[ranyhb]

Consolidates the three remaining actionable PRs into a 4.2.0 release. Supersedes and closes #191, #195, #200. Each is a separate commit with the original author credited via Co-authored-by.

PR	Author	Change
#200	@brianrudolf	Emit SQLALCHEMY_ENABLE_POOL_PRE_PING
#195	@seslly	Honor postgresql.auth.existingSecret for the database password
#191	@Mason0920	topologySpreadConstraints on all workloads

Two of these fix values that silently did nothing

#200 — redash.sqlAlchemyEnablePoolPrePing has been in values.yaml with a documented default of "true", but the shared env helper never emitted the variable. Rendered output contained zero occurrences of SQLALCHEMY_ENABLE_POOL_PRE_PING, so anyone who set it got nothing. Now emitted across all six workloads.

#195 — REDASH_DATABASE_PASSWORD was hardcoded to the password key of <release>-postgresql. Pointing the bundled PostgreSQL at an existing secret left Redash referencing a secret that does not exist. The upstream patch referenced postgresql.auth.secretKeys.userPasswordKey, which this chart never declared, so the key would have resolved empty when only existingSecret was set — both values are now declared and documented.

Verified across all three paths:

values	rendered secretKeyRef
default	{name: test-postgresql, key: password} (unchanged from master)
existingSecret=my-pg	{name: my-pg, key: password}
+ userPasswordKey=pgpass	{name: my-pg, key: pgpass}

#191 was reimplemented, not applied

The upstream patch made the chart fail to render entirely:

Error: parse error at (redash/templates/worker-deployment.yaml:83): bad character U+0024 '$'

It wrote .Values.$workerConfig.topologySpreadConstraints — a variable can't be used as a field name. Three further problems: it used indent 8 where every surrounding block uses nindent 8 (malformed YAML), declared the value as {} though the field is a list, and predated the Knative template.

Reimplemented in the chart's existing style, reading the merged $workerConfig so per-worker overrides work:

test-redash-adhocworker        maxSkew=9 key=topology.kubernetes.io/zone   <- workers.adhoc override
test-redash-genericworker      maxSkew=1 key=kubernetes.io/hostname        <- worker default
test-redash-scheduledworker    maxSkew=1 key=kubernetes.io/hostname

Applied to server, all workers, scheduler, migrations and the Knative Service. Knative gates this PodSpec field, so it needs the corresponding config-features flag there.

Verification

helm lint and helm template pass in default and Knative mode. Rendered manifests parsed as YAML: 31 documents, imagePullSecrets on all 6 pod controllers, 3/3 distinct worker selectors. With no values set, topologySpreadConstraints appears zero times — no behaviour change for existing releases. The 4.1.0 probe helper and clusterDomain still behave correctly.

No upgrade steps: unlike 4.1.0, nothing here touches an immutable field.

🤖 Generated with Claude Code

[cubic-dev-ai]

All reported issues were addressed across 10 files

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>