net-kingdom/sso-mfa/k8s/postgresql/create-secrets.sh

#!/usr/bin/env bash
# Private creation or exact-match verification; rotations require --rotate-key.
set +x
set -euo pipefail
umask 077
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
exec python3 "$SCRIPT_DIR/../../bootstrap/apply-service-secrets.py" postgresql "$@"
feat(sso-mfa): T03 PostgreSQL manifests (NK-WP-0001-T03) CloudNativePG Cluster CR (net-kingdom-pg, PostgreSQL 16) with two application databases: keycloak_db (owner: keycloak) and privacyidea_db (owner: privacyidea). Passwords managed continuously via managed.roles. WAL archiving section stubbed and commented; activate when object storage is available. ScheduledBackup CR included (daily 02:00 UTC, 7d retention). Also: sync workplan status for T01 (Phase 0a done), T02 (manifests done), T03 (manifests done, restore drill pending); close NK-WP-0002. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> 2026-03-05 09:22:13 +01:00			`#!/usr/bin/env bash`
fix(security): make service Secret updates private and conditional Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a1346b-72a4-7d40-b8bd-8b8ca346cfa2 2026-10-13 20:20:42 +02:00			`# Private creation or exact-match verification; rotations require --rotate-key.`
			`set +x`
feat(sso-mfa): T03 PostgreSQL manifests (NK-WP-0001-T03) CloudNativePG Cluster CR (net-kingdom-pg, PostgreSQL 16) with two application databases: keycloak_db (owner: keycloak) and privacyidea_db (owner: privacyidea). Passwords managed continuously via managed.roles. WAL archiving section stubbed and commented; activate when object storage is available. ScheduledBackup CR included (daily 02:00 UTC, 7d retention). Also: sync workplan status for T01 (Phase 0a done), T02 (manifests done), T03 (manifests done, restore drill pending); close NK-WP-0002. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> 2026-03-05 09:22:13 +01:00			`set -euo pipefail`
fix(security): make service Secret updates private and conditional Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a1346b-72a4-7d40-b8bd-8b8ca346cfa2 2026-10-13 20:20:42 +02:00			`umask 077`
			`SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"`
			`exec python3 "$SCRIPT_DIR/../../bootstrap/apply-service-secrets.py" postgresql "$@"`