feat(helm): add support for mongodb operator - #41733
Merged
Merged
Conversation
Contributor
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (4)
✅ Files skipped from review due to trivial changes (3)
🚧 Files skipped from review as they are similar to previous changes (1)
WalkthroughAdds optional MongoDB Kubernetes Operator support to the Helm chart: chart version bump and dependency, new values/schema, operator-aware templates (MongoDBCommunity CR, password-init hook, helpers), deployment wiring, docs, tests, and Changes
Sequence Diagram(s)sequenceDiagram
participant Helm as Helm (render)
participant KubeAPI as Kubernetes API
participant Operator as MongoDB Operator
participant Job as Password Init Job
participant MongoDB as MongoDB Pods
participant App as Appsmith Deployment
Helm->>KubeAPI: Install chart with values
alt mongodbOperator.enabled
Helm->>KubeAPI: Install operator subchart & CRDs
KubeAPI->>Operator: Operator deployed
end
alt mongodbCommunity.enabled and no passwordSecretName
Helm->>KubeAPI: Create Password Init Job (pre-install hook)
Job->>KubeAPI: Check/Create password Secret
KubeAPI-->>Job: Secret present/created
end
alt mongodbCommunity.enabled
Helm->>KubeAPI: Create MongoDBCommunity CR
KubeAPI->>Operator: Operator reconciles CR
Operator->>KubeAPI: Create MongoDB Pods (replica set)
KubeAPI->>MongoDB: Pods running
end
Helm->>KubeAPI: Deploy Appsmith (with init-container)
App->>MongoDB: init-container polls DB readiness (mongosh)
App->>KubeAPI: Read connection secret (connectionString.standardSrv)
Estimated code review effort🎯 4 (Complex) | ⏱️ ~60 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Review rate limit: 7/8 reviews remaining, refill in 7 minutes and 30 seconds.Comment |
Use Helm lookup to preserve existing password across upgrades, fall back to randAlphaNum(24) on fresh installs. The secret is annotated with helm.sh/resource-policy: keep so it survives uninstall/reinstall cycles. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
wyattwalter
commented
Apr 15, 2026
| ## @param global.namespaceOverride Override the namespace for resource deployed by the chart, but can itself be overridden by the local namespaceOverride | ||
| ## | ||
| global: | ||
| imageRegistry: "" |
Contributor
Author
There was a problem hiding this comment.
This was an implicit option supported by Bitnami charts, but not documented.
wyattwalter
marked this pull request as ready for review
April 15, 2026 22:43
wyattwalter
commented
Apr 15, 2026
| @@ -0,0 +1,110 @@ | |||
| { | |||
Contributor
Author
There was a problem hiding this comment.
It's in the doc already, but I added all the values that I'm adding to the chart in this pass into a new schema file. Will follow this PR / release with a more complete set.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 8
🧹 Nitpick comments (2)
.gitignore (1)
46-49: Scope themongodb*ignore rule more narrowly.
mongodb*is very broad and can accidentally ignore legitimate repo files outside Helm. Consider limiting it to known local paths (or root-only) used for local MongoDB artifacts.Suggested refinement
-# ignore local mongodb data/binary artifacts developers create during local testing -mongodb* -!deploy/helm/**/mongodb* +# ignore local mongodb data/binary artifacts developers create during local testing +/mongodb* +!deploy/helm/**/mongodb*🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.gitignore around lines 46 - 49, The .gitignore entry "mongodb*" is too broad and may hide legitimate repo files; replace it with a narrowed pattern that only ignores local MongoDB artifacts (for example restrict to root-only "/mongodb*" or specific local dirs like "/tmp/mongodb-*" or "local-data/mongodb/" depending on how developers create artifacts) and keep the existing exception "deploy/helm/**/mongodb*" so Helm chart files are still tracked; update the ignore rule instead of the wildcard to precisely match known local paths used for testing.deploy/helm/values.yaml (1)
90-104: Pin the password-init image by default.Using
latestfor an install-blocking hook makes releases non-reproducible and can break unexpectedly when the upstream image changes bundled tooling orkubectlbehavior. A tested, pinned tag is safer here, withlatestleft as an explicit opt-in.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@deploy/helm/values.yaml` around lines 90 - 104, The passwordInit image uses an unpinned tag ("latest"), making the install hook non-reproducible; change the default value of passwordInit.image.tag to a specific, tested kubectl image tag (replace the current "latest" default with a pinned version) so installs are deterministic and only allow "latest" via an explicit override; update the documentation/comment near passwordInit.image.repository and passwordInit.image.tag to note that pinning is required for reproducible releases.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@deploy/helm/docs/install-mongodb-operator.md`:
- Around line 67-77: The fenced block showing the expected kubectl output is
unlabeled (triggers MD040); update that code fence to include a language label
(use "text") so it becomes ```text ... ```; locate the fenced "Expected output"
block containing the pod/phase/version table and change its opening fence to
```text to satisfy markdownlint without altering the block contents.
