feat(agent-runtime): run PostgreSQL schema setup before deployment

config/manager/kustomization.yaml

@@ -15,6 +15,7 @@ patches:
     \ - name: RELATED_IMAGE_SAIA_API\n    value: \"667741767953.dkr.ecr.us-west-2.amazonaws.com/ml-platform/saia/saia-api:build-1\"\n
     \ - name: RELATED_IMAGE_SLIM_API\n    value: \"667741767953.dkr.ecr.us-west-2.amazonaws.com/ml-platform/slim/slim-api:build-1\"\n
     \ - name: RELATED_IMAGE_AGENT_RUNTIME_BASE\n    value: \"docker.io/splunk/agent-runtime:latest\"\n
+    \ - name: RELATED_IMAGE_AGENT_RUNTIME_SCHEMA_SETUP\n    value: \"docker.io/splunk/agent-runtime-schema-setup:latest\"\n
     \ - name: RELATED_IMAGE_AGENT_RUNTIME_PROVIDER_MLTK\n    value: \"docker.io/splunk/agent-runtime-provider-mltk:latest\"\n
     \ - name: RELATED_AGENT_RUNTIME_MODULE_PROVIDER_MLTK\n    value: \"agentcore_operations.loader:MLTKAgentLoader\"\n
     \ - name: RELATED_IMAGE_POST_INSTALL_HOOK\n    value: \"667741767953.dkr.ecr.us-west-2.amazonaws.com/ml-platform/saia/saia-data-loader:build-1\"\n

config/samples/ai_v1_aiplatform_agentruntime.yaml

@@ -5,6 +5,11 @@ metadata:
 type: Opaque
 stringData:
   DATABASE_URL: postgresql://user:password@postgres.default.svc.cluster.local:5432/checkpoints
+  PG_HOST: postgres.default.svc.cluster.local
+  PG_PORT: "5432"
+  PG_USER: user
+  PG_PASSWORD: password
+  PG_DBNAME: checkpoints
 ---
 apiVersion: ai.splunk.com/v1
 kind: AIPlatform

helm-chart/splunk-ai-operator/templates/deployment.yaml

@@ -82,6 +82,8 @@ spec:
             value: {{ .Values.slimApiImage }}
           - name: RELATED_IMAGE_AGENT_RUNTIME_BASE
             value: {{ .Values.agentRuntimeBaseImage | quote }}
+          - name: RELATED_IMAGE_AGENT_RUNTIME_SCHEMA_SETUP
+            value: {{ .Values.agentRuntimeSchemaSetupImage | quote }}
 {{- range $version, $image := .Values.agentRuntimeBaseImages }}
           - name: RELATED_IMAGE_AGENT_RUNTIME_BASE_{{ $version | upper | replace "." "_" | replace "-" "_" }}
             value: {{ $image | quote }}

helm-chart/splunk-ai-operator/values.yaml

@@ -116,6 +116,7 @@ slimApiImage: "docker.io/splunk/slim-api:1.0.0"
 # Agent Runtime images. The base image is shared; provider images are carrier
 # payloads keyed by feature.provider.
 agentRuntimeBaseImage: "docker.io/splunk/agent-runtime:latest"
+agentRuntimeSchemaSetupImage: "docker.io/splunk/agent-runtime-schema-setup:latest"
 agentRuntimeBaseImages: {}
 # Example:
 #   v2.0.0: "docker.io/splunk/agent-runtime:v2.0.0"

internal/controller/aiservice_controller.go

@@ -27,6 +27,7 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/builder"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/controller"
+	"sigs.k8s.io/controller-runtime/pkg/event"
 	"sigs.k8s.io/controller-runtime/pkg/handler"
 	logf "sigs.k8s.io/controller-runtime/pkg/log"
 	"sigs.k8s.io/controller-runtime/pkg/predicate"
@@ -228,11 +229,19 @@ func (r *AIServiceReconciler) SetupWithManager(mgr ctrl.Manager) error {
 				common.AnnotationChangedPredicate(),
 			)),
 		).
+		// Watch the referenced checkpoint Secret because it is user-owned and not
+		// an AIService child resource.
+		Watches(
+			&corev1.Secret{},
+			handler.EnqueueRequestsFromMapFunc(r.findAIServicesForCheckpointSecret),
+			builder.WithPredicates(checkpointSecretChangedPredicate()),
+		).
 		// Add predicates to filter events and avoid unnecessary reconciliations
 		WithEventFilter(predicate.Or(
 			common.GenerationChangedPredicate(),
 			common.AnnotationChangedPredicate(),
 			common.LabelChangedPredicate(),
+			checkpointSecretChangedPredicate(),
 		)).
 		// Configure concurrency control
 		WithOptions(controller.Options{
@@ -326,6 +335,46 @@ func (r *AIServiceReconciler) findAIServicesForPlatform(ctx context.Context, pla
 	return requests
 }
 
+// findAIServicesForCheckpointSecret maps a checkpoint Secret to AgentRuntime
+// AIService objects that reference it in the same namespace.
+func (r *AIServiceReconciler) findAIServicesForCheckpointSecret(ctx context.Context, secret client.Object) []reconcile.Request {
+	log := logf.FromContext(ctx)
+	var services aiv1.AIServiceList
+	if err := r.List(ctx, &services, client.InNamespace(secret.GetNamespace())); err != nil {
+		log.Error(err, "failed to list AIServices for checkpoint Secret", "secret", secret.GetName())
+		return nil
+	}
+
+	requests := make([]reconcile.Request, 0)
+	for _, svc := range services.Items {
+		if svc.Spec.Feature.Name == "agentruntime" && svc.Spec.CheckpointDbSecretRef == secret.GetName() {
+			requests = append(requests, reconcile.Request{NamespacedName: types.NamespacedName{
+				Name:      svc.Name,
+				Namespace: svc.Namespace,
+			}})
+		}
+	}
+	return requests
+}
+
+func checkpointSecretChangedPredicate() predicate.Predicate {
+	return predicate.Funcs{
+		CreateFunc: func(e event.CreateEvent) bool {
+			_, ok := e.Object.(*corev1.Secret)
+			return ok
+		},
+		UpdateFunc: func(e event.UpdateEvent) bool {
+			oldSecret, oldOK := e.ObjectOld.(*corev1.Secret)
+			newSecret, newOK := e.ObjectNew.(*corev1.Secret)
+			return oldOK && newOK && oldSecret.ResourceVersion != newSecret.ResourceVersion
+		},
+		DeleteFunc: func(e event.DeleteEvent) bool {
+			_, ok := e.Object.(*corev1.Secret)
+			return ok
+		},
+	}
+}
+
 func containsString(slice []string, s string) bool {
 	for _, x := range slice {
 		if x == s {