From b0b3f3382fb2471074791de31e6c22616c47726a Mon Sep 17 00:00:00 2001
From: michaelkedar <michaelkedar@google.com>
Date: Mon, 26 Oct 2026 05:43:54 +0000
Subject: [PATCH] feat: add env vars for prod prostgres dual reads

---
 deployment/clouddeploy/osv-api/run-prod.yaml | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

diff --git a/deployment/clouddeploy/osv-api/run-prod.yaml b/deployment/clouddeploy/osv-api/run-prod.yaml
index d8ca1a1b8c2..7c55a682b54 100644
--- a/deployment/clouddeploy/osv-api/run-prod.yaml
+++ b/deployment/clouddeploy/osv-api/run-prod.yaml
@@ -7,6 +7,8 @@ spec:
     metadata:
       annotations:
         autoscaling.knative.dev/maxScale: '200'
+        run.googleapis.com/network-interfaces: '[{"network":"default","subnetwork":"default"}]'
+        run.googleapis.com/vpc-access-egress: private-ranges-only
     spec:
       containers:
       - image: osv-server
@@ -20,6 +22,23 @@ spec:
           value: osv-vulnerabilities
         - name: FAILED_TASKS_TOPIC
           value: failed-tasks
+        - name: POSTGRES_SHADOW_RATE
+          value: "0"
+        - name: POSTGRES_HOST
+          value: "10.25.0.3"
+        - name: POSTGRES_PORT
+          value: "6432"
+        - name: POSTGRES_USER
+          value: "osv-readonly"
+        - name: POSTGRES_DB
+          value: "osv"
+        - name: POSTGRES_SSLMODE
+          value: "require"
+        - name: POSTGRES_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              name: postgres-readonly-password
+              key: latest
         resources:
           limits:
             cpu: 2