In `@deploy/helm/README.md`:
- Around line 174-175: Update the README sentence to use the fully-qualified
Helm value name: replace the ambiguous `auth.passwordSecretName` with
`mongodbCommunity.auth.passwordSecretName` (keep the rest of the sentence intact
referencing `mongodbCommunity.enabled=true` and the `{name}-password` Secret) so
readers can copy the exact setting.
In `@deploy/helm/templates/_helpers.tpl`:
- Around line 141-142: Guard the nested Helm value lookups to avoid nil deref
errors: replace direct access of .Values.initContainer.mongodb.image and
.Values.mongodbOperator.mongodb.repo with safe checks (e.g., use hasKey / with
or default fallbacks) so rendering won't fail when initContainer or
mongodbOperator.mongodb are absent; for example wrap lookups in a with or if
(hasKey .Values "initContainer" and hasKey .Values.initContainer "mongodb")
before accessing .Values.initContainer.mongodb.image, and similarly verify
.Values.mongodbOperator and .Values.mongodbOperator.mongodb exist (or use
default values) before accessing .Values.mongodbOperator.mongodb.repo or
deriving $img.registry/$img.repository/$img.tag in the template.
In `@deploy/helm/templates/deployment.yaml`:
- Around line 171-177: The current guard only checks
.Values.applicationConfig.APPSMITH_DB_URL and
.Values.applicationConfig.APPSMITH_MONGODB_URI, so it still overrides DB
settings provided via other config sources; update the condition around the
APPSMITH_DB_URL env injection to also verify that no DB connection is supplied
via secretName, secrets, or externalSecrets (e.g. check .Values.secretName,
.Values.secrets (or the specific keys used), and .Values.externalSecrets) before
setting the env var; keep the same updated predicate logic in this template as
in templates/import.yaml and use the same include
"appsmith.mongoOperatorSecretName" reference for the secretKeyRef when the
operator-managed DB is truly desired.
In `@deploy/helm/templates/hooks/mongodb-community.yaml`:
- Around line 93-99: The Job pod spec for the password-init hook (container name
"create-password", job name variable {{ $jobName }}) is missing
imagePullSecrets, causing pulls to fail against private registries; add an
imagePullSecrets section under the Job pod spec (beside serviceAccountName and
restartPolicy) that references the chart value (for example use
.Values.global.imagePullSecrets or the existing
.Values.mongodbCommunity.passwordInit.image.pullSecrets if present), ensuring
the Job will use the configured pull secrets when pulling the password-init
image.
In `@deploy/helm/templates/mongodb-community.yaml`:
- Around line 25-31: The roles block currently grants overly broad privileges
(see entries with name: clusterAdmin and name: userAdminAnyDatabase); remove
these two entries and instead ensure the created Appsmith DB user is assigned
only the minimal roles required (e.g., name: readWrite on db: {{
.Values.mongodbCommunity.auth.database }} and optionally name: clusterMonitor if
monitoring is needed) while keeping the dbOwner/db assignment adjusted
accordingly; update the roles list in the roles section so it contains only
readWrite (and clusterMonitor if required) for the Appsmith database.
In `@deploy/helm/tests/mongodb_operator_test.yaml`:
- Around line 130-133: The test fixture contains a literal credential string in
the matchRegex pattern for path data.APPSMITH_DB_URL (pattern:
"mongodb\\+srv://root:password@appsmith-mongodb"); update the regex to avoid
hardcoded credentials by matching a generic credential segment instead (e.g.,
use "mongodb\\+srv://[^@]+@" or "mongodb\\+srv://[^:]+:[^@]+@" or similar) so
the test still verifies the URI shape without embedding real/guessable secrets
in the pattern.
In `@deploy/helm/values.schema.json`:
- Around line 31-33: The JSON schema for mongodbCommunity.name currently allows
63 characters which conflicts with derived resource suffixes; update the schema
by changing the "maxLength" for the mongodbCommunity.name property from 63 to 60
so it matches the helper that generates the default and prevents runtime name
collisions (leave the existing "pattern" unchanged).
---
Nitpick comments:
In @.gitignore:
- Around line 46-49: The .gitignore entry "mongodb*" is too broad and may hide
legitimate repo files; replace it with a narrowed pattern that only ignores
local MongoDB artifacts (for example restrict to root-only "/mongodb*" or
specific local dirs like "/tmp/mongodb-*" or "local-data/mongodb/" depending on
how developers create artifacts) and keep the existing exception
"deploy/helm/**/mongodb*" so Helm chart files are still tracked; update the
ignore rule instead of the wildcard to precisely match known local paths used
for testing.
