Read db passwords from the environment first

[zaihuaji]

Summary

• Look up the db password in the environment before .pgpass and OpenBao, for containers on CIRRUS where a Kubernetes secret injects it as <NODE>_<KEY> (PGDB01_DSSDBPASS, PGDB03_IVADDBPASS, ...).
• Cache a password found in .pgpass or OpenBao back into the environment, so that child processes on local and PBS batch hosts inherit it instead of repeating the lookup.
• Derive one secret name from the db server node and the login name, serving both the OpenBao path kv/gdex/<node> and the environment variable, so the two transports cannot drift.
• Prefer the node of the host being connected to (pgdb02 for the view host) and fall back to the node mapped for the db name (pgdb01), so a node without its own secrets keeps working.
• Bump version to 3.0.15.

Test plan

• Secret names resolve as deployed for all 9 host/db/login combinations.
• pgdb02 uses PGDB02_* / kv/gdex/pgdb02 when present and falls back to PGDB01_* / kv/gdex/pgdb01 when missing; pgdb01 and pgdb03 unchanged.
• Write-back exports under the preferred node only.
• pytest passes.

[Copilot]

🟡 Changes recommended

Newly added docstrings describe host-conditional environment caching that the implementation does not enforce, which can mislead operators about runtime behavior.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

This PR updates PgDBI’s credential resolution so PostgreSQL passwords are first read from the environment (to support CIRRUS/Kubernetes secret injection), with fallbacks to .pgpass and OpenBao, and adds an environment write-back cache to avoid repeated lookups in child processes. It also standardizes secret naming based on (db node, login) and bumps the package version to 3.0.15.

Changes:

• Add env-first password lookup and env write-back caching in PgDBI, plus node-based OpenBao secret loading with fallback nodes.
• Introduce node/key derivation helpers (get_dbnodes, get_secret_name, get_envpassword, set_envpassword) and new mappings (DBNODES, DBSKEYS).
• Bump package/version references from 3.0.14 → 3.0.15.

File summaries

File	Description
src/rda_python_common/pg_dbi.py	Adds env-first password lookup, env caching, and node-based OpenBao secret resolution with fallback behavior.
src/rda_python_common/init.py	Bumps __version__ to 3.0.15.
README.md	Updates displayed “current version” to 3.0.15.
pyproject.toml	Bumps project version to 3.0.15.

Review details

Suppressed comments (1)

src/rda_python_common/pg_dbi.py:2714

• This docstring restricts env caching to local/PBS batch hosts, but set_envpassword() is called without any such condition. Update the docstring (or add the missing condition).

      Called for a password found in .pgpass or OpenBao, on local and PBS batch hosts,
      so that the child processes of the current one inherit it and skip the lookup.

• Files reviewed: 4/4 changed files
• Comments generated: 1
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.