feat(perf): compare frozen queries with Athena

.github/workflows/scenario-dev.yml

@@ -119,6 +119,10 @@ jobs:
       - name: Update kubeconfig
         run: aws eks update-kubeconfig --name "$CLUSTER_NAME" --region "$AWS_REGION" --alias "$KUBE_CONTEXT"
 
+      - name: Load Athena perf configuration
+        if: env.SCENARIO_NAME == 'posthog_frozen_perf'
+        run: bash scripts/scenario_athena_config.sh >> "$GITHUB_ENV"
+
       - name: Deploy isolated Duckgres stack
         run: tests/mw-dev/run.sh deploy
 

docs/runbooks/scenario-dev.md

@@ -8,17 +8,18 @@ identity, diagnostics, and teardown.
 ## Scheduled Runs
 
 The daily scheduled trigger runs `posthog_frozen_perf`, which creates
-production-shaped DuckLake tables from the frozen dataset, executes paired
-raw-view and DuckLake-table queries, and publishes the comparison history.
+production-shaped DuckLake tables from the frozen dataset, executes equivalent
+PGWire, Trino, and on-demand Athena queries, and publishes the comparison history.
 Scheduled runs no longer execute `full-suite`.
 
 Manual runs remain selectable and default to `full-suite`, which covers the
 frozen dataset metadata, legacy perf, and dbt workloads with one shared
 warehouse lifecycle.
 
-Scenario jobs override the shared harness's default worker request to 2 CPU and
-8Gi memory for the frozen pgwire perf workload. This adds process headroom for
-repeated full-dataset aggregates without increasing DuckDB's thread count. The
+Scenario jobs override the shared harness's default worker request to 3 CPU and
+12Gi memory for the frozen PGWire perf workload. The isolated Trino workers
+use the same aggregate execution resources. This adds process headroom for
+repeated full-dataset aggregates without changing DuckDB's thread count. The
 shared e2e workflow keeps the harness defaults documented in
 `tests/mw-dev/README.md`.
 
@@ -40,13 +41,31 @@ Configure these repository secrets:
 
 - `AWS_ECR_PUBLISH_IAM_ROLE`
 - `MW_DEV_ACCOUNT_ID`
+- `MW_DEV_TRINO_POD_IDENTITY_ROLE`
 
 Configure these repository variables:
 
 - `TS_WIF_CLIENT_ID_MW_DEV`
 - `TS_WIF_AUDIENCE_MW_DEV`
 - `MW_DEV_SCENARIO_PERF_SECRET_ID`
 
+Athena requires no additional GitHub settings. Terraform publishes its
+configuration to the SSM String parameter `/duckgres/perf/athena` in the dev
+account and grants the workflow's existing OIDC role `ssm:GetParameter` on
+that parameter only. Apply this infrastructure before enabling Athena runs.
+For frozen perf, `scripts/scenario_athena_config.sh` loads and validates the
+JSON after AWS authentication and before deploying the isolated stack. Other
+scenarios do not load it. The parameter contains `pod_identity_role_arn`,
+`workgroup_name`, `glue_database_name`, and `results_s3_uri`, derived from
+Terraform resources; they are configuration identifiers, not credentials.
+
+The Athena values must identify an engine-v3 on-demand workgroup, a Glue
+database with explicit `events` and `persons` external tables over the frozen
+Parquet prefixes, and an encrypted S3 result root ending in `/`. Disable
+workgroup result reuse and configure lifecycle expiry on the result root. The
+scenario still disables result reuse on every query and validates that the
+effective result location remains under the configured root.
+
 `MW_DEV_SCENARIO_PERF_SECRET_ID` names the AWS Secrets Manager JSON secret used
 only by historical perf publishing. The secret must contain `host`, `port`,
 `database`, `username`, and `password`. The workflow pipes it directly from
@@ -61,6 +80,14 @@ The harness also injects `DUCKGRES_SCENARIO_ORG_ID=ci-pr-<workflow-run-id>-cnpg`
 for successful CNPG scenarios. That name matches the Crossplane composition's
 exact CI credential ownership boundary and the harness's cleanup convention.
 
+The scenario Job uses the dedicated `duckgres-scenario` ServiceAccount. Its
+Pod Identity role needs only Athena query APIs for the configured workgroup,
+read-only Glue metadata access to the benchmark database, read/list access to
+the frozen dataset, and result-prefix access (plus the configured KMS key when
+SSE-KMS is used). The workflow deployer needs `iam:PassRole`/`iam:GetRole` for
+that role. Teardown and the stale-run sweep already delete every Pod Identity
+association in the disposable namespace.
+
 For a direct local run with `just scenario`, set
 `DUCKGRES_SCENARIO_ORG_ID` explicitly to an authorized, disposable org id.
 The local runner has no default because reusing a fixed warehouse identity can
@@ -69,6 +96,13 @@ required as reported by `scripts/scenario_run.sh --check-env`.
 
