Helm chart: bundled Postgres DSN has no sslmode param — migrations fail with "pq: SSL is not enabled on the server" #4951

Bug

When postgresql.enabled=true, the chart hardcodes the app's Postgres URL in templates/configmap.yaml:

postgres:
  autoMigrate: migration
  url: postgres://application:application@{{ include "openmeter.fullname" . }}-postgres:5432/application

The URL has no sslmode parameter. Since the migration-based autoMigrate strategy (golang-migrate) opens this DSN with lib/pq, whose default is sslmode=require, and the bundled bitnami PostgreSQL ships with TLS disabled, every service crashloops at startup:

failed to create migrator: failed to open database: pq: SSL is not enabled on the server

The runtime connections (pgx, default sslmode=prefer) fall back to plaintext, which is why this only surfaces once autoMigrate: migration became the default — upgrades from ent-automigrate chart versions (e.g. helm chart 1.0.0-beta.213 → 1.0.0-beta.232) break out of the box.

There is also no values-level escape hatch: the configmap template builds $cfg with mergeOverwrite $config $valuesConfig, so a user-supplied config.postgres.url (with ?sslmode=disable) is overwritten by the generated one.

Repro

1. helm install openmeter oci://ghcr.io/openmeterio/helm-charts/openmeter --version 1.0.0-beta.232 (defaults, bundled Postgres)
2. Watch api/workers crashloop with the error above.

Workaround

Enable TLS on the bundled Postgres so sslmode=require succeeds:

postgresql:
  tls:
    enabled: true
    autoGenerated: true

Suggested fix

Append ?sslmode=disable to the generated DSN for the bundled (non-TLS) Postgres, or let config.postgres.url win over the generated value.

Chart/app version: 1.0.0-beta.232 (also present on current main). Environment: RKE2 + microk8s, helm 3-style OCI install.