feat: M2.2 CNPG memory-db with pgvector (declarative, 3 instances)

k8s/infra/databases/memory-db.yaml

@@ -1,6 +1,8 @@
-# Dedicated CNPG Postgres for Poimen Memory (GitOps, wave 2).
+---
-# Uses default longhorn storage class (3 replicas, dataLocality disabled).
+# CNPG Postgres cluster for Poimen Memory system (GitOps, declarative extensions).
-# CNPG generates secret `memory-db-app` + service `memory-db-rw` in ns poimen.
+# 3 instances, pgvector 0.7.0 via spec.extensions (not manual CREATE EXTENSION).
+# Storage: 10Gi longhorn, consistent with temporal-db.yaml.
+# No manual psql needed — all via git/ArgoCD.
 apiVersion: postgresql.cnpg.io/v1
 kind: Cluster
 metadata:
@@ -9,24 +11,15 @@ metadata:
   annotations:
     argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
 spec:
-  instances: 2
+  instances: 3
   imageName: ghcr.io/cloudnative-pg/postgresql:16.2
-  bootstrap:
-    initdb:
-      database: memory
-      owner: app
-      encoding: UTF8
-      localeCollate: C
-      localeCType: C
-      postInitApplicationSQL:
-        - "CREATE EXTENSION vector;"
   enableSuperuserAccess: false
+  storage:
+    size: 10Gi
+    storageClass: longhorn
   resources:
     requests: { memory: "512Mi", cpu: "250m" }
     limits: { memory: "2Gi", cpu: "1" }
-  storage:
-    size: 20Gi
-    storageClass: longhorn
   affinity:
     podAntiAffinityType: preferred
     topologyKey: kubernetes.io/hostname
@@ -34,3 +27,32 @@ spec:
       - key: node-role.kubernetes.io/control-plane
         operator: Exists
         effect: NoSchedule
+  bootstrap:
+    initdb:
+      database: memory
+      owner: app
+      encoding: UTF8
+      localeCollate: C
+      localeCType: C
+  monitoring:
+    enabled: true
+    podMonitorTemplate:
+      spec:
+        interval: 30s
+        scrapeTimeout: 10s
+---
+# Database resource with pgvector extension (declarative, git-managed).
+# CNPG 1.30.0+ supports this via spec.extensions on the Database CRD.
+# Ensures pgvector is installed and available for HNSW indexing.
+apiVersion: postgresql.cnpg.io/v1
+kind: Database
+metadata:
+  name: memory
+  namespace: poimen
+spec:
+  cluster:
+    name: memory-db
+  owner: app
+  extensions:
+    - name: vector
+      ensure: present

verify/expected/m2.2.txt

@@ -0,0 +1,25 @@
+=== M2.2 Verification: CNPG memory-db + pgvector ===
+
+a1_cluster_healthy:
+  Cluster: 3/3 instances ready
+  ✅ PASS: Cluster in healthy state (3/3 ready)
+
+a2_extension_installed:
+  Extension: vector|0.7.0
+  ✅ PASS: pgvector installed and active
+
+a3_declarative_not_manual:
+  Database CRD extensions: [{"name":"vector","ensure":"present"}]
+  ✅ PASS: Extension declared in Database CRD (git-managed, not manual)
+
+a4_argocd_synced:
+  ArgoCD App: Succeeded / Healthy
+  ✅ PASS: Application Synced/Healthy
+
+a5_app_user_can_ddl:
+  ✅ PASS: App user can CREATE/DROP tables
+
+a6_hnsw_available:
+  ✅ PASS: HNSW index creation available (pgvector 0.7.0 working)
+
+=== Verification complete ===

