43 lines
1.3 KiB
YAML
43 lines
1.3 KiB
YAML
|
# Dedicated CNPG Postgres for ZITADEL (GitOps, wave 2 — before the zitadel
|
||
|
|
# chart at wave 3). Same shape as authentik-db.yaml: CNPG generates the secret
|
||
|
|
# `zitadel-db-app` and the service `zitadel-db-rw` in ns iam, and
|
||
|
|
# k8s/infra/iam/zitadel-values.yaml reads the DSN from that secret locally (no
|
||
|
|
# cross-namespace secret copy).
|
||
|
|
#
|
||
|
|
# ZITADEL requires PostgreSQL 14+; the repo convention image is 16.2.
|
||
|
|
apiVersion: postgresql.cnpg.io/v1
|
||
|
|
kind: Cluster
|
||
|
|
metadata:
|
||
|
|
name: zitadel-db
|
||
|
|
namespace: iam
|
||
|
|
annotations:
|
||
|
|
argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
|
||
|
|
spec:
|
||
|
|
instances: 3
|
||
|
|
imageName: ghcr.io/cloudnative-pg/postgresql:16.2
|
||
|
|
bootstrap:
|
||
|
|
initdb:
|
||
|
|
database: zitadel
|
||
|
|
owner: app
|
||
|
|
encoding: UTF8
|
||
|
|
localeCollate: C
|
||
|
|
localeCType: C
|
||
|
|
enableSuperuserAccess: false
|
||
|
|
resources:
|
||
|
|
requests: { memory: "512Mi", cpu: "250m" }
|
||
|
|
limits: { memory: "2Gi", cpu: "1" }
|
||
|
|
storage:
|
||
|
|
size: 10Gi
|
||
|
|
storageClass: longhorn-cnpg
|
||
|
|
monitoring:
|
||
|
|
enablePodMonitor: true
|
||
|
|
affinity:
|
||
|
|
# preferred + tolerations: HA across nodes without deadlocking a partly-
|
||
|
|
# schedulable 3-CP (same as authentik-db and forgejo-db).
|
||
|
|
podAntiAffinityType: preferred
|
||
|
|
topologyKey: kubernetes.io/hostname
|
||
|
|
tolerations:
|
||
|
|
- key: node-role.kubernetes.io/control-plane
|
||
|
|
operator: Exists
|
||
|
|
effect: NoSchedule
|