fix: avoid double helm upgrade in CI install script

[Fortune-Ndlovu]

Description of the change

Previously, .rhdh/scripts/install.sh called helm upgrade twice:

• Once without any values, then again with --set clusterRouterBase, postgresql.password, etc.
  This caused two deployment rollouts:
• Helm created Revision 1, deployed it, then immediately created Revision 2, rolling again. Resulting in two ReplicaSets, and temporary pod churn

This PR removes the first redundant helm upgrade, keeping only the final call with full values.
Verified:

• Only Revision 1 appears in oc rollout history
• Only 1 ReplicaSet is created
• No second deployment or image pull

Which issue(s) does this PR fix or relate to

• https://issues.redhat.com/browse/RHIDP-7500

How to test changes / Special notes to the reviewer

Checklist

• For each Chart updated, version bumped in the corresponding Chart.yaml according to Semantic Versioning.
• For each Chart updated, variables are documented in the values.yaml and added to the corresponding README.md. The pre-commit utility can be used to generate the necessary content. Use pre-commit run -a to apply changes. The pre-commit Workflow will do this automatically for you if needed.
• JSON Schema template updated and re-generated the raw schema via the pre-commit hook.
• Tests pass using the Chart Testing tool and the ct lint command.
• If you updated the orchestrator-infra chart, make sure the versions of the Knative CRDs are aligned with the versions of the CRDs installed by the OpenShift Serverless operators declared in the values.yaml file. See Installing Knative Eventing and Knative Serving CRDs for more details.

Summary by Sourcery

Simplify the CI install script by removing the redundant Helm upgrade and consolidating deployment into a single invocation with proper password handling.

New Features:

• Preserve existing PostgreSQL secret password or generate a new one if absent.

Enhancements:

• Eliminate redundant initial Helm upgrade to prevent double deployment rollouts.
• Consolidate installation into a single Helm upgrade call with explicit cluster router base and database password values.

[rm3l]

@sourcery-ai review

[sourcery-ai]

Reviewer's Guide

The CI install script’s helm deployment has been streamlined by removing the redundant initial upgrade, consolidating parameter collection (including clusterRouterBase) and PostgreSQL password handling into a single helm upgrade invocation, and adding logic to preserve or generate the database password before deployment.

Sequence diagram for streamlined Helm upgrade in CI install script

sequenceDiagram
    actor CI_User as CI/CD Pipeline
    participant Script as install.sh
    participant K8s as Kubernetes Cluster
    participant Helm as Helm
    participant Secret as PostgreSQL Secret

    CI_User->>Script: Run install.sh
    Script->>K8s: Check for redhat-developer-hub-postgresql secret
    alt Secret exists
        Script->>Secret: Retrieve password
    else Secret does not exist
        Script->>Script: Generate new password
    end
    Script->>K8s: Get clusterRouterBase
    Script->>Helm: helm upgrade redhat-developer-hub ... --set clusterRouterBase --set postgresql.password
    Helm->>K8s: Deploy/Upgrade application (single rollout)
    K8s-->>CI_User: Deployment complete

Loading

Flow diagram for improved password handling in install script

flowchart TD
    A[Start install.sh] --> B{Does PostgreSQL secret exist?}
    B -- Yes --> C[Retrieve password from secret]
    B -- No --> D[Generate new password]
    C --> E[Collect clusterRouterBase]
    D --> E
    E --> F[Run helm upgrade with collected values]
    F --> G[Deployment complete]

Loading

File-Level Changes

Change	Details	Files
Consolidate helm upgrade into a single call	Removed the initial helm upgrade -i invocation without any flags Deleted the separate password-only value collection step Retained only the final helm upgrade -i with full --set parameters	.rhdh/scripts/install.sh
Add conditional PostgreSQL secret check and password generation	Inserted kubectl get secret check to detect an existing DB password Decoded the password from the secret when present Generated a new random password via openssl rand when absent Added echo statements to log whether the existing or new password is used	.rhdh/scripts/install.sh

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[sourcery-ai]

Hey @Fortune-Ndlovu - I've reviewed your changes - here's some feedback:

• Add set -euo pipefail at the top of the script to ensure it fails fast on errors and unset variables.
• Consider adding the --wait flag to the helm upgrade invocation so the script waits for a successful rollout before exiting.
• Standardize on either oc or kubectl throughout the script to avoid requiring both CLIs in your CI environment.

Prompt for AI Agents

Please address the comments from this code review:
## Overall Comments
- Add `set -euo pipefail` at the top of the script to ensure it fails fast on errors and unset variables.
- Consider adding the `--wait` flag to the `helm upgrade` invocation so the script waits for a successful rollout before exiting.
- Standardize on either `oc` or `kubectl` throughout the script to avoid requiring both CLIs in your CI environment.

## Individual Comments

### Comment 1
<location> `.rhdh/scripts/install.sh:138` </location>
<code_context>
-helm upgrade redhat-developer-hub -i "${CHART_URL}" --version "$CV"
+# collect values - check for existing secret in the target namespace
+if kubectl get secret redhat-developer-hub-postgresql -n "$namespace" &> /dev/null; then
+  PASSWORD=$(kubectl get secret redhat-developer-hub-postgresql -n "$namespace" -o jsonpath="{.data.password}" | base64 -d)
+  echo "Found existing PostgreSQL secret in namespace $namespace, preserving password"
+else
</code_context>

<issue_to_address>
No error handling if secret exists but password field is missing or malformed.

Add checks to ensure the 'password' field exists and is valid base64 before decoding, and handle errors if not.
</issue_to_address>

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rm3l]

/lgtm