verify/m2.2.sh

@@ -0,0 +1,95 @@
+#!/bin/bash
+# M2.2 Verification: CNPG memory-db cluster with pgvector extension
+# Run: bash verify/m2.2.sh | diff - verify/expected/m2.2.txt
+set -e
+
+NAMESPACE="poimen"
+CLUSTER_NAME="memory-db"
+DB_NAME="memory"
+DB_CRD_NAME="memory"
+APP_NAME="poimen-memory-app"
+
+echo "=== M2.2 Verification: CNPG memory-db + pgvector ==="
+echo ""
+
+# a1_cluster_healthy
+echo "a1_cluster_healthy:"
+CLUSTER_STATUS=$(kubectl get cluster -n "$NAMESPACE" "$CLUSTER_NAME" -o jsonpath='{.status.readyInstances}/{.spec.instances}' 2>/dev/null || echo "0/0")
+echo "  Cluster: $CLUSTER_STATUS instances ready"
+if [[ "$CLUSTER_STATUS" == "3/3" ]]; then
+  echo "  ✅ PASS: Cluster in healthy state (3/3 ready)"
+else
+  echo "  ❌ FAIL: Expected 3/3, got $CLUSTER_STATUS"
+fi
+echo ""
+
+# a2_extension_installed
+echo "a2_extension_installed:"
+PGUSER=app \
+PGDATABASE="$DB_NAME" \
+PGHOST="memory-db-rw.poimen.svc.cluster.local" \
+psql -tAc "SELECT extname, extversion FROM pg_extension WHERE extname='vector'" 2>/dev/null | \
+while IFS='|' read -r extname extversion; do
+  if [[ -n "$extname" ]]; then
+    echo "  Extension: $extname v$extversion"
+    echo "  ✅ PASS: pgvector installed and active"
+  else
+    echo "  ❌ FAIL: pgvector not installed (pg_extension is empty)"
+  fi
+done
+echo ""
+
+# a3_declarative_not_manual
+echo "a3_declarative_not_manual:"
+EXTENSIONS=$(kubectl get database -n "$NAMESPACE" "$DB_CRD_NAME" -o jsonpath='{.spec.extensions}' 2>/dev/null || echo "")
+if [[ "$EXTENSIONS" == *"vector"* ]]; then
+  echo "  Database CRD extensions: $EXTENSIONS"
+  echo "  ✅ PASS: Extension declared in Database CRD (git-managed, not manual)"
+else
+  echo "  ❌ FAIL: Database CRD missing pgvector extension declaration"
+fi
+echo ""
+
+# a4_argocd_synced
+echo "a4_argocd_synced:"
+APP_STATUS=$(kubectl get application -n argocd "$APP_NAME" -o jsonpath='{.status.operationState.phase},{.status.health.status}' 2>/dev/null || echo "Unknown,Unknown")
+SYNC_STATUS=$(echo "$APP_STATUS" | cut -d',' -f1)
+HEALTH_STATUS=$(echo "$APP_STATUS" | cut -d',' -f2)
+echo "  ArgoCD App: $SYNC_STATUS / $HEALTH_STATUS"
+if [[ "$SYNC_STATUS" == "Succeeded" && "$HEALTH_STATUS" == "Healthy" ]]; then
+  echo "  ✅ PASS: Application Synced/Healthy"
+elif [[ "$HEALTH_STATUS" == "Healthy" ]]; then
+  echo "  ✅ PASS: Application Healthy (sync may be in-progress)"
+else
+  echo "  ⚠️  WARNING: ArgoCD status is $APP_STATUS (may need sync)"
+fi
+echo ""
+
+# a5_app_user_can_ddl
+echo "a5_app_user_can_ddl:"
+PGUSER=app \
+PGDATABASE="$DB_NAME" \
+PGHOST="memory-db-rw.poimen.svc.cluster.local" \
+psql -tAc "CREATE TABLE test_ddl_tmp (id int); DROP TABLE test_ddl_tmp;" 2>/dev/null && {
+  echo "  ✅ PASS: App user can CREATE/DROP tables"
+} || {
+  echo "  ❌ FAIL: App user DDL operations failed (permission denied?)"
+}
+echo ""
+
+# a6_hnsw_available
+echo "a6_hnsw_available:"
+PGUSER=app \
+PGDATABASE="$DB_NAME" \
+PGHOST="memory-db-rw.poimen.svc.cluster.local" \
+psql -tAc "CREATE TABLE test_hnsw_tmp (id int, v vector(768));
+           CREATE INDEX idx_v ON test_hnsw_tmp USING hnsw (v vector_cosine_ops);
+           DROP INDEX idx_v;
+           DROP TABLE test_hnsw_tmp;" 2>/dev/null && {
+  echo "  ✅ PASS: HNSW index creation available (pgvector 0.7.0 working)"
+} || {
+  echo "  ❌ FAIL: HNSW index creation failed (pgvector not loaded?)"
+}
+echo ""
+
+echo "=== Verification complete ==="