feat(workbench): add Audit Database support

api/core/v1beta1/site_types.go

@@ -632,6 +632,10 @@ type InternalWorkbenchExperimentalFeatures struct {
 	// ForceAdminUiEnabled forces the configuration manager UI to be enabled even when Workbench has it disabled
 	// by default when running on Kubernetes
 	ForceAdminUiEnabled bool `json:"forceAdminUiEnabled,omitempty"`
+
+	// AuditDatabaseEnabled provisions Workbench's Audit Database: a second Postgres database,
+	// distinct from the internal database, that stores historical session and usage data.
+	AuditDatabaseEnabled bool `json:"auditDatabaseEnabled,omitempty"`
 }
 
 type InternalChronicleSpec struct {

api/core/v1beta1/workbench_config.go

@@ -30,6 +30,7 @@ type WorkbenchSecretConfig struct {
 
 type WorkbenchSecretIniConfig struct {
 	Database           *WorkbenchDatabaseConfig              `json:"database.conf,omitempty"`
+	AuditDatabase      *WorkbenchAuditDatabaseConfig         `json:"audit-database.conf,omitempty"`
 	OpenidClientSecret *WorkbenchOpenidClientSecret          `json:"openid-client-secret,omitempty"`
 	Databricks         map[string]*WorkbenchDatabricksConfig `json:"databricks.conf,omitempty"`
 }
@@ -909,6 +910,18 @@ type WorkbenchDatabaseConfig struct {
 	Password string                    `json:"password,omitempty"`
 }
 
+// WorkbenchAuditDatabaseConfig renders /etc/rstudio/audit-database.conf. Password is
+// populated directly here rather than via WORKBENCH_POSTGRES_PASSWORD, since that env
+// var is shared with database.conf and can't carry two different roles' passwords.
+type WorkbenchAuditDatabaseConfig struct {
+	Provider WorkbenchDatabaseProvider `json:"provider,omitempty"`
+	Database string                    `json:"database,omitempty"`
+	Port     string                    `json:"port,omitempty"`
+	Host     string                    `json:"host,omitempty"`
+	Username string                    `json:"username,omitempty"`
+	Password string                    `json:"password,omitempty"`
+}
+
 type WorkbenchVsCodeConfig struct {
 	Enabled                 int    `json:"enabled,omitempty"`
 	Exe                     string `json:"exe,omitempty"`

api/core/v1beta1/workbench_config_test.go

@@ -22,6 +22,14 @@ func TestWorkbenchSecretConfig_GenerateSecretData(t *testing.T) {
 				Host:     "myhost.com",
 				Username: "user",
 			},
+			AuditDatabase: &WorkbenchAuditDatabaseConfig{
+				Provider: WorkbenchDatabaseProviderPostgres,
+				Database: "chicken_audit",
+				Port:     "5432",
+				Host:     "myhost.com",
+				Username: "chicken_audit",
+				Password: "audit-secret",
+			},
 			OpenidClientSecret: &WorkbenchOpenidClientSecret{
 				ClientId: "your-client-id-test",
 			},
@@ -40,9 +48,15 @@ func TestWorkbenchSecretConfig_GenerateSecretData(t *testing.T) {
 	require.Contains(t, res["database.conf"], "port=5432")
 	require.Contains(t, res["database.conf"], "host=myhost.com")
 	require.Contains(t, res["database.conf"], "username=user")
+	require.Contains(t, res["audit-database.conf"], "provider=postgresql")
+	require.Contains(t, res["audit-database.conf"], "database=chicken_audit")
+	require.Contains(t, res["audit-database.conf"], "port=5432")
+	require.Contains(t, res["audit-database.conf"], "host=myhost.com")
+	require.Contains(t, res["audit-database.conf"], "username=chicken_audit")
+	require.Contains(t, res["audit-database.conf"], "password=audit-secret")
 	require.Contains(t, res["openid-client-secret"], "client-id=your-client-id-test")
 	require.Contains(t, res["databricks.conf"], "name=posit-test")
-	require.Len(t, res, 3)
+	require.Len(t, res, 4)
 }
 
 func TestWorkbenchConfig_GenerateConfigmap(t *testing.T) {

api/core/v1beta1/workbench_types.go

@@ -110,6 +110,11 @@ type WorkbenchSpec struct {
 	// MainDatabaseCredentialSecret configures the secret used for storing the main database credentials
 	MainDatabaseCredentialSecret SecretConfig `json:"mainDatabaseCredentialSecret,omitempty"`
 
+	// AuditDatabaseEnabled provisions a second Postgres database (distinct from the internal
+	// database) and role, then renders audit-database.conf pointing Workbench at it. Requires
+	// the Secret referenced by Secret.VaultName to already contain a "dev-audit-db-password" key.
+	AuditDatabaseEnabled bool `json:"auditDatabaseEnabled,omitempty"`
+
 	Replicas int `json:"replicas,omitempty"`
 
 	// DsnSecret is the name of the secret that contains the DSN to include with all Workbench sessions

config/crd/bases/core.posit.team_sites.yaml

@@ -1884,6 +1884,11 @@ spec:
                     description: ExperimentalFeatures allows enabling miscellaneous
                       experimental features for workbench
                     properties:
+                      auditDatabaseEnabled:
+                        description: |-
+                          AuditDatabaseEnabled provisions Workbench's Audit Database: a second Postgres database,
+                          distinct from the internal database, that stores historical session and usage data.
+                        type: boolean
                       chronicleSidecarProductApiKeyEnabled:
                         description: |-
                           ChronicleSidecarProductApiKeyEnabled assumes the api key for this product has been added to a secret and

config/crd/bases/core.posit.team_workbenches.yaml

@@ -106,6 +106,12 @@ spec:
                       type: string
                   type: object
                 type: array
+              auditDatabaseEnabled:
+                description: |-
+                  AuditDatabaseEnabled provisions a second Postgres database (distinct from the internal
+                  database) and role, then renders audit-database.conf pointing Workbench at it. Requires
+                  the Secret referenced by Secret.VaultName to already contain a "dev-audit-db-password" key.
+                type: boolean
               auth:
                 properties:
                   administratorRoleMapping:
@@ -975,6 +981,25 @@ spec:
                 properties:
                   workbench-secret-ini-config:
                     properties:
+                      audit-database.conf:
+                        description: |-
+                          WorkbenchAuditDatabaseConfig renders /etc/rstudio/audit-database.conf. Password is
+                          populated directly here rather than via WORKBENCH_POSTGRES_PASSWORD, since that env
+                          var is shared with database.conf and can't carry two different roles' passwords.
+                        properties:
+                          database:
+                            type: string
+                          host:
+                            type: string
+                          password:
+                            type: string
+                          port:
+                            type: string
+                          provider:
+                            type: string
+                          username:
+                            type: string
+                        type: object
                       database.conf:
                         properties:
                           database:

dist/chart/templates/crd/core.posit.team_sites.yaml

@@ -1905,6 +1905,11 @@ spec:
                     description: ExperimentalFeatures allows enabling miscellaneous
                       experimental features for workbench
                     properties:
+                      auditDatabaseEnabled:
+                        description: |-
+                          AuditDatabaseEnabled provisions Workbench's Audit Database: a second Postgres database,
+                          distinct from the internal database, that stores historical session and usage data.
+                        type: boolean
                       chronicleSidecarProductApiKeyEnabled:
                         description: |-
                           ChronicleSidecarProductApiKeyEnabled assumes the api key for this product has been added to a secret and