k8s/iam: add cloudnativepg postgres and vault + authentik

- PostgreSQL 3-replica HA with pgvector
- Vault S3 storage backend (MinIO)
- Authentik federated OIDC provider
- Vault auto-unseal via postStart hook

k8s/ddb/cnpg-values.yaml

@@ -0,0 +1,51 @@
+# CloudNativePG Operator Configuration
+# Handles PostgreSQL cluster management with HA replication
+#
+# Timeout settings tuned for clusters with 5+ second network latency spikes
+
+# Operator deployment
+replicaCount: 1
+
+# Operator Pod configuration
+podAnnotations:
+  prometheus.io/scrape: "true"
+  prometheus.io/port: "8080"
+
+# Resource limits
+resources:
+  limits:
+    memory: 512Mi
+  requests:
+    memory: 256Mi
+
+# Monitoring
+monitoring:
+  enabled: true
+  serviceMonitor:
+    enabled: false  # disable until we have prometheus-operator CRDs
+
+# ── Configuration for operator behavior ────────────────────────────────────────
+# Applied to the cnpg-controller-manager-config ConfigMap
+config:
+  # HTTP client timeout for communicating with Postgres instances
+  # Default: 30s. Increased to 120s to tolerate 5+ second network latency spikes
+  instanceManagerHTTPClientTimeout: 120s
+
+  # TLS verification for instance manager
+  instanceManagerTLSInsecureSkipVerify: false
+
+  # Allow debug logging to diagnose HTTP communication issues
+  enableDebugLogging: true
+
+  # Pod debugging (disabled; security risk in production)
+  enablePodDebugging: false
+
+  # In-place updates for instance manager (disabled; safer for HA)
+  enableInstanceManagerInplaceUpdates: false
+
+  # Azure PVC updates (not applicable for Longhorn)
+  enableAzurePVCUpdates: false
+
+  # Certificate lifetime (90 days) and renewal threshold (7 days before expiry)
+  certificateDuration: 90
+  expiringCheckThreshold: 7