ce7cb702218693d08ea6d83464d2457c9250027c

vendor/platform/postgres/config/backup.yaml

@@ -0,0 +1,44 @@
+apiVersion: barmancloud.cnpg.io/v1
+kind: ObjectStore
+metadata:
+  name: pg-backup
+  namespace: postgres
+spec:
+  retentionPolicy: "7d"
+  configuration:
+    destinationPath: s3://pg-backup/
+    endpointURL: https://s3.quorate.internal
+    endpointCA:
+      name: pg-backup
+      key: ca.crt
+    s3Credentials:
+      accessKeyId:
+        name: pg-backup
+        key: ACCESS_KEY_ID
+      secretAccessKey:
+        name: pg-backup
+        key: ACCESS_SECRET_KEY
+    wal:
+      compression: gzip
+  instanceSidecarConfiguration:
+    resources:
+      requests:
+        cpu: 100m
+        memory: 128Mi
+      limits:
+        memory: 512Mi
+---
+apiVersion: postgresql.cnpg.io/v1
+kind: ScheduledBackup
+metadata:
+  name: main-weekly
+  namespace: postgres
+spec:
+  schedule: "0 0 6 * * 1"
+  backupOwnerReference: self
+  cluster:
+    name: main
+  target: prefer-standby
+  method: plugin
+  pluginConfiguration:
+    name: barman-cloud.cloudnative-pg.io

vendor/platform/postgres/config/certificate.yaml

@@ -0,0 +1,55 @@
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: vault-postgres
+spec:
+  vault:
+    path: pki_postgres/sign/server
+    server: https://vault-active-tls.vault.svc.cluster.local:443
+    serverName: vault-active-direct.vault.svc.cluster.local
+    caBundleSecretRef:
+      name: vault-root-ca
+      key: ca.crt
+    auth:
+      kubernetes:
+        role: cert-manager-postgres
+        mountPath: /v1/auth/kubernetes
+        serviceAccountRef:
+          name: cert-manager
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: main-server-vault
+  namespace: postgres
+spec:
+  secretName: main-server-vault
+  duration: 2160h
+  renewBefore: 360h
+  secretTemplate:
+    labels:
+      cnpg.io/reload: ""
+  privateKey:
+    algorithm: ECDSA
+    size: 256
+    rotationPolicy: Always
+  usages:
+    - server auth
+  dnsNames:
+    - main-rw
+    - main-rw.postgres
+    - main-rw.postgres.svc
+    - main-rw.postgres.svc.cluster.local
+    - main-rw-lb
+    - main-rw-lb.postgres
+    - main-rw-lb.postgres.svc
+    - main-rw-lb.postgres.svc.cluster.local
+    - main-ro-lb
+    - main-ro-lb.postgres
+    - main-ro-lb.postgres.svc
+    - main-ro-lb.postgres.svc.cluster.local
+    - postgres-rw.quorate.internal
+    - postgres-ro.quorate.internal
+  issuerRef:
+    name: vault-postgres
+    kind: ClusterIssuer

vendor/platform/postgres/config/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - certificate.yaml
+  - backup.yaml
+  - main-cluster.yaml

vendor/platform/postgres/config/main-cluster.yaml

@@ -0,0 +1,71 @@
+apiVersion: postgresql.cnpg.io/v1
+kind: Cluster
+metadata:
+  name: main
+  namespace: postgres
+spec:
+  inheritedMetadata:
+    annotations:
+      certificates.quorate.internal/activation: '{"plugin-barman-cloud":"native"}'
+  instances: 3
+  imageName: zot.quorate.internal/quorate/cnpg-postgresql:18.6@sha256:430d8904b6ab4ebab9c3e188a07dc73fac4e5be9f86b8cf4e50be43b4dacbdc2
+  primaryUpdateMethod: switchover
+  certificates:
+    serverCASecret: main-server-vault
+    serverTLSSecret: main-server-vault
+  postgresql:
+    shared_preload_libraries:
+      - timescaledb
+    parameters:
+      max_connections: "200"
+      timescaledb.telemetry_level: "off"
+  resources:
+    requests:
+      cpu: "1"
+      memory: "4Gi"
+    limits:
+      memory: "4Gi"
+
+  plugins:
+    - name: barman-cloud.cloudnative-pg.io
+      isWALArchiver: true
+      parameters:
+        barmanObjectName: pg-backup
+
+  managed:
+    services:
+      # Hide the default ClusterIP ro/r services
+      disabledDefaultServices: ["ro", "r"]
+
+      additional:
+        - selectorType: rw
+          serviceTemplate:
+            metadata:
+              name: main-rw-lb
+              labels:
+                io.cilium/bgp-announce: "true"
+              annotations:
+                lbipam.cilium.io/ips: "10.234.158.153"
+            spec:
+              type: LoadBalancer
+              externalTrafficPolicy: Local
+
+        - selectorType: ro
+          serviceTemplate:
+            metadata:
+              name: main-ro-lb
+              labels:
+                io.cilium/bgp-announce: "true"
+              annotations:
+                lbipam.cilium.io/ips: "10.157.251.228"
+            spec:
+              type: LoadBalancer
+              externalTrafficPolicy: Local
+  storage:
+    storageClass: openebs-hostpath
+    size: 50Gi
+
+  affinity:
+    enablePodAntiAffinity: true
+    topologyKey: kubernetes.io/hostname
+    podAntiAffinityType: required