Thanks for the details — this looks like a chart config mismatch plus a secret naming/key issue. What’s happening - The Prefect Helm chart (Prefect 3.x) always wires

PREFECT_API_DATABASE_CONNECTION_URL

from a Kubernetes Secret, not from

extraEnvVars

. - When you set

secret.create: false

and do not set

secret.name

, the chart defaults to looking for a Secret named

{release-name}-postgresql-connection

. In your case that’s

prefect-server-postgresql-connection

, which doesn’t exist — hence the error. - The chart expects the secret to contain a key named

connection-string

(not

url

). How to fix it Pick one of these options: Option A — Use your existing secret (pre-created) 1) Create a secret with the correct key:

kubectl create secret generic prefect-db-secret \
  --namespace <your-namespace> \
  --from-literal=connection-string='<postgresql+asyncpg://USER:PASSWORD@HOST:5432/DBNAME>'

2) Update your values to point the chart at that secret and disable the bundled Postgres:

postgresql:
  enabled: false

secret:
  create: false
  name: prefect-db-secret

# (Do not try to set PREFECT_API_DATABASE_CONNECTION_URL via extraEnvVars;
# the chart injects it from the secret above.)

Option B — Let the chart create the secret for you If you’re okay putting the DB bits into values so the chart can assemble the URL:

postgresql:
  enabled: false

secret:
  create: true
  name: prefect-db-secret
  username: prefect
  password: your-secure-password
  host: <http://postgres.example.com|postgres.example.com>
  port: "5432"
  database: prefect_server

The chart will create a Secret named

prefect-db-secret

with key

connection-string

and wire it automatically. Notes and gotchas - The secret must be in the same namespace as your Helm release. - The connection URL should use the async driver in Prefect 3.x, e.g.

postgresql+asyncpg://...

- Do not rely on

extraEnvVars

for the database URL — the chart overrides it with the secret-based value. - If you really only want the DB password in a Secret and compose the URL from other Helm values: the current chart does not support compositing from multiple secrets/values. Use Option A (entire URL in a secret) to keep credentials out of values files. Quick verification - Check the secret exists and has the correct key:

kubectl get secret prefect-db-secret -n <ns> -o yaml
# Ensure data.connection-string is present (base64-encoded)

- Confirm the pod env source:

kubectl get deploy <your-prefect-server-deploy> -n <ns> -o yaml | grep -A5 PREFECT_API_DATABASE_CONNECTION_URL

I also notice your shown values use a

prefect.api.database.*

section and

extraEnvVars

to try to set the URL. That structure does not match the official Prefect Helm chart’s values. To avoid more surprises, can you confirm: - Which chart repository are you installing from? - Which chart name and version? (e.g., prefecthq/prefect-helm, chart: prefect-server, version X.Y.Z) Official docs and references - Prefect Helm charts repo: prefect-helm - Prefect Server chart README/values: prefect-server chart - Self-hosting Prefect 3.x: Self-host docs

You’re hitting the right spot: the Prefect Helm chart does not support a configurable key name for the DB URL. It always looks for a key named

connection-string

. The

secret.key: url

value you added isn’t a recognized chart value, so it’s ignored. What to do - Keep using your existing secret name; you do not need a separate secret. - Add a key named

connection-string

to that secret (the value should be your full async Postgres URL). Quick fixes 1) Replace/patch the secret with the correct key:

# Option A: recreate
kubectl delete secret prefect-db-secret -n <namespace>
kubectl create secret generic prefect-db-secret \
  -n <namespace> \
  --from-literal=connection-string='<postgresql+asyncpg://USER:PASSWORD@HOST:5432/DBNAME>'

# Option B: patch in place
kubectl patch secret prefect-db-secret -n <namespace> \
  -p '{"stringData":{"connection-string":"<postgresql+asyncpg://USER:PASSWORD@HOST:5432/DBNAME>"}}'

2) Ensure your values point to that secret:

postgresql:
  enabled: false

secret:
  create: false
  name: prefect-db-secret

3) Make sure the secret is in the same namespace as the Helm release. Your error shows `default/prefect-db-secret`; if your release is in another namespace, either move the secret or deploy the release to

default

. Verify

kubectl get secret prefect-db-secret -n <namespace> -o yaml
# Confirm data.connection-string (base64) or stringData.connection-string is present

kubectl get deploy -n <namespace> <prefect-server-deploy-name> -o yaml | grep -A5 PREFECT_API_DATABASE_CONNECTION_URL

If pods already failed, restart them after fixing the secret:

kubectl rollout restart deploy/<prefect-server-deploy-name> -n <namespace>

References - Prefect Helm chart (expects key

connection-string

): prefect-server chart - Self-hosting Prefect 3.x: Self-host docs If you paste the YAML for your current

prefect-db-secret

(redacting creds), I can confirm the exact tweak needed.