ce7cb702218693d08ea6d83464d2457c9250027c

vendor/platform/postgres/config/backup.yaml

@@ -0,0 +1,44 @@
+apiVersion: barmancloud.cnpg.io/v1
+kind: ObjectStore
+metadata:
+  name: pg-backup
+  namespace: postgres
+spec:
+  retentionPolicy: "7d"
+  configuration:
+    destinationPath: s3://pg-backup/
+    endpointURL: https://s3.quorate.internal
+    endpointCA:
+      name: pg-backup
+      key: ca.crt
+    s3Credentials:
+      accessKeyId:
+        name: pg-backup
+        key: ACCESS_KEY_ID
+      secretAccessKey:
+        name: pg-backup
+        key: ACCESS_SECRET_KEY
+    wal:
+      compression: gzip
+  instanceSidecarConfiguration:
+    resources:
+      requests:
+        cpu: 100m
+        memory: 128Mi
+      limits:
+        memory: 512Mi
+---
+apiVersion: postgresql.cnpg.io/v1
+kind: ScheduledBackup
+metadata:
+  name: main-weekly
+  namespace: postgres
+spec:
+  schedule: "0 0 6 * * 1"
+  backupOwnerReference: self
+  cluster:
+    name: main
+  target: prefer-standby
+  method: plugin
+  pluginConfiguration:
+    name: barman-cloud.cloudnative-pg.io

vendor/platform/postgres/config/certificate.yaml

@@ -0,0 +1,55 @@
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: vault-postgres
+spec:
+  vault:
+    path: pki_postgres/sign/server
+    server: https://vault-active-tls.vault.svc.cluster.local:443
+    serverName: vault-active-direct.vault.svc.cluster.local
+    caBundleSecretRef:
+      name: vault-root-ca
+      key: ca.crt
+    auth:
+      kubernetes:
+        role: cert-manager-postgres
+        mountPath: /v1/auth/kubernetes
+        serviceAccountRef:
+          name: cert-manager
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: main-server-vault
+  namespace: postgres
+spec:
+  secretName: main-server-vault
+  duration: 2160h
+  renewBefore: 360h
+  secretTemplate:
+    labels:
+      cnpg.io/reload: ""
+  privateKey:
+    algorithm: ECDSA
+    size: 256
+    rotationPolicy: Always
+  usages:
+    - server auth
+  dnsNames:
+    - main-rw
+    - main-rw.postgres
+    - main-rw.postgres.svc
+    - main-rw.postgres.svc.cluster.local
+    - main-rw-lb
+    - main-rw-lb.postgres
+    - main-rw-lb.postgres.svc
+    - main-rw-lb.postgres.svc.cluster.local
+    - main-ro-lb
+    - main-ro-lb.postgres
+    - main-ro-lb.postgres.svc
+    - main-ro-lb.postgres.svc.cluster.local
+    - postgres-rw.quorate.internal
+    - postgres-ro.quorate.internal
+  issuerRef:
+    name: vault-postgres
+    kind: ClusterIssuer

vendor/platform/postgres/config/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - certificate.yaml
+  - backup.yaml
+  - main-cluster.yaml

vendor/platform/postgres/config/main-cluster.yaml

@@ -0,0 +1,71 @@
+apiVersion: postgresql.cnpg.io/v1
+kind: Cluster
+metadata:
+  name: main
+  namespace: postgres
+spec:
+  inheritedMetadata:
+    annotations:
+      certificates.quorate.internal/activation: '{"plugin-barman-cloud":"native"}'
+  instances: 3
+  imageName: zot.quorate.internal/quorate/cnpg-postgresql:18.6@sha256:430d8904b6ab4ebab9c3e188a07dc73fac4e5be9f86b8cf4e50be43b4dacbdc2
+  primaryUpdateMethod: switchover
+  certificates:
+    serverCASecret: main-server-vault
+    serverTLSSecret: main-server-vault
+  postgresql:
+    shared_preload_libraries:
+      - timescaledb
+    parameters:
+      max_connections: "200"
+      timescaledb.telemetry_level: "off"
+  resources:
+    requests:
+      cpu: "1"
+      memory: "4Gi"
+    limits:
+      memory: "4Gi"
+
+  plugins:
+    - name: barman-cloud.cloudnative-pg.io
+      isWALArchiver: true
+      parameters:
+        barmanObjectName: pg-backup
+
+  managed:
+    services:
+      # Hide the default ClusterIP ro/r services
+      disabledDefaultServices: ["ro", "r"]
+
+      additional:
+        - selectorType: rw
+          serviceTemplate:
+            metadata:
+              name: main-rw-lb
+              labels:
+                io.cilium/bgp-announce: "true"
+              annotations:
+                lbipam.cilium.io/ips: "10.234.158.153"
+            spec:
+              type: LoadBalancer
+              externalTrafficPolicy: Local
+
+        - selectorType: ro
+          serviceTemplate:
+            metadata:
+              name: main-ro-lb
+              labels:
+                io.cilium/bgp-announce: "true"
+              annotations:
+                lbipam.cilium.io/ips: "10.157.251.228"
+            spec:
+              type: LoadBalancer
+              externalTrafficPolicy: Local
+  storage:
+    storageClass: openebs-hostpath
+    size: 50Gi
+
+  affinity:
+    enablePodAntiAffinity: true
+    topologyKey: kubernetes.io/hostname
+    podAntiAffinityType: required

