Story Crater Bot
c2bcda58d9
ARCHITECTURAL CHANGE: Align with CNPG design intent BEFORE (Complex, broken): - Per-app roles (authentik, temporal) with Database CR owner field - Database CR doesn't transfer ownership properly - Needed manual permission grants (PostSync Job) - Apps couldn't create tables without grants from 'app' role AFTER (Simple, works): - All apps use shared 'app' bootstrap user - Database CRs: owner: app (matches actual ownership) - No permission grants needed (owner has full rights) - Isolation via separate database names only CHANGES: - Database CRs: owner changed from app-specific to 'app' - ddb-cluster.yaml: removed managed.roles section - Deleted grant-schema-permissions PostSync Job - Follows Forgejo pattern (already working this way) MANUAL STEPS REQUIRED: 1. Update authentik-secrets: AUTHENTIK_POSTGRESQL__USER=app 2. Update temporal secrets: similar change 3. Recreate databases with app as owner 4. Restart applications Benefits: - Simpler architecture - No permission grant complexity - Aligns with CNPG single-cluster design - Matches working Forgejo implementation
69 lines
1.8 KiB
YAML
69 lines
1.8 KiB
YAML
apiVersion: postgresql.cnpg.io/v1
|
|
kind: Cluster
|
|
metadata:
|
|
name: ddb-cluster
|
|
namespace: ddb
|
|
labels:
|
|
app: postgresql
|
|
layer: data
|
|
spec:
|
|
# 3-replica cluster — distributed across control-plane nodes (cp-1, cp-2, cp-3)
|
|
# Provides HA for Forgejo and other stateful apps using shared DDB
|
|
instances: 3
|
|
|
|
# PostgreSQL 16.2
|
|
imageName: ghcr.io/cloudnative-pg/postgresql:16.2
|
|
|
|
# Bootstrap: create app database + extensions
|
|
bootstrap:
|
|
initdb:
|
|
database: app
|
|
owner: app
|
|
encoding: UTF8
|
|
localeCollate: C
|
|
localeCType: C
|
|
postInitApplicationSQL:
|
|
- CREATE EXTENSION IF NOT EXISTS vector;
|
|
- CREATE EXTENSION IF NOT EXISTS pgcrypto;
|
|
- CREATE EXTENSION IF NOT EXISTS pg_trgm;
|
|
|
|
# Simple ownership model: all apps use 'app' bootstrap user.
|
|
# Isolation via separate database names, not separate roles.
|
|
# Aligns with CNPG design (single cluster, multiple databases).
|
|
# managed.roles removed - no per-app roles needed.
|
|
|
|
# Disable superuser (security)
|
|
enableSuperuserAccess: false
|
|
|
|
# PostgreSQL configuration
|
|
postgresql:
|
|
parameters:
|
|
shared_buffers: "256MB"
|
|
max_parallel_workers: "4"
|
|
max_parallel_workers_per_gather: "4"
|
|
# WAL archiving for backups
|
|
archive_mode: "on"
|
|
archive_timeout: "5min"
|
|
log_destination: "csvlog"
|
|
log_directory: "/controller/log"
|
|
log_filename: "postgres"
|
|
log_rotation_age: "0"
|
|
dynamic_shared_memory_type: "posix"
|
|
|
|
# Storage on Longhorn
|
|
storage:
|
|
size: 10Gi
|
|
storageClass: longhorn
|
|
|
|
# Monitoring
|
|
monitoring:
|
|
enablePodMonitor: false
|
|
disableDefaultQueries: false
|
|
customQueriesConfigMap:
|
|
- name: cnpg-default-monitoring
|
|
key: queries
|
|
|
|
# Pod anti-affinity for spreading replicas
|
|
affinity:
|
|
podAntiAffinityType: preferred
|