In `@deploy/helm/values.yaml`:
- Around line 90-104: The passwordInit image uses an unpinned tag ("latest"),
making the install hook non-reproducible; change the default value of
passwordInit.image.tag to a specific, tested kubectl image tag (replace the
current "latest" default with a pinned version) so installs are deterministic
and only allow "latest" via an explicit override; update the
documentation/comment near passwordInit.image.repository and
passwordInit.image.tag to note that pinning is required for reproducible
releases.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 8b35fba0-5d20-4580-8f6d-682b8de9bfab
⛔ Files ignored due to path filters (1)
deploy/helm/tests/__snapshot__/defaults_snapshot_test.yaml.snapis excluded by!**/*.snap
📒 Files selected for processing (13)
.gitignoredeploy/helm/Chart.yamldeploy/helm/README.mddeploy/helm/docs/install-mongodb-operator.mddeploy/helm/templates/NOTES.txtdeploy/helm/templates/_helpers.tpldeploy/helm/templates/deployment.yamldeploy/helm/templates/hooks/mongodb-community.yamldeploy/helm/templates/import.yamldeploy/helm/templates/mongodb-community.yamldeploy/helm/tests/mongodb_operator_test.yamldeploy/helm/values.schema.jsondeploy/helm/values.yaml
Comment on lines
+141
to
+142
| {{- $registry := (.Values.global).imageRegistry | default $img.registry -}} | ||
| {{- printf "%s/%s:%s" $registry $img.repository $img.tag -}} |
Contributor
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Verify whether intermediate maps are guaranteed by defaults
fd -a 'values*.yaml' deploy/helm
rg -n -C2 '(^global:|^initContainer:|^mongodbOperator:|passwordInit:)' deploy/helmRepository: appsmithorg/appsmith
Length of output: 1523
🏁 Script executed:
fd -a 'values*.yaml' deploy/helm | xargs grep -A 20 "^mongodbOperator:"Repository: appsmithorg/appsmith
Length of output: 874
🏁 Script executed:
sed -n '130,175p' deploy/helm/templates/_helpers.tpl | cat -nRepository: appsmithorg/appsmith
Length of output: 2429
Guard nested Helm value lookups at lines 166 and 169 to prevent render-time failures
Unsafe field chaining on potentially nil maps will cause template rendering errors. Line 166 accesses .Values.initContainer.mongodb.image when initContainer is an empty dict by default, and line 169 accesses .Values.mongodbOperator.mongodb.repo when mongodbOperator.mongodb does not exist in values.yaml.
Suggested hardening
{{- define "appsmith.mongoInitContainerImage" -}}
-{{- if ((.Values.initContainer).mongodb).image -}}
-{{- .Values.initContainer.mongodb.image -}}
+{{- $initImage := dig "initContainer" "mongodb" "image" "" .Values -}}
+{{- if $initImage -}}
+{{- $initImage -}}
{{- else -}}
-{{- $repo := ((.Values.mongodbOperator).mongodb).repo | default "quay.io/mongodb" -}}
+{{- $repo := dig "mongodbOperator" "mongodb" "repo" "quay.io/mongodb" .Values -}}
{{- printf "%s/mongodb-community-server:%s-ubi8" $repo .Values.mongodbCommunity.version -}}
{{- end -}}
{{- end -}}🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@deploy/helm/templates/_helpers.tpl` around lines 141 - 142, Guard the nested
Helm value lookups to avoid nil deref errors: replace direct access of
.Values.initContainer.mongodb.image and .Values.mongodbOperator.mongodb.repo
with safe checks (e.g., use hasKey / with or default fallbacks) so rendering
won't fail when initContainer or mongodbOperator.mongodb are absent; for example
wrap lookups in a with or if (hasKey .Values "initContainer" and hasKey
.Values.initContainer "mongodb") before accessing
.Values.initContainer.mongodb.image, and similarly verify
.Values.mongodbOperator and .Values.mongodbOperator.mongodb exist (or use
default values) before accessing .Values.mongodbOperator.mongodb.repo or
deriving $img.registry/$img.repository/$img.tag in the template.
Comment on lines
+171
to
+177
| {{- if and .Values.mongodbCommunity.enabled (not .Values.mongodb.enabled) (not .Values.applicationConfig.APPSMITH_DB_URL) (not .Values.applicationConfig.APPSMITH_MONGODB_URI) }} | ||
| - name: APPSMITH_DB_URL | ||
| valueFrom: | ||
| secretKeyRef: | ||
| name: {{ include "appsmith.mongoOperatorSecretName" . }} | ||
| key: connectionString.standardSrv | ||
| {{- end }} |
Contributor
There was a problem hiding this comment.
Don't override secret-backed DB settings here.
This guard only checks .Values.applicationConfig.*. If a user supplies MongoDB settings through secretName, secrets, or externalSecrets, this explicit APPSMITH_DB_URL still wins and silently forces Appsmith onto the operator-managed database. Please gate this on all supported config sources, and keep templates/import.yaml in sync with the same rule.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@deploy/helm/templates/deployment.yaml` around lines 171 - 177, The current
guard only checks .Values.applicationConfig.APPSMITH_DB_URL and
.Values.applicationConfig.APPSMITH_MONGODB_URI, so it still overrides DB
settings provided via other config sources; update the condition around the
APPSMITH_DB_URL env injection to also verify that no DB connection is supplied
via secretName, secrets, or externalSecrets (e.g. check .Values.secretName,
.Values.secrets (or the specific keys used), and .Values.externalSecrets) before
setting the env var; keep the same updated predicate logic in this template as
in templates/import.yaml and use the same include
"appsmith.mongoOperatorSecretName" reference for the secretKeyRef when the
operator-managed DB is truly desired.
