dc4245361d
RPF-WP-0018 closed: all seven tasks done. The provider-declaration finding was adopted upstream and its canonical form is the provider: block in tenancy.yaml; adaptive-pricing declined the standing co-signature and supplied typed tier minima instead, recorded in ADR-0002. Three corrections against our own output are recorded in the documents rather than edited away. RPF-WP-0019 T03 done (ceiling of three, memory binding, apps-pg-2 named as overflow, enforced by make apps-pg-verify-capacity). T01/T02 are repository-complete: backup target, retention, per-consumer connection limits, role timeouts and Burstable resources are declared in source and published in s3-consumer-interfaces 1.1.0 before rollout. They stay in progress because no live application, backup success or restore proof exists, and declared configuration is not a section 13 artifact. T04 waits on that window. apps-pg R reason corrected to say the target is declared-not-applied rather than absent. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
94 lines
3 KiB
YAML
94 lines
3 KiB
YAML
---
|
|
# Shared CNPG Cluster for S5 application databases (RAILIANCE-WP-0003).
|
|
# Owned by railiance-platform (S3). Operator lives in cnpg-system.
|
|
#
|
|
# Apply: kubectl apply -f helm/apps-pg-cluster.yaml
|
|
# Status: kubectl cnpg status apps-pg -n databases (requires cnpg kubectl plugin)
|
|
# or: kubectl get cluster apps-pg -n databases -o wide
|
|
#
|
|
# Pre-condition: apps-pg-credentials Secret must exist in databases ns.
|
|
# See helm/apps-pg-secret.sops.yaml.template for the bootstrap recipe.
|
|
#
|
|
# Consumer onboarding: see docs/apps-pg.md. The bootstrap role apps_admin
|
|
# and meta DB apps_meta exist only to anchor the cluster; per-app roles
|
|
# and databases are added through the documented onboarding contract.
|
|
apiVersion: postgresql.cnpg.io/v1
|
|
kind: Cluster
|
|
metadata:
|
|
name: apps-pg
|
|
namespace: databases
|
|
labels:
|
|
app.kubernetes.io/name: apps-pg
|
|
app.kubernetes.io/component: database
|
|
app.kubernetes.io/managed-by: manual
|
|
railiance.io/layer: s3-platform
|
|
railiance.io/role: shared-apps-database
|
|
spec:
|
|
instances: 1 # bump to 3 when node RAM > 8GB
|
|
imageName: ghcr.io/cloudnative-pg/postgresql:16
|
|
resources:
|
|
requests:
|
|
cpu: 100m
|
|
memory: 256Mi
|
|
limits:
|
|
cpu: "1"
|
|
memory: 1Gi
|
|
storage:
|
|
size: 10Gi
|
|
bootstrap:
|
|
initdb:
|
|
database: apps_meta
|
|
owner: apps_admin
|
|
secret:
|
|
name: apps-pg-credentials
|
|
# Per-app PostgreSQL roles are added here (CNPG 1.28 role lifecycle is
|
|
# cluster-scoped — no standalone Role CR). The credential Secret for
|
|
# each role lives in the databases namespace and is mirrored into the
|
|
# consumer namespace by the consuming repo. See docs/apps-pg.md.
|
|
managed:
|
|
roles:
|
|
- name: vergabe # RAILIANCE-WP-0002 T04 (vergabe-teilnahme)
|
|
ensure: present
|
|
login: true
|
|
connectionLimit: 20
|
|
passwordSecret:
|
|
name: vergabe-app-credentials
|
|
- name: coulomb_social # CSOC-WP-0002 (coulomb-social)
|
|
ensure: present
|
|
login: true
|
|
connectionLimit: 20
|
|
passwordSecret:
|
|
name: coulomb-social-app-credentials
|
|
postgresql:
|
|
parameters:
|
|
max_connections: "100"
|
|
log_connections: "on"
|
|
log_disconnections: "on"
|
|
log_lock_waits: "on"
|
|
log_min_duration_statement: "1000"
|
|
track_io_timing: "on"
|
|
backup:
|
|
retentionPolicy: "30d"
|
|
barmanObjectStore:
|
|
destinationPath: s3://railiance-platform-pg-backup/apps-pg/
|
|
endpointURL: https://s3.nl-ams.scw.cloud
|
|
s3Credentials:
|
|
accessKeyId:
|
|
name: platform-pg-backup-s3
|
|
key: ACCESS_KEY_ID
|
|
secretAccessKey:
|
|
name: platform-pg-backup-s3
|
|
key: ACCESS_SECRET_KEY
|
|
wal:
|
|
compression: gzip
|
|
maxParallel: 2
|
|
data:
|
|
compression: gzip
|
|
jobs: 2
|
|
# HA replica + connection pooler are deferred (RAILIANCE-WP-0003 Notes):
|
|
# services:
|
|
# additional:
|
|
# - selectorType: rw
|
|
# serviceTemplate:
|
|
# metadata:
|
|
# name: apps-pg-pooler-rw
|