vendor/platform/postgres/direct-access.yaml

@@ -0,0 +1,18 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: postgres-direct-access
+  namespace: postgres
+spec:
+  endpointSelector:
+    matchLabels:
+      cnpg.io/cluster: main
+  ingress:
+    - fromCIDR:
+        - 10.115.187.218/24
+        - 10.63.81.107/24
+        - 10.162.8.60/24
+      toPorts:
+        - ports:
+            - port: "5432"
+              protocol: TCP

vendor/platform/postgres/helm-release.yaml

@@ -0,0 +1,66 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: cnpg
+  namespace: postgres
+spec:
+  interval: 15m
+  releaseName: cnpg
+  targetNamespace: postgres
+  chart:
+    spec:
+      chart: cloudnative-pg
+      version: 0.29.1
+      sourceRef:
+        kind: HelmRepository
+        name: cnpg
+        namespace: flux-system
+  install:
+    createNamespace: true
+    remediation:
+      retries: 3
+  upgrade:
+    remediation:
+      retries: 3
+  values:
+    replicaCount: 2
+    resources:
+      limits:
+        memory: 200Mi
+      requests:
+        cpu: 20m
+        memory: 100Mi
+    monitoring:
+      podMonitorEnabled: false
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: barman
+  namespace: postgres
+spec:
+  interval: 15m
+  releaseName: barman
+  targetNamespace: postgres
+  chart:
+    spec:
+      chart: plugin-barman-cloud
+      version: 0.8.1
+      sourceRef:
+        kind: HelmRepository
+        name: cnpg
+        namespace: flux-system
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    remediation:
+      retries: 3
+  values:
+    replicaCount: 2
+    resources:
+      limits:
+        memory: 200Mi
+      requests:
+        cpu: 5m
+        memory: 100Mi

vendor/platform/postgres/kustomization.yaml

@@ -0,0 +1,8 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - namespace.yaml
+  - vso.yaml
+  - helm-release.yaml
+  - direct-access.yaml
+  - network-policies.yaml

vendor/platform/postgres/namespace.yaml

@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: postgres
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: pg-vso
+  namespace: postgres

