) to head (42cf667).
⚠️ Report is 75 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #5700      +/-   ##
==========================================
+ Coverage   43.59%   45.19%   +1.59%     
==========================================
  Files         415      418       +3     
  Lines       43134    43331     +197     
==========================================
+ Hits        18804    19583     +779     
+ Misses      22454    21807     -647     
- Partials     1876     1941      +65     

Flag	Coverage Δ
admin	34.96% <ø> (+0.17%)	⬆️
agent	50.17% <ø> (+1.13%)	⬆️
managed	44.98% <100.00%> (+2.00%)	⬆️
vmproxy	72.22% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.