Fix postgres-mcp: mount config as file, not DB_CONFIG env var

The freepeak/db-mcp-server image ships a baked-in CONFIG_PATH pointing
at its own bundled sample config; a same-named env var does not take
priority over an existing file at that path, so DB_CONFIG was
silently ignored and the server came up serving the sample databases
instead of ours. Mount the real config as a file at /app/config.json
instead.

postgres-mcp/templates/deployment.yaml

@@ -48,26 +48,30 @@ spec:
             - name: {{ $key }}
               value: {{ $value | quote }}
             {{- end }}
-            {{- if .Values.existingSecret }}
-            - name: DB_CONFIG
-              valueFrom:
-                secretKeyRef:
-                  name: {{ .Values.existingSecret }}
-                  key: {{ .Values.secretConfigKey }}
-            {{- end }}
             {{- if .Values.auditLog.enabled }}
             - name: DB_MCP_AUDIT_LOG
               value: {{ .Values.auditLog.path | quote }}
             {{- end }}
-          {{- if .Values.auditLog.enabled }}
           volumeMounts:
+            {{- if .Values.existingSecret }}
+            - name: db-config
+              mountPath: /app/config.json
+              subPath: {{ .Values.secretConfigKey }}
+              readOnly: true
+            {{- end }}
+            {{- if .Values.auditLog.enabled }}
             - name: audit-log
               mountPath: {{ .Values.auditLog.dir }}
             {{- end }}
           resources:
             {{- toYaml .Values.resources | nindent 12 }}
-      {{- if .Values.auditLog.enabled }}
       volumes:
+        {{- if .Values.existingSecret }}
+        - name: db-config
+          secret:
+            secretName: {{ .Values.existingSecret }}
+        {{- end }}
+        {{- if .Values.auditLog.enabled }}
         - name: audit-log
           persistentVolumeClaim:
             claimName: {{ .Release.Name }}-audit-log

postgres-mcp/values.yaml

@@ -5,16 +5,22 @@ image:
 
 port: 9092
 
-# Name of a Secret holding the whole multi-database config as one JSON blob
+# Name of a Secret holding the whole multi-database config as one JSON blob,
-# (see FreePeak/db-mcp-server's DB_CONFIG env var) -- keeps connection
+# mounted as a file at /app/config.json (the image's own CONFIG_PATH
-# strings/passwords for every database out of a plain ConfigMap.
+# default) -- overriding it by file, not the DB_CONFIG env var, because the
+# image ships a baked-in CONFIG_PATH pointing at its own sample config,
+# which a same-named env var does NOT take priority over (file always wins;
+# confirmed empirically -- DB_CONFIG alone silently loaded the sample DBs
+# instead of ours). Keeps connection strings/passwords for every database
+# out of a plain ConfigMap.
 existingSecret: ""
-secretConfigKey: "DB_CONFIG"
+secretConfigKey: "config.json"
 
 env:
   TRANSPORT_MODE: "sse"
   SERVER_PORT: "9092"
   LOG_LEVEL: "info"
+  CONFIG_PATH: "/app/config.json"
 
 # Persistent audit log (DB_MCP_AUDIT_LOG) -- one JSONL record per executed
 # statement, including rejected writes against read-only databases. Kept on