 ## Failure Recovery
 
+If loading `/duckgres/perf/athena` fails, confirm the Athena Terraform apply
+completed, the workflow is using the expected AWS account/region, and its
+OIDC role has the exact-parameter read grant. Invalid or incomplete JSON fails
+before deployment and exports no partial settings. Fix the Terraform source
+and apply it again rather than editing the parameter manually. Rerun the
+workflow after the parameter and permission are available.
+
 Every scenario sub-run provisions its own org or warehouse name and includes
 cleanup steps. The isolated stack also tears down the temporary namespace after
 the payload finishes. The harness keeps the artifact volume attached to a
@@ -83,6 +117,8 @@ uploadable in a visible `*.partial/` directory with an
   published in the GitHub Actions job summary.
 - `step_results.csv` contains per-step duration, status, and error class.
 - `events.jsonl` contains the execution timeline.
+- `perf/query_service_metrics.csv` separates Athena queue/planning/engine time
+  and records bytes scanned for cost analysis.
 
 Perf query errors mark the `perf_queries` DAG step failed. They do not stop
 independent sibling branches: for example, `dbt_models` still runs because it
@@ -104,3 +140,9 @@ If cleanup did not complete, the scenario-created org is
 control plane. Also inspect the workflow diagnostics from
 `tests/mw-dev/run.sh diagnostics`; the namespace is
 `duckgres-ci-pr-<workflow-run-id>`.
+
+If an Athena query times out, the driver calls `StopQueryExecution`. A hard pod
+termination can still leave result objects, so S3 lifecycle expiry is the
+reliable cleanup backstop. Check the Athena query history for scan-limit or
+catalog errors, confirm the workgroup did not override results outside the
+configured root, and rerun after fixing the private Glue/IAM configuration.

docs/runbooks/scenario-runner.md

@@ -54,11 +54,16 @@ shape deployed with the scenario stack:
 ```bash
 export DUCKGRES_K8S_WORKER_CPU_REQUEST="3"
 export DUCKGRES_K8S_WORKER_MEMORY_REQUEST="12Gi"
+export DUCKGRES_SCENARIO_ATHENA_REGION="<aws-region>"
+export DUCKGRES_SCENARIO_ATHENA_WORKGROUP="<on-demand-workgroup>"
+export DUCKGRES_SCENARIO_ATHENA_DATABASE="<glue-database>"
+export DUCKGRES_SCENARIO_ATHENA_RESULTS_S3_URI="s3://<results-bucket>/<prefix>/"
 ```
 
 The full and fast suites exercise PGWire only. The targeted frozen perf
-scenario compares PGWire and Trino. It records per-query success and failure
-rows in `query_results.csv`.
+scenario compares PGWire, Trino, and on-demand Athena. It records per-query
+success and failure rows in `query_results.csv` and Athena service details in
+`query_service_metrics.csv`.
 Measured query errors fail the perf DAG step after its artifacts are written;
 independent sibling steps continue to run.
 
@@ -150,7 +155,7 @@ The frozen perf scenario uses:
 - `tests/mw-dev/scenario/scenarios/posthog_frozen_perf.yaml`
 - `tests/perf/queries/ducklake_frozen.yaml`
 
-Perf artifacts are written under `artifacts/scenario/<run_id>/perf/` using the existing `tests/perf/core` artifact schema, including `query_results.csv`, `summary.json`, and `server_metrics.prom`.
+Perf artifacts are written under `artifacts/scenario/<run_id>/perf/` using the existing `tests/perf/core` artifact schema, including `query_results.csv`, `query_service_metrics.csv`, `summary.json`, and `server_metrics.prom`.
 
