Method provisionWarehouse

controlplane/provisioning/api.go:204–372

(c *gin.Context)

	// service-credentials mint uses it to fan a snapshot reload out to peer
	// replicas after rotating a credential.
	peerFanout PeerFanout
	// ingressSuffix is the managed tenant DNS suffix (leading dot) joined onto
	// the org ID to build connect.host in the service-credential response. It
	// must match the TLS server_name the CP pins for managed tenants so the
	// host handed back is the ingress the credential auths against. Empty ⇒
	// managedIngressSuffix() falls back to DefaultManagedIngressSuffix.
	ingressSuffix string
}

// warehouseStatusResponse is the public-facing view of warehouse state.
// Exposes lifecycle status and, when ready, connection details (without password).
type warehouseStatusResponse struct {
	OrgID              string                                        `json:"org_id"`
	State              configstore.ManagedWarehouseProvisioningState `json:"state"`
	StatusMessage      string                                        `json:"status_message"`
	S3State            configstore.ManagedWarehouseProvisioningState `json:"s3_state"`
	MetadataStoreState configstore.ManagedWarehouseProvisioningState `json:"metadata_store_state"`
	IdentityState      configstore.ManagedWarehouseProvisioningState `json:"identity_state"`
	SecretsState       configstore.ManagedWarehouseProvisioningState `json:"secrets_state"`
	ReadyAt            *time.Time                                    `json:"ready_at,omitempty"`
	FailedAt           *time.Time                                    `json:"failed_at,omitempty"`
	Connection         *connectionDetails                            `json:"connection,omitempty"`
	// Bucket is the authoritative per-org S3 bucket name the CP provisioned.
	// Empty for external data stores or ducklings provisioned before CP-owned
	// naming whose row hasn't been backfilled yet.
	Bucket string `json:"bucket,omitempty"`
}

// connectionDetails is returned in status (without password) and in provision/reset-password (with password).
type connectionDetails struct {
	Host     string `json:"host"`
	Port     int    `json:"port"`
	Database string `json:"database"`
	Username string `json:"username"`
	Password string `json:"password,omitempty"`
}

type provisionRequest struct {
	DatabaseName string `json:"database_name"`
	// DefaultTeamID is a TRANSITIONAL alias for TeamID (the historical field
	// name from when duckgres tracked a billing/default team). Treated
	// exactly as team_id; remove once the PostHog backend sends team_id.
	DefaultTeamID int64 `json:"default_team_id,omitempty"`
	// TeamID is the org's first PostHog team — a JSON NUMBER, matching
	// PostHog's integer Team.id (a quoted string is a 400 at decode time).
	// REQUIRED when the provision creates a NEW org (400 otherwise — a
	// warehouse cannot exist without a team; the row becomes the org's first
	// duckgres_org_teams entry, no billing semantics attached). Optional on
	// re-provision of an existing org: absent/0 leaves the stored teams
	// untouched. SchemaName optionally overrides the conventional "team_<id>"
	// warehouse schema for that first row; it requires a team id.
	TeamID        int64                  `json:"team_id,omitempty"`
	SchemaName    string                 `json:"schema_name,omitempty"`
	MetadataStore *provisionMetadataReq  `json:"metadata_store,omitempty"`
	DataStore     *provisionDataStoreReq `json:"data_store,omitempty"`
	DuckLake      *provisionDuckLakeReq  `json:"ducklake,omitempty"`

	// Trino is the opt-in flag for the shared Trino cell. Optional — when