Sealos Database

Identity and Discovery

• Owner: sealos-database (/sealos-database and database create, connect, backup, logs, or access requests).
• Class: cloud-local-mutation through sealos-cli, with an optional redacted handoff to deployment.
• Canaries: DB-REUSE-ENV, DB-CONFIRM-PUBLIC, and DB-REDACT-CONNECT.

Scope and Boundaries

Accept a project path and database intent. Analyze first, list existing databases, create or reuse the selected type, and wire only the existing application env key. Preserve prior env values and local Compose rollback; private access is the default. Database deletion, public access, backup deletion, restore collisions, and disabling active access remain gated operations.

Risk and Confirmation

Never print passwords, full connection strings, kubeconfig, auth files, or copied env values. Ask before public access or destructive operations and state the private alternative. Parse JSON CLI output and keep the selected workspace, namespace, database, and env mutation scoped to the request.

Lifecycle Workflow

For each request, resolve the project, analyze its database need, confirm CLI/auth/region/workspace, list before create/reuse, fetch connection details, wire the existing env key, and verify connectivity or migrations. Emit request-scoped success, stopped, or error; the existing analyzer-first workflow remains the domain extension below. Workspace ambiguity, an unavailable credential response, or a tracked env target stops the request before mutation.