From 06b179a9fa779693cb2115e41b71745a553fe6a5 Mon Sep 17 00:00:00 2001
From: sHa <sha@shadoll.dev>
Date: Sun, 30 Aug 2026 00:27:46 +0300
Subject: [PATCH] Fix postgres-mcp: mount config as file, not DB_CONFIG env var

The freepeak/db-mcp-server image ships a baked-in CONFIG_PATH pointing
at its own bundled sample config; a same-named env var does not take
priority over an existing file at that path, so DB_CONFIG was
silently ignored and the server came up serving the sample databases
instead of ours. Mount the real config as a file at /app/config.json
instead.
---
 postgres-mcp/templates/deployment.yaml | 26 +++++++++++++++-----------
 postgres-mcp/values.yaml               | 14 ++++++++++----
 2 files changed, 25 insertions(+), 15 deletions(-)

diff --git a/postgres-mcp/templates/deployment.yaml b/postgres-mcp/templates/deployment.yaml
index f62ea12..f7660c3 100644
--- a/postgres-mcp/templates/deployment.yaml
+++ b/postgres-mcp/templates/deployment.yaml
@@ -48,27 +48,31 @@ spec:
             - name: {{ $key }}
               value: {{ $value | quote }}
             {{- end }}
-            {{- if .Values.existingSecret }}
-            - name: DB_CONFIG
-              valueFrom:
-                secretKeyRef:
-                  name: {{ .Values.existingSecret }}
-                  key: {{ .Values.secretConfigKey }}
-            {{- end }}
             {{- if .Values.auditLog.enabled }}
             - name: DB_MCP_AUDIT_LOG
               value: {{ .Values.auditLog.path | quote }}
             {{- end }}
-          {{- if .Values.auditLog.enabled }}
           volumeMounts:
+            {{- if .Values.existingSecret }}
+            - name: db-config
+              mountPath: /app/config.json
+              subPath: {{ .Values.secretConfigKey }}
+              readOnly: true
+            {{- end }}
+            {{- if .Values.auditLog.enabled }}
             - name: audit-log
               mountPath: {{ .Values.auditLog.dir }}
-          {{- end }}
+            {{- end }}
           resources:
             {{- toYaml .Values.resources | nindent 12 }}
-      {{- if .Values.auditLog.enabled }}
       volumes:
+        {{- if .Values.existingSecret }}
+        - name: db-config
+          secret:
+            secretName: {{ .Values.existingSecret }}
+        {{- end }}
+        {{- if .Values.auditLog.enabled }}
         - name: audit-log
           persistentVolumeClaim:
             claimName: {{ .Release.Name }}-audit-log
-      {{- end }}
+        {{- end }}
diff --git a/postgres-mcp/values.yaml b/postgres-mcp/values.yaml
index d885a48..7e4c89a 100644
--- a/postgres-mcp/values.yaml
+++ b/postgres-mcp/values.yaml
@@ -5,16 +5,22 @@ image:
 
 port: 9092
 
-# Name of a Secret holding the whole multi-database config as one JSON blob
-# (see FreePeak/db-mcp-server's DB_CONFIG env var) -- keeps connection
-# strings/passwords for every database out of a plain ConfigMap.
+# Name of a Secret holding the whole multi-database config as one JSON blob,
+# mounted as a file at /app/config.json (the image's own CONFIG_PATH
+# default) -- overriding it by file, not the DB_CONFIG env var, because the
+# image ships a baked-in CONFIG_PATH pointing at its own sample config,
+# which a same-named env var does NOT take priority over (file always wins;
+# confirmed empirically -- DB_CONFIG alone silently loaded the sample DBs
+# instead of ours). Keeps connection strings/passwords for every database
+# out of a plain ConfigMap.
 existingSecret: ""
-secretConfigKey: "DB_CONFIG"
+secretConfigKey: "config.json"
 
 env:
   TRANSPORT_MODE: "sse"
   SERVER_PORT: "9092"
   LOG_LEVEL: "info"
+  CONFIG_PATH: "/app/config.json"
 
 # Persistent audit log (DB_MCP_AUDIT_LOG) -- one JSONL record per executed
 # statement, including rejected writes against read-only databases. Kept on