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
♻️ Duplicate comments (1)
deploy/helm/docs/install-mongodb-operator.md (1)
67-77:⚠️ Potential issue | 🟡 MinorLabel the fenced “Expected output” block with a language.
The code fence at Line 67 should include a language (use
text) to satisfy markdownlint MD040.Suggested fix
-``` +```text NAME READY STATUS appsmith-0 1/1 Running appsmith-mongo-0 2/2 Running appsmith-postgresql-0 1/1 Running appsmith-redis-master-0 1/1 Running mongodb-kubernetes-operator-... 1/1 Running NAME PHASE VERSION appsmith-mongo Running 8.0.20</details> <details> <summary>🤖 Prompt for AI Agents</summary>Verify each finding against the current code and only fix it if needed.
In
@deploy/helm/docs/install-mongodb-operator.mdaround lines 67 - 77, The
fenced "Expected output" block is missing a language hint which triggers
markdownlint MD040; edit the fenced block (the multiline example showing
NAME/READY/STATUS and PHASE/VERSION) and add the language identifiertext
immediately after the opening triple backticks so the block becomes ```text,
ensuring the example is properly labeled for linting.</details> </blockquote></details> </blockquote></details> <details> <summary>🤖 Prompt for all review comments with AI agents</summary>Verify each finding against the current code and only fix it if needed.
Inline comments:
In@deploy/helm/values.yaml:
- Around line 67-68: The values key mongodbCommunity.replicaSetName is declared
but never used; either wire it into the mongodb-community Helm template or
remove it. To fix, update deploy/helm/templates/mongodb-community.yaml to
consume .Values.mongodbCommunity.replicaSetName and render it into the MongoDB
resource (e.g., set spec.replicaSetName on the MongoDBCommunity CR or the
StatefulSet/Pod spec that requires the replica set name) so the configured value
influences the deployed resource; alternatively, if the chart/operator doesn’t
support configuring a replica set, remove/deprecate the replicaSetName entry
from values.yaml. Reference the values key replicaSetName and the template file
mongodb-community.yaml when making the change.
Duplicate comments:
In@deploy/helm/docs/install-mongodb-operator.md:
- Around line 67-77: The fenced "Expected output" block is missing a language
hint which triggers markdownlint MD040; edit the fenced block (the multiline
example showing NAME/READY/STATUS and PHASE/VERSION) and add the language
identifiertextimmediately after the opening triple backticks so the block
becomes ```text, ensuring the example is properly labeled for linting.</details> <details> <summary>🪄 Autofix (Beta)</summary> Fix all unresolved CodeRabbit comments on this PR: - [ ] <!-- {"checkboxId": "4b0d0e0a-96d7-4f10-b296-3a18ea78f0b9"} --> Push a commit to this branch (recommended) - [ ] <!-- {"checkboxId": "ff5b1114-7d8c-49e6-8ac1-43f82af23a33"} --> Create a new PR with the fixes </details> --- <details> <summary>ℹ️ Review info</summary> <details> <summary>⚙️ Run configuration</summary> **Configuration used**: Path: .coderabbit.yaml **Review profile**: CHILL **Plan**: Pro **Run ID**: `d9518d1d-9144-4b15-9180-c9a685a76dbf` </details> <details> <summary>📥 Commits</summary> Reviewing files that changed from the base of the PR and between a51d25a9a64f0326fdf8b0b38881172af2150f67 and adba5b8a40cba1a75e8c9d714c7a6cc2e331cd96. </details> <details> <summary>📒 Files selected for processing (3)</summary> * `deploy/helm/docs/install-mongodb-operator.md` * `deploy/helm/templates/_helpers.tpl` * `deploy/helm/values.yaml` </details> <details> <summary>🚧 Files skipped from review as they are similar to previous changes (1)</summary> * deploy/helm/templates/_helpers.tpl </details> </details> <!-- This is an auto-generated comment by CodeRabbit for review status -->
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
♻️ Duplicate comments (1)
deploy/helm/templates/deployment.yaml (1)
171-181:⚠️ Potential issue | 🟠 Major
.Values.secretsis still an override hole here.