 The frozen dbt scenario uses:
 

go.mod

@@ -4,10 +4,11 @@ go 1.25.4
 
 require (
 	github.com/apache/arrow-go/v18 v18.5.1
-	github.com/aws/aws-sdk-go-v2 v1.42.1
+	github.com/aws/aws-sdk-go-v2 v1.45.1
 	github.com/aws/aws-sdk-go-v2/config v1.32.29
 	github.com/aws/aws-sdk-go-v2/credentials v1.19.28
 	github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.22.32
+	github.com/aws/aws-sdk-go-v2/service/athena v1.64.0
 	github.com/aws/aws-sdk-go-v2/service/route53 v1.62.3
 	github.com/aws/aws-sdk-go-v2/service/s3 v1.105.0
 	github.com/aws/aws-sdk-go-v2/service/sts v1.44.0
@@ -52,8 +53,8 @@ require (
 	github.com/agnivade/levenshtein v1.2.1 // indirect
 	github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.14 // indirect
 	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.30 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.30 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.30 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/configsources v1.5.1 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.8.1 // indirect
 	github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.31 // indirect
 	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.13 // indirect
 	github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.23 // indirect
@@ -62,7 +63,7 @@ require (
 	github.com/aws/aws-sdk-go-v2/service/signin v1.4.0 // indirect
 	github.com/aws/aws-sdk-go-v2/service/sso v1.32.0 // indirect
 	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.37.0 // indirect
-	github.com/aws/smithy-go v1.27.3 // indirect
+	github.com/aws/smithy-go v1.28.1 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/bytedance/gopkg v0.1.3 // indirect
 	github.com/bytedance/sonic v1.15.0 // indirect

go.sum

@@ -28,8 +28,8 @@ github.com/arbovm/levenshtein v0.0.0-20160628152529-48b4e1c0c4d0 h1:jfIu9sQUG6Ig
 github.com/arbovm/levenshtein v0.0.0-20160628152529-48b4e1c0c4d0/go.mod h1:t2tdKJDJF9BV14lnkjHmOQgcvEKgtqs5a1N3LNdJhGE=
 github.com/aws/aws-sdk-go v1.55.8 h1:JRmEUbU52aJQZ2AjX4q4Wu7t4uZjOu71uyNmaWlUkJQ=
 github.com/aws/aws-sdk-go v1.55.8/go.mod h1:ZkViS9AqA6otK+JBBNH2++sx1sgxrPKcSzPPvQkUtXk=
-github.com/aws/aws-sdk-go-v2 v1.42.1 h1:9eOTgu1z/dVtYpNZ3/8/XbbaX0x/BqE3HUzAzs6K0ek=
-github.com/aws/aws-sdk-go-v2 v1.42.1/go.mod h1:5pKeft2eJj+gElQ38Jqg4ibCqh+/AK33/0X3hip7IjM=
+github.com/aws/aws-sdk-go-v2 v1.45.1 h1:iIoG3NaLhV6UZpPXyPXlDj2I9oS8tV/nMcMnITCC6Ks=
+github.com/aws/aws-sdk-go-v2 v1.45.1/go.mod h1:bttEH6JqnUL8LepvDVfdrds/fZ5bCIxzpe3abyUrhDU=
 github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.14 h1:3IZY0XAJquT3aHzbkHfPzy4ACPcEjVG0x87KOwtpqGY=
 github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.14/go.mod h1:zwM6veDkhGgQFqkBy+uT28AAYpLu+uFMlPl+rCg/73E=
 github.com/aws/aws-sdk-go-v2/config v1.32.29 h1:BcMHHnpiWKogf+gGfpj3K1w+Sktz29XDo/cPSAPO3FU=
@@ -40,12 +40,14 @@ github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.30 h1:/hi1JADLEW9YYryEz1w4GQ
 github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.30/go.mod h1:/3AOgy4K17Dm4ucMZVC/MJkzy5kmfKUcINRHZyo0koQ=
 github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.22.32 h1:kUb0wd0/NfYv2RDoDfogxBy/Hevby5yLIL12iCcs0hY=
 github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.22.32/go.mod h1:+rUx79uJZfEavbKROY+U1ez7bUMie7oOAdrjgL0C1FQ=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.30 h1:xM/Is9cKMHa8Jj8zkvWhvrFkZsXJV9E+BB4g0HW0duQ=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.30/go.mod h1:WueJeNDZvK1fMYEWJIkcivBfEzUkTpBhzlrUKKY8EuA=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.30 h1:jn46zC9LdsVR/ZpMIJqMqb8hHv31BlLx3ulVqNspUOk=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.30/go.mod h1:1hTMsAgbdS/AtUi4bw8+gUuh1pceo+eXRLfpSuSQj3M=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.5.1 h1:pc138gM1CW+XPc60rEwUlwwuwWFQK16CI1T7v1F9Oec=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.5.1/go.mod h1:1+koxpPIbfBdfzP6vojm5/zTpTQ/micYwlxIiNB3TxI=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.8.1 h1:K0JsbZQj+1h208Ro1zHeA4l7bMp0NvRffHQ91q8Ol1s=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.8.1/go.mod h1:W3/vL6EtCIatICGy9ab29QhMuae+cOKPWcMxv02CO+Q=
 github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.31 h1:3GUprIsfmGcC5SACIyB0e7E0BM1O1b3Erl5CePYIAeQ=
 github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.31/go.mod h1:7PuV1yl5e2xnUbm+RqvVg5i2iBM8EyijZNoI9wsOoOc=
+github.com/aws/aws-sdk-go-v2/service/athena v1.64.0 h1:HnHMA98zWRuaRdIYa/fvPCHeEQbJykVsXfiK74x6v2o=
+github.com/aws/aws-sdk-go-v2/service/athena v1.64.0/go.mod h1:PvOgT+mAEoXeoG7Nun4D1h8jiJ21dH3ms80DZFrw+hU=
 github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.13 h1:mbRIur/BiHK6SKPjoBIXSE/hJ6g6JGRLuxQy1jGjlN4=
 github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.13/go.mod h1:ITg9em2KbJx1s0y4aqRX5OYWG6HBZ5TVR//OdpEZ2CQ=
 github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.23 h1:9Fjh6fi/U5JEStVZijmaMpUwE/gvBJj7x2B/PjbO9To=
@@ -66,8 +68,8 @@ github.com/aws/aws-sdk-go-v2/service/ssooidc v1.37.0 h1:fpOlDPI55HdszaxapEGk6HsG
 github.com/aws/aws-sdk-go-v2/service/ssooidc v1.37.0/go.mod h1:DMPWJBjYs6+3+f/qhBFEFPPlQ6NlhWjai3dJNvipJ84=
 github.com/aws/aws-sdk-go-v2/service/sts v1.44.0 h1:bLZ0PolJ8J+HkJHztcXORUpHXBye2U8298lCEMi6ZCU=
 github.com/aws/aws-sdk-go-v2/service/sts v1.44.0/go.mod h1:9gdl4RrflIdpDb2TlXshWgR1F9TeCkvqDx77Vpr4Z/Q=
-github.com/aws/smithy-go v1.27.3 h1:F3Zb497UhhskkfpJmfkXswyo+t0sh9OTBnIHjogWbVY=
-github.com/aws/smithy-go v1.27.3/go.mod h1:YE2RhdIuDbA5E5bTdciG9KrW3+TiEONeUWCqxX9i1Fc=
+github.com/aws/smithy-go v1.28.1 h1:R/nXH00c8qcfCzQVELtRw+eLQWtzv+VAIEFJ1/xxXlQ=
+github.com/aws/smithy-go v1.28.1/go.mod h1:YE2RhdIuDbA5E5bTdciG9KrW3+TiEONeUWCqxX9i1Fc=
 github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
 github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
 github.com/bytecodealliance/wasmtime-go/v43 v43.0.2 h1:EZJlEpDanv6j/Y5Mcl2ndMjgK5Tw2QVDTJCzmLWNozg=