vendor/platform/postgres/network-policies.yaml

@@ -0,0 +1,299 @@
+---
+# CNPG cluster pods: intra-namespace, host metrics, DNS.
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: postgres-cluster
+  namespace: postgres
+spec:
+  endpointSelector:
+    matchLabels:
+      cnpg.io/cluster: main
+  ingress:
+    # Allow intra-namespace replication and metrics.
+    - fromEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: postgres
+      toPorts:
+        - ports:
+            - port: "5432"
+              protocol: TCP
+            - port: "8000"
+              protocol: TCP
+    # Vault database engine: rotates static role credentials
+    - fromEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: vault
+            app.kubernetes.io/name: vault
+            component: server
+      toPorts:
+        - ports:
+            - port: "5432"
+              protocol: TCP
+    # Zitadel app and init job
+    - fromEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: zitadel
+            app.kubernetes.io/name: zitadel
+      toPorts:
+        - ports:
+            - port: "5432"
+              protocol: TCP
+    # Forgejo app and init containers
+    - fromEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: forgejo
+            app.kubernetes.io/name: forgejo
+      toPorts:
+        - ports:
+            - port: "5432"
+              protocol: TCP
+    - fromEndpoints:
+        - matchExpressions:
+            - key: k8s:io.kubernetes.pod.namespace
+              operator: In
+              values:
+                - forgejo-public
+            - key: app.kubernetes.io/name
+              operator: In
+              values:
+                - forgejo
+            - key: app.kubernetes.io/instance
+              operator: In
+              values:
+                - forge-code
+                - forge-git
+      toPorts:
+        - ports:
+            - port: "5432"
+              protocol: TCP
+    # Grafana app
+    - fromEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: grafana
+            app.kubernetes.io/name: grafana
+      toPorts:
+        - ports:
+            - port: "5432"
+              protocol: TCP
+    # Quay registry, mirror, and Clair
+    - fromEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: quay
+      toPorts:
+        - ports:
+            - port: "5432"
+              protocol: TCP
+    # Argo Workflows controller/server archive and node-status offload
+    - fromEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: argo
+            app.kubernetes.io/name: argo-workflows-workflow-controller
+      toPorts:
+        - ports:
+            - port: "5432"
+              protocol: TCP
+    - fromEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: argo
+            app.kubernetes.io/name: argo-workflows-server
+      toPorts:
+        - ports:
+            - port: "5432"
+              protocol: TCP
+    - fromEndpoints:
+        - matchExpressions:
+            - key: k8s:io.kubernetes.pod.namespace
+              operator: In
+              values:
+                - stalwart
+            - key: app.kubernetes.io/name
+              operator: In
+              values:
+                - stalwart
+                - stalwart-bootstrap
+                - stalwart-controller
+            - key: app.kubernetes.io/instance
+              operator: In
+              values:
+                - stalwart
+      toPorts:
+        - ports:
+            - port: "5432"
+              protocol: TCP
+    # Allow host for metrics.
+    - fromEntities:
+        - host
+      toPorts:
+        - ports:
+            - port: "8000"
+              protocol: TCP
+  egress:
+    # Allow intra-namespace replication and metrics.
+    - toEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: postgres
+      toPorts:
+        - ports:
+            - port: "5432"
+              protocol: TCP
+            - port: "8000"
+              protocol: TCP
+    # Allow kube-apiserver access.
+    - toEntities:
+        - kube-apiserver
+      toPorts:
+        - ports:
+            - port: "6443"
+              protocol: TCP
+    # Allow DNS access.
+    - toEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: kube-system
+            k8s-app: kube-dns
+      toPorts:
+        - ports:
+            - port: "53"
+              protocol: UDP
+            - port: "53"
+              protocol: TCP
+    - toEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: versitygw
+            app.kubernetes.io/name: versitygw
+            app.kubernetes.io/instance: versitygw
+      toPorts:
+        - ports:
+            - port: "7070"
+              protocol: TCP
+    - toCIDR:
+        - 10.66.127.81/32
+      toPorts:
+        - ports:
+            - port: "443"
+              protocol: TCP
+---
+# Host egress to postgres pods (metrics, webhook).
+apiVersion: cilium.io/v2
+kind: CiliumClusterwideNetworkPolicy
+metadata:
+  name: host-egress-postgres
+spec:
+  nodeSelector: {}
+  egress:
+    - toEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: postgres
+      toPorts:
+        - ports:
+            - port: "8000"
+              protocol: TCP
+            - port: "9443"
+              protocol: TCP
+            - port: "8081"
+              protocol: TCP
+---
+# CNPG operator: webhook (9443), host metrics (8000), apiserver.
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: cnpg-operator
+  namespace: postgres
+spec:
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/name: cloudnative-pg
+  ingress:
+    # Allow webhook access from kube-apiserver (may arrive as remote-node when apiserver is on a different node).
+    - fromEntities:
+        - kube-apiserver
+        - host
+        - remote-node
+      toPorts:
+        - ports:
+            - port: "9443"
+              protocol: TCP
+    # Allow host for metrics.
+    - fromEntities:
+        - host
+      toPorts:
+        - ports:
+            - port: "8000"
+              protocol: TCP
+  egress:
+    # Allow metrics scraping from cluster pods.
+    - toEndpoints:
+        - matchLabels:
+            cnpg.io/cluster: main
+      toPorts:
+        - ports:
+            - port: "8000"
+              protocol: TCP
+    # Allow kube-apiserver access.
+    - toEntities:
+        - kube-apiserver
+      toPorts:
+        - ports:
+            - port: "6443"
+              protocol: TCP
+    # Allow DNS access.
+    - toEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: kube-system
+            k8s-app: kube-dns
+      toPorts:
+        - ports:
+            - port: "53"
+              protocol: UDP
+            - port: "53"
+              protocol: TCP
+    - toEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: postgres
+            app.kubernetes.io/name: plugin-barman-cloud
+      toPorts:
+        - ports:
+            - port: "9090"
+              protocol: TCP
+---
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: barman
+  namespace: postgres
+spec:
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/name: plugin-barman-cloud
+  ingress:
+    - fromEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: postgres
+            app.kubernetes.io/name: cloudnative-pg
+      toPorts:
+        - ports:
+            - port: "9090"
+              protocol: TCP
+    - fromEntities:
+        - host
+      toPorts:
+        - ports:
+            - port: "8081"
+              protocol: TCP
+  egress:
+    - toEntities:
+        - kube-apiserver
+      toPorts:
+        - ports:
+            - port: "6443"
+              protocol: TCP
+    - toEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: kube-system
+            k8s-app: kube-dns
+      toPorts:
+        - ports:
+            - port: "53"
+              protocol: UDP
+            - port: "53"
+              protocol: TCP

vendor/platform/postgres/vso.yaml

@@ -0,0 +1,42 @@
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultAuth
+metadata:
+  name: default
+  namespace: postgres
+spec:
+  method: kubernetes
+  mount: kubernetes
+  kubernetes:
+    role: pg-backup
+    serviceAccount: pg-vso
+  vaultConnectionRef: vault/vault
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: pg-backup
+  namespace: postgres
+spec:
+  type: kv-v2
+  mount: secret
+  path: versitygw/users/pg-backup
+  destination:
+    name: pg-backup
+    create: true
+    overwrite: true
+    transformation:
+      excludeRaw: true
+      excludes:
+        - .*
+      templates:
+        ACCESS_KEY_ID:
+          text: |
+            {{- get .Secrets "access_key_id" -}}
+        ACCESS_SECRET_KEY:
+          text: |
+            {{- get .Secrets "secret_access_key" -}}
+        ca.crt:
+          text: |
+            {{ get .Secrets "internal_ca_cert" }}
+  refreshAfter: 1h
+  vaultAuthRef: default