envFromat Lines 189-192 loads the chart-managed Secret when.Values.secretsis set, but this guard does not exclude that path. Since explicitenvwins overenvFrom, a secret-backedAPPSMITH_DB_URLis still silently replaced by the operator connection string.Suggested patch
- {{- if and .Values.mongodbCommunity.enabled (not .Values.mongodb.enabled) (not .Values.applicationConfig.APPSMITH_DB_URL) (not .Values.applicationConfig.APPSMITH_MONGODB_URI) (not .Values.secretName) (not .Values.externalSecrets.enabled) }} + {{- if and .Values.mongodbCommunity.enabled (not .Values.mongodb.enabled) (not .Values.applicationConfig.APPSMITH_DB_URL) (not .Values.applicationConfig.APPSMITH_MONGODB_URI) (not .Values.secretName) (not .Values.secrets) (not .Values.externalSecrets.enabled) }}🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@deploy/helm/templates/deployment.yaml` around lines 171 - 181, The APPSMITH_DB_URL injection block can still override a user-provided DB URL coming from chart-managed secrets because .Values.secrets is not excluded; update the conditional that controls the APPSMITH_DB_URL env entry to also require (not .Values.secrets) (i.e. extend the and(...) check), so the block only runs when .Values.secrets is false/absent. Edit the stanza that sets APPSMITH_DB_URL (the block referencing include "appsmith.mongoOperatorSecretName" and valueFrom.secretKeyRef.connectionString.standardSrv) to add the (not .Values.secrets) guard so envFrom-backed secrets cannot be silently overridden.
🧹 Nitpick comments (1)
deploy/helm/tests/mongodb_operator_test.yaml (1)
174-211: Add regression coverage for secret-backed DB config.The deployment branching now depends on
secretName,.Values.secrets, andexternalSecrets.enabled, but this suite only covers bare operator-only and transition mode. Please add cases asserting that bothAPPSMITH_DB_URLand the operatormongo-init-containerstay absent when any secret-backed DB source is present.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@deploy/helm/tests/mongodb_operator_test.yaml` around lines 174 - 211, Add tests covering secret-backed DB sources by creating new cases that set a secret-backed DB via the template variables (e.g., set secretName: "some-secret", set .Values.secrets to include that secret, and set externalSecrets.enabled: true) and assert that the operator init container ("mongo-init-container" at spec.template.spec.initContainers) is absent and that APPSMITH_DB_URL (env entry under spec.template.spec.containers[0].env) is not injected; also add similar cases for each relevant combination (secretName present, .Values.secrets populated, and externalSecrets.enabled true) to ensure both initContainers and APPSMITH_DB_URL remain absent in operator-only and transition scenarios.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@deploy/helm/templates/deployment.yaml`:
- Around line 92-95: The mongo-init-container block is currently gated only by
.Values.mongodbCommunity.enabled so the pod may wait on the operator even when
Appsmith uses a different DB; change the condition to reuse the same predicate
used when injecting APPSMITH_DB_URL (the helper/logic that determines “Appsmith
is targeting operator-managed MongoDB”) so the init container runs only when
Appsmith is actually targeting operator-managed MongoDB. Concretely, replace the
current else-if (.Values.mongodbCommunity.enabled) around the
mongo-init-container with the exact predicate/helper used for APPSMITH_DB_URL
injection (the same include/templating expression), keeping the rest of the
mongo-init-container (name: mongo-init-container, image: include
"appsmith.mongoInitContainerImage", and the mongosh command) unchanged.
---
Duplicate comments:
In `@deploy/helm/templates/deployment.yaml`:
- Around line 171-181: The APPSMITH_DB_URL injection block can still override a
user-provided DB URL coming from chart-managed secrets because .Values.secrets
is not excluded; update the conditional that controls the APPSMITH_DB_URL env
entry to also require (not .Values.secrets) (i.e. extend the and(...) check), so
the block only runs when .Values.secrets is false/absent. Edit the stanza that
sets APPSMITH_DB_URL (the block referencing include
"appsmith.mongoOperatorSecretName" and
valueFrom.secretKeyRef.connectionString.standardSrv) to add the (not
.Values.secrets) guard so envFrom-backed secrets cannot be silently overridden.