scripts/scenario_athena_config.sh

@@ -0,0 +1,34 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Emit validated GitHub environment-file assignments, never shell code to eval.
+# Terraform owns this parameter and its exact-resource read permission.
+parameter_name="/duckgres/perf/athena"
+: "${AWS_REGION:?AWS_REGION is required to load Athena perf configuration}"
+
+if ! config=$(aws ssm get-parameter --name "$parameter_name" --region "$AWS_REGION" \
+  --query Parameter.Value --output text); then
+  echo "Could not load Athena perf configuration from $parameter_name. Apply the Athena infrastructure and its CI read permission first." >&2
+  exit 1
+fi
+
+# Validate the complete document before emitting anything: a bad value must not
+# append a partial configuration or inject another entry into GITHUB_ENV.
+if ! assignments=$(jq -ers '
+  if length != 1 then error("expected one configuration object") else .[0] end
+  | {
+      SCENARIO_POD_IDENTITY_ROLE: .pod_identity_role_arn,
+      DUCKGRES_SCENARIO_ATHENA_WORKGROUP: .workgroup_name,
+      DUCKGRES_SCENARIO_ATHENA_DATABASE: .glue_database_name,
+      DUCKGRES_SCENARIO_ATHENA_RESULTS_S3_URI: .results_s3_uri
+    }
+  | if all(.[]; type == "string" and test("\\S") and (test("[[:cntrl:]]") | not))
+    then to_entries[] | "\(.key)=\(.value)"
+    else error("expected nonempty single-line strings for all four Athena settings")
+    end
+' <<< "$config"); then
+  echo "Invalid Athena perf configuration in $parameter_name. Check the Terraform-managed parameter; no settings were exported." >&2
+  exit 1
+fi
+
+printf '%s\n' "$assignments"

