Implement PostgreSQL production store path

Add the PostgreSQL backend, migration and stopped-write transfer tools, lease-aware deployment manifests, tenancy declarations, and shared conformance coverage. Persist grouping mutations in durable stores and separate process liveness from database readiness.

deploy/README.md

@@ -22,6 +22,11 @@ credentials are projected as files so clients can re-read them on rotation.
 egress policy. The pinned image in both files must contain the PostgreSQL code
 and migration before either manifest is applied.
 
+The Deployment uses `/live` for process liveness and `/health` for readiness.
+`/health` checks the selected store, so a database or lease outage removes the
+pod from service without turning an external dependency failure into a restart
+loop.
+
 ## Rolling out an image
 
 **Do not build images on a workstation.** `.forgejo/workflows/image.yaml`

deploy/tenant-engine-migration.yaml

@@ -0,0 +1,86 @@
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: tenant-engine-schema-migration
+  namespace: tenant-engine
+  labels:
+    app.kubernetes.io/name: tenant-engine
+    app.kubernetes.io/component: migration
+spec:
+  backoffLimit: 2
+  ttlSecondsAfterFinished: 86400
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: tenant-engine-migration
+    spec:
+      automountServiceAccountToken: false
+      restartPolicy: Never
+      securityContext:
+        fsGroup: 10001
+        runAsNonRoot: true
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+      - name: migrate
+        image: forgejo.coulomb.social/coulomb/tenant-engine@sha256:44ca65f3cdd5967b0124e16b6aba10bf1ac2747e1dde96cbef3dd11ae7cc9574
+        args:
+        - tenant-engine-migrate
+        - --url-file
+        - /var/run/secrets/postgres-migration/url
+        env:
+        - name: TENANT_ENGINE_MIGRATION_DATABASE_URL_FILE
+          value: /var/run/secrets/postgres-migration/url
+        resources:
+          limits:
+            cpu: 500m
+            memory: 256Mi
+          requests:
+            cpu: 25m
+            memory: 48Mi
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
+          readOnlyRootFilesystem: true
+        volumeMounts:
+        - mountPath: /var/run/secrets/postgres-migration
+          name: postgres-migration
+          readOnly: true
+      volumes:
+      - name: postgres-migration
+        secret:
+          defaultMode: 0440
+          secretName: tenant-engine-postgres-migration
+          items:
+          - key: url
+            path: url
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: tenant-engine-schema-migration
+  namespace: tenant-engine
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: tenant-engine-migration
+  policyTypes: [Egress]
+  egress:
+  - to:
+    - namespaceSelector:
+        matchLabels:
+          kubernetes.io/metadata.name: databases
+      podSelector:
+        matchLabels:
+          cnpg.io/cluster: platform-pg
+    ports:
+    - {port: 5432, protocol: TCP}
+  - to:
+    - namespaceSelector:
+        matchLabels:
+          kubernetes.io/metadata.name: kube-system
+    ports:
+    - {port: 53, protocol: UDP}
+    - {port: 53, protocol: TCP}

deploy/tenant-engine.yaml

@@ -10,18 +10,6 @@ metadata:
     # reach 5432 and the failure looks like DNS or a bad credential.
     railiance.io/postgres-client: platform-pg
 ---
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: tenant-engine-data
-  namespace: tenant-engine
-spec:
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: 1Gi
----
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -33,24 +21,27 @@ spec:
     matchLabels:
       app.kubernetes.io/name: tenant-engine
   strategy:
-    type: Recreate
+    type: RollingUpdate
   template:
     metadata:
       labels:
         app.kubernetes.io/name: tenant-engine
     spec:
       automountServiceAccountToken: false
+      serviceAccountName: tenant-engine
       containers:
       - name: tenant-engine
         env:
-        - name: TENANT_ENGINE_DATABASE_PATH
-          value: /data/tenant-engine.db
+        - name: TENANT_ENGINE_DATABASE_URL_FILE
+          value: /var/run/secrets/postgres-runtime/url
         - name: TENANT_ENGINE_FLEX_AUTH_URL
           value: http://flex-auth-tenant-engine.flex-auth.svc.cluster.local:8080
+        - name: TENANT_ENGINE_FLEX_AUTH_TOKEN_FILE
+          value: /var/run/secrets/flex-auth-caller/token
         image: forgejo.coulomb.social/coulomb/tenant-engine@sha256:44ca65f3cdd5967b0124e16b6aba10bf1ac2747e1dde96cbef3dd11ae7cc9574
         livenessProbe:
           httpGet:
-            path: /health
+            path: /live
             port: http
           periodSeconds: 20
         ports:
@@ -75,17 +66,33 @@ spec:
               - ALL
           readOnlyRootFilesystem: true
         volumeMounts:
-        - mountPath: /data
-          name: data
+        - mountPath: /var/run/secrets/postgres-runtime
+          name: postgres-runtime
+          readOnly: true
+        - mountPath: /var/run/secrets/flex-auth-caller
+          name: flex-auth-caller
+          readOnly: true
       securityContext:
         fsGroup: 10001
         runAsNonRoot: true
         seccompProfile:
           type: RuntimeDefault
       volumes:
-      - name: data
-        persistentVolumeClaim:
-          claimName: tenant-engine-data
+      - name: postgres-runtime
+        secret:
+          defaultMode: 0440
+          secretName: tenant-engine-postgres-runtime
+          items:
+          - key: url
+            path: url
+      - name: flex-auth-caller
+        projected:
+          defaultMode: 0440
+          sources:
+          - serviceAccountToken:
+              audience: flex-auth
+              expirationSeconds: 3600
+              path: token
 ---
 apiVersion: v1
 kind: Service
@@ -100,6 +107,13 @@ spec:
   selector:
     app.kubernetes.io/name: tenant-engine
 ---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: tenant-engine
+  namespace: tenant-engine
+automountServiceAccountToken: false
+---
 apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy
 metadata:
@@ -124,6 +138,16 @@ spec:
     - port: 8090
       protocol: TCP
   egress:
+  - ports:
+    - port: 5432
+      protocol: TCP
+    to:
+    - namespaceSelector:
+        matchLabels:
+          kubernetes.io/metadata.name: databases
+      podSelector:
+        matchLabels:
+          cnpg.io/cluster: platform-pg
   - ports:
     - port: 8080
       protocol: TCP