---
Nitpick comments:
In `@deploy/helm/tests/mongodb_operator_test.yaml`:
- Around line 174-211: Add tests covering secret-backed DB sources by creating
new cases that set a secret-backed DB via the template variables (e.g., set
secretName: "some-secret", set .Values.secrets to include that secret, and set
externalSecrets.enabled: true) and assert that the operator init container
("mongo-init-container" at spec.template.spec.initContainers) is absent and that
APPSMITH_DB_URL (env entry under spec.template.spec.containers[0].env) is not
injected; also add similar cases for each relevant combination (secretName
present, .Values.secrets populated, and externalSecrets.enabled true) to ensure
both initContainers and APPSMITH_DB_URL remain absent in operator-only and
transition scenarios.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 7592253d-a546-446b-9a30-6280ecfdba42
📒 Files selected for processing (6)
deploy/helm/README.mddeploy/helm/templates/deployment.yamldeploy/helm/templates/hooks/mongodb-community.yamldeploy/helm/templates/mongodb-community.yamldeploy/helm/tests/mongodb_operator_test.yamldeploy/helm/values.schema.json
✅ Files skipped from review due to trivial changes (2)
- deploy/helm/values.schema.json
- deploy/helm/README.md
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (2)
deploy/helm/README.md (1)
174-174: Clarify derived Secret name whenmongodbCommunity.nameis empty.Line 174 currently implies a literal
{mongodbCommunity.name}-password; consider clarifying that it uses the resolved MongoDBCommunity name (defaulting to<release-fullname>-mongo).🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@deploy/helm/README.md` at line 174, Clarify the README text to state that when mongodbCommunity.enabled=true and mongodbCommunity.auth.passwordSecretName is empty the pre-install Job writes the password into a Secret whose name is derived from the resolved MongoDBCommunity resource name (i.e. the chart/operator will use the resolved mongodbCommunity.name, which defaults to <release-fullname>-mongo if not explicitly set), so the Secret will be named "<resolved-mongodbCommunity.name>-password" rather than the literal "{mongodbCommunity.name}-password"; mention the default explicitly and reference mongodbCommunity.name, mongodbCommunity.auth.passwordSecretName and the pre-install Job to make lookup unambiguous.deploy/helm/values.schema.json (1)
61-64: Add explicit schema default forpasswordSecretNameto match chart defaults.Line 61-64:
mongodbCommunity.auth.passwordSecretNameis missing"default": "", whiledeploy/helm/values.yamldefaults it to empty. Keeping schema/defaults aligned avoids drift in schema-aware tooling and docs.Suggested diff
"passwordSecretName": { "type": "string", - "description": "Name of an existing Secret containing the password (key: password). When empty, a pre-install Job generates a random password into a Secret named \"{name}-password\"." + "description": "Name of an existing Secret containing the password (key: password). When empty, a pre-install Job generates a random password into a Secret named \"{name}-password\".", + "default": "" }🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@deploy/helm/values.schema.json` around lines 61 - 64, The JSON schema property mongodbCommunity.auth.passwordSecretName is missing an explicit default and should include "default": "" to match the chart default in deploy/helm/values.yaml; update the values.schema.json entry for passwordSecretName (the property named "passwordSecretName" under mongodbCommunity.auth) to add the default empty string so schema-aware tooling and docs reflect the chart's behavior.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@deploy/helm/README.md`:
- Around line 166-167: The quickstart shows a mismatch between the Helm repo
alias and the install command: the README adds the repo as "stable-appsmith" but
the install uses "appsmith/appsmith"; update the Helm install command to use the
same alias added earlier (e.g., use "stable-appsmith/appsmith" in the `helm
install` invocation) or alternatively change the repo add alias to "appsmith" so
the existing `helm install appsmith appsmith/appsmith` matches; update whichever
of `helm repo add` or the `helm install` line (referencing the helm install
command and the repo alias) so both use the same repository alias.
---
Nitpick comments:
In `@deploy/helm/README.md`:
- Line 174: Clarify the README text to state that when
mongodbCommunity.enabled=true and mongodbCommunity.auth.passwordSecretName is
empty the pre-install Job writes the password into a Secret whose name is
derived from the resolved MongoDBCommunity resource name (i.e. the
chart/operator will use the resolved mongodbCommunity.name, which defaults to
<release-fullname>-mongo if not explicitly set), so the Secret will be named
"<resolved-mongodbCommunity.name>-password" rather than the literal
"{mongodbCommunity.name}-password"; mention the default explicitly and reference
mongodbCommunity.name, mongodbCommunity.auth.passwordSecretName and the
pre-install Job to make lookup unambiguous.
In `@deploy/helm/values.schema.json`:
- Around line 61-64: The JSON schema property
mongodbCommunity.auth.passwordSecretName is missing an explicit default and
should include "default": "" to match the chart default in
deploy/helm/values.yaml; update the values.schema.json entry for
passwordSecretName (the property named "passwordSecretName" under
mongodbCommunity.auth) to add the default empty string so schema-aware tooling
and docs reflect the chart's behavior.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 89836f30-7647-468c-86f2-d4b6a8bf633b
📒 Files selected for processing (4)
deploy/helm/README.mddeploy/helm/docs/install-mongodb-operator.mddeploy/helm/values.schema.jsondeploy/helm/values.yaml
✅ Files skipped from review due to trivial changes (1)
- deploy/helm/docs/install-mongodb-operator.md
🚧 Files skipped from review as they are similar to previous changes (1)
- deploy/helm/values.yaml
Contributor
There was a problem hiding this comment.
♻️ Duplicate comments (1)
deploy/helm/templates/_helpers.tpl (1)
142-142:⚠️ Potential issue | 🟠 MajorHarden nested
.Valueslookups to prevent render-time nil dereferences.Line 142, Line 177, and Line 180 still chain through optional maps directly. If any intermediate key is missing, template rendering can fail. This repeats the previously reported issue for the image helper paths.