tests/mw-dev/README.md

@@ -103,21 +103,33 @@ Optional perf-step settings are:
 - `trino_ca_cert_file` (default empty, using system roots)
 - `trino_startup_timeout` (default `2m`)
 - `trino_startup_poll_interval` (default `2s`)
+- `athena_catalog` (default `AwsDataCatalog`)
+- `athena_poll_interval` (default `500ms`)
+- `athena_query_timeout` (default `30m`)
+
+An Athena target additionally requires explicit `athena_region`,
+`athena_workgroup`, `athena_database`, and `athena_output_location` settings.
+The output location must be the same `s3://` prefix enforced by the workgroup.
+Athena uses unique query execution IDs for result object names.
 
 The startup window contains an authenticated `SELECT 1` retry and completes
 before warmup or measured statements run. For the isolated mw-dev cell, use
 `trino_ca_cert_file: /trino-ca/ca.crt`.
 
-`posthog_frozen_perf` enables Trino and selects the isolated Trino suite. Its
+`posthog_frozen_perf` enables Trino and Athena and selects the isolated Trino suite. Its
 scenario Job mounts the per-run CA from `duckgres-trino-tls` and passes that
 path through `DUCKGRES_SCENARIO_TRINO_CA_CERT`; the perf adapter verifies the
 coordinator certificate and retries its first authenticated query for the
 bounded Secret-projection window. It also passes the deployed
 `DUCKGRES_K8S_WORKER_CPU_REQUEST` and `DUCKGRES_K8S_WORKER_MEMORY_REQUEST` into
 the perf step, which requests that exact shape through PGWire startup options
 and therefore bypasses the exploratory worker tier. The paired catalog remains the single SQL
-source: direct-Parquet `raw_view` members run only through PGWire, while each
-production-shaped `ducklake_table` member runs through both PGWire and Trino.
+source: direct-Parquet `raw_view` members run only through PGWire,
+production-shaped `ducklake_table` members run through PGWire and Trino, and
+`athena_external` members run through Athena against Glue tables over the same
+immutable Parquet objects. Athena is on-demand, result reuse is disabled, and
+the harness records service-side timing and scanned bytes in
+`query_service_metrics.csv`.
 To reproduce the scheduled run, deploy and test with `E2E_SUITE=trino` and the
 same `TRINO_POD_IDENTITY_ROLE` required by the isolated Trino lane. Teardown and
 the scheduled cleanup sweep remove both namespace-local workloads and their
@@ -508,6 +520,19 @@ finalizers are still running.
 | (role) | `github-duckgres-e2e` | dedicated stripped role in the mw-dev account (posthog-cloud-infra) — `eks:DescribeCluster` + Pod Identity association calls + `iam:PassRole`/`iam:GetRole` on the CP and dedicated Trino roles + an EKS access entry for kubectl. The workflow assumes `arn:aws:iam::<MW_DEV_ACCOUNT_ID>:role/github-duckgres-e2e`. |
 | repo setting | "Require approval for all outside collaborators" | the access gate (see below) |
 
+Athena adds no one-time GitHub configuration. Its Terraform unit publishes the
+SSM String parameter `/duckgres/perf/athena` and grants the existing workflow
+OIDC role `ssm:GetParameter` on that exact parameter. The JSON keys are
+`pod_identity_role_arn`, `workgroup_name`, `glue_database_name`, and
+`results_s3_uri`, all derived from the deployed resources. The frozen-perf
+workflow loads them with `bash scripts/scenario_athena_config.sh` and exports
+the existing scenario environment variables before deployment. The loader
+requires AWS CLI, jq, and an explicit `AWS_REGION`; it fails without exporting
+partial settings if fetching or validation fails. Apply the infrastructure
+first, and fix configuration in Terraform rather than editing SSM manually.
+Direct local scenario invocations still accept the documented explicit Athena
+environment variables.
+
 The `scenario-dev` workflow requests a 16,200-second session from
 `github-duckgres-e2e`, matching its 270-minute job timeout. The role's
 `max_session_duration` in posthog-cloud-infra must be at least 16,200 seconds

tests/mw-dev/manifests.tmpl.yaml

@@ -128,6 +128,12 @@ metadata:
   namespace: ${NAMESPACE}
 automountServiceAccountToken: false
 ---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: duckgres-scenario
+  namespace: ${NAMESPACE}
+---
 # In-namespace CP permissions: spawn/patch worker pods, manage per-worker
 # secrets, read the worker configmap, hold the janitor lease. Mirrors the
 # chart's duckgres-control-plane Role.