Story Crater Bot
5ce0b92186
authentik/temporal DB users+databases were never provisioned (old helmfile hook gone; db-init-job only made schemas in shared app DB). Adds managed.roles (authentik/temporal login roles, passwords from basic-auth secrets) + Database CRs (dedicated DBs owned by each role). Role secrets applied out-of-band (SOPS), not in kustomize resources so data-schemas app doesn't choke on ciphertext.
82 lines
2.2 KiB
YAML
82 lines
2.2 KiB
YAML
apiVersion: postgresql.cnpg.io/v1
|
|
kind: Cluster
|
|
metadata:
|
|
name: ddb-cluster
|
|
namespace: ddb
|
|
labels:
|
|
app: postgresql
|
|
layer: data
|
|
spec:
|
|
# Single instance — cp-1 is the only schedulable node in the 3-CP topology
|
|
# (.163/.166 are dedicated control planes with no workload scheduling/storage).
|
|
# Postgres standby HA is traded away; control-plane/etcd HA is unaffected.
|
|
instances: 1
|
|
|
|
# PostgreSQL 16.2
|
|
imageName: ghcr.io/cloudnative-pg/postgresql:16.2
|
|
|
|
# Bootstrap: create app database + extensions
|
|
bootstrap:
|
|
initdb:
|
|
database: app
|
|
owner: app
|
|
encoding: UTF8
|
|
localeCollate: C
|
|
localeCType: C
|
|
postInitApplicationSQL:
|
|
- CREATE EXTENSION IF NOT EXISTS vector;
|
|
- CREATE EXTENSION IF NOT EXISTS pgcrypto;
|
|
- CREATE EXTENSION IF NOT EXISTS pg_trgm;
|
|
|
|
# Per-app login roles, passwords sourced from secrets (CNPG reconciles the
|
|
# role password to match the secret). Their databases are separate Database
|
|
# CRs (see authentik-database.yaml / temporal-database.yaml) owned by these
|
|
# roles. Replaces the old helmfile post-sync user-creation hook.
|
|
managed:
|
|
roles:
|
|
- name: authentik
|
|
ensure: present
|
|
login: true
|
|
passwordSecret:
|
|
name: authentik-db-role
|
|
- name: temporal
|
|
ensure: present
|
|
login: true
|
|
passwordSecret:
|
|
name: temporal-db-role
|
|
|
|
# Disable superuser (security)
|
|
enableSuperuserAccess: false
|
|
|
|
# PostgreSQL configuration
|
|
postgresql:
|
|
parameters:
|
|
shared_buffers: "256MB"
|
|
max_parallel_workers: "4"
|
|
max_parallel_workers_per_gather: "4"
|
|
# WAL archiving for backups
|
|
archive_mode: "on"
|
|
archive_timeout: "5min"
|
|
log_destination: "csvlog"
|
|
log_directory: "/controller/log"
|
|
log_filename: "postgres"
|
|
log_rotation_age: "0"
|
|
dynamic_shared_memory_type: "posix"
|
|
|
|
# Storage on Longhorn
|
|
storage:
|
|
size: 10Gi
|
|
storageClass: longhorn
|
|
|
|
# Monitoring
|
|
monitoring:
|
|
enablePodMonitor: false
|
|
disableDefaultQueries: false
|
|
customQueriesConfigMap:
|
|
- name: cnpg-default-monitoring
|
|
key: queries
|
|
|
|
# Pod anti-affinity for spreading replicas
|
|
affinity:
|
|
podAntiAffinityType: preferred
|