Suggested hardening diff
{{- define "appsmith.useOperatorMongo" -}} -{{- if and .Values.mongodbCommunity.enabled (not .Values.mongodb.enabled) (not .Values.applicationConfig.APPSMITH_DB_URL) (not .Values.applicationConfig.APPSMITH_MONGODB_URI) (not .Values.secretName) (not .Values.secrets) (not .Values.externalSecrets.enabled) -}} +{{- $dbURL := dig "applicationConfig" "APPSMITH_DB_URL" "" .Values -}} +{{- $mongoURI := dig "applicationConfig" "APPSMITH_MONGODB_URI" "" .Values -}} +{{- $externalSecretsEnabled := dig "externalSecrets" "enabled" false .Values -}} +{{- if and .Values.mongodbCommunity.enabled (not .Values.mongodb.enabled) (not $dbURL) (not $mongoURI) (not .Values.secretName) (not .Values.secrets) (not $externalSecretsEnabled) -}} true {{- end -}} {{- end -}} @@ {{- define "appsmith.mongoInitContainerImage" -}} -{{- if ((.Values.initContainer).mongodb).image -}} -{{- .Values.initContainer.mongodb.image -}} +{{- $initImage := dig "initContainer" "mongodb" "image" "" .Values -}} +{{- if $initImage -}} +{{- $initImage -}} {{- else -}} -{{- $repo := ((.Values.mongodbOperator).mongodb).repo | default "quay.io/mongodb" -}} +{{- $repo := dig "mongodbOperator" "mongodb" "repo" "quay.io/mongodb" .Values -}} {{- printf "%s/mongodb-community-server:%s-ubi8" $repo .Values.mongodbCommunity.version -}} {{- end -}} {{- end -}}#!/bin/bash set -euo pipefail # Inspect helper implementations in this PR surface sed -n '136,186p' deploy/helm/templates/_helpers.tpl # Verify whether the chained paths are guaranteed across values files fd -a 'values*.yaml' deploy/helm | while read -r f; do echo "---- $f ----" rg -n '^(applicationConfig|externalSecrets|initContainer|mongodbOperator):|^[[:space:]]+mongodb:|^[[:space:]]+repo:|^[[:space:]]+enabled:' "$f" || true doneAlso applies to: 177-181
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@deploy/helm/templates/_helpers.tpl` at line 142, The conditional chains like .Values.applicationConfig.APPSMITH_DB_URL, .Values.secretName, .Values.secrets, and .Values.externalSecrets.enabled can nil-deref during render; change the expression to defensively test for intermediate keys using hasKey and index (e.g. hasKey .Values "applicationConfig" and hasKey (index .Values "applicationConfig") "APPSMITH_DB_URL") before accessing their fields, and similarly guard .Values.secretName/.Values.secrets and hasKey .Values "externalSecrets" && hasKey (index .Values "externalSecrets") "enabled" before reading .Values.externalSecrets.enabled; apply the same pattern around .Values.mongodbCommunity.enabled and .Values.mongodb.enabled checks to harden the entire conditional in the helper template.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Duplicate comments:
In `@deploy/helm/templates/_helpers.tpl`:
- Line 142: The conditional chains like
.Values.applicationConfig.APPSMITH_DB_URL, .Values.secretName, .Values.secrets,
and .Values.externalSecrets.enabled can nil-deref during render; change the
expression to defensively test for intermediate keys using hasKey and index
(e.g. hasKey .Values "applicationConfig" and hasKey (index .Values
"applicationConfig") "APPSMITH_DB_URL") before accessing their fields, and
similarly guard .Values.secretName/.Values.secrets and hasKey .Values
"externalSecrets" && hasKey (index .Values "externalSecrets") "enabled" before
reading .Values.externalSecrets.enabled; apply the same pattern around
.Values.mongodbCommunity.enabled and .Values.mongodb.enabled checks to harden
the entire conditional in the helper template.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 7107a1cb-82bd-4be1-9567-7dee96a359f9
📒 Files selected for processing (4)
deploy/helm/README.mddeploy/helm/templates/_helpers.tpldeploy/helm/templates/deployment.yamldeploy/helm/values.schema.json
✅ Files skipped from review due to trivial changes (2)
- deploy/helm/values.schema.json
- deploy/helm/README.md
🚧 Files skipped from review as they are similar to previous changes (1)
- deploy/helm/templates/deployment.yaml
Contributor
Author
|
The last thing from coderabbit is how the other places in the chart do it, so I'm ignoring that one for now. |
Contributor
There was a problem hiding this comment.
♻️ Duplicate comments (1)
deploy/helm/templates/_helpers.tpl (1)
177-180:⚠️ Potential issue | 🟠 MajorHarden nested Helm value access to prevent render-time nil dereferences.
Line 177 and Line 180 still use unsafe chained lookups; if intermediate maps are unset/null,
helm templatecan fail. Please switch to guarded access (dig/with/hasKey) for both paths.Suggested fix
{{- define "appsmith.mongoInitContainerImage" -}} -{{- if ((.Values.initContainer).mongodb).image -}} -{{- .Values.initContainer.mongodb.image -}} +{{- $initImage := dig "initContainer" "mongodb" "image" "" .Values -}} +{{- if $initImage -}} +{{- $initImage -}} {{- else -}} -{{- $repo := ((.Values.mongodbOperator).mongodb).repo | default "quay.io/mongodb" -}} +{{- $repo := dig "mongodbOperator" "mongodb" "repo" "quay.io/mongodb" .Values -}} {{- printf "%s/mongodb-community-server:%s-ubi8" $repo .Values.mongodbCommunity.version -}} {{- end -}} {{- end -}}#!/bin/bash set -euo pipefail # 1) Confirm current helper still uses chained access in this file rg -n -C2 'define "appsmith.mongoInitContainerImage"|initContainer|mongodbOperator' deploy/helm/templates/_helpers.tpl # 2) Inspect values defaults for intermediate map presence across chart values files fd -a 'values*.yaml' deploy/helm | xargs -I{} sh -c ' echo "=== {} ===" rg -n -C2 "^(initContainer:|mongodbOperator:)" "{}" || true '🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@deploy/helm/templates/_helpers.tpl` around lines 177 - 180, The template accesses nested values unsafely (".Values.initContainer.mongodb.image" and ".Values.mongodbOperator.mongodb.repo"); change both lookups to guarded forms using helm's dig/hasKey/with so missing intermediate maps don't cause render-time nil derefs — e.g., check for .Values.initContainer and its "mongodb" key (or use dig .Values "initContainer" "mongodb" "image") and similarly guard .Values.mongodbOperator before reading .Values.mongodbOperator.mongodb.repo, returning a sensible default when keys are absent; update the helper definition (the template that emits the mongo initContainer image) to use these guarded lookups.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Duplicate comments:
In `@deploy/helm/templates/_helpers.tpl`:
- Around line 177-180: The template accesses nested values unsafely
(".Values.initContainer.mongodb.image" and
".Values.mongodbOperator.mongodb.repo"); change both lookups to guarded forms
using helm's dig/hasKey/with so missing intermediate maps don't cause
render-time nil derefs — e.g., check for .Values.initContainer and its "mongodb"
key (or use dig .Values "initContainer" "mongodb" "image") and similarly guard
.Values.mongodbOperator before reading .Values.mongodbOperator.mongodb.repo,
returning a sensible default when keys are absent; update the helper definition
(the template that emits the mongo initContainer image) to use these guarded
lookups.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: e3c0f189-62a5-4de4-a2c5-79fcfb69290c
📒 Files selected for processing (4)
deploy/helm/README.mddeploy/helm/templates/_helpers.tpldeploy/helm/templates/deployment.yamldeploy/helm/values.schema.json
✅ Files skipped from review due to trivial changes (2)
- deploy/helm/README.md
- deploy/helm/values.schema.json
🚧 Files skipped from review as they are similar to previous changes (1)
- deploy/helm/templates/deployment.yaml
|
This PR has not seen activitiy for a while. It will be closed in 7 days unless further activity is detected. |
subrata71
reviewed
Apr 29, 2026
subrata71
left a comment
subrata71
left a comment
Collaborator
There was a problem hiding this comment.
Thanks for adding the operator-managed MongoDB path. The overall direction makes sense, but I have a concern around migration safety from the existing Bitnami chart-based MongoDB.
From what I understand, this PR enables a transition mode where both Bitnami MongoDB and MongoDBCommunity can run side by side, while Appsmith continues to use the Bitnami instance until mongodb.enabled=false is set. That helps stage the new MongoDB deployment, but I do not see anything that actually performs or validates data migration. Am I missing something here?
Can we clarify the expected production migration path before merging/recommending this?
Contributor
Author
|
@subrata71 Yes, that's intentional. Helm is not an orchestrator, so I did not attempt an automatic migration. I added a few more explicit notes about the status of migration support (it works, but some edge cases), I'd like to merge this in while that works. It won't release until it gets merged to master. |
sebastianiv21
self-requested a review
April 29, 2026 20:10
sebastianiv21
approved these changes
Apr 29, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Tip
Add a TL;DR when the description is longer than 500 words or extremely technical (helps the content, marketing, and DevRel team).
Please also include relevant motivation and context. List any dependencies that are required for this change. Add links to Notion, Figma or any other documents that might be relevant to the PR.
Adds preview support for the MongoDB operator to replace the old Bitnami chart. I've been unable to find a seamless alternative to the old chart and having to maintain our own templates is untenable. This is the direction that MongoDB is going, so it seems simpler to embrace it.
The Bitnami chart and MongoDB operator options are not mutually exclusive here to allow for transitioning between the two. However, in practice the time where both are enabled should be minimal to avoid confusion and extra resources.
Pros for this approach:
Cons:
Once we've gotten through some testing, intent is to share docs on how to use this for both new installs and how to transition. Then at some point in the future, create a new major release that forces the administrator to either migrate or bring in their own MongoDB from an external source.
Fixes https://linear.app/appsmith/issue/APP-14807/task-helm-chart-switch-for-mongodb-image-from-bitnami-to-mongodb
Automation
/ok-to-test tags=""
🔍 Cypress test results
Warning
Tests have not run on the HEAD 92c0eed yet
Wed, 29 Apr 2026 20:05:39 UTC
Communication
Should the DevRel and Marketing teams inform users about this change?
Summary by CodeRabbit
New Features
Documentation
Tests
Chores