os/argocd/platform/common/base/cnpg-cluster.yaml at main · voltade/os · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
apiVersion: postgresql.cnpg.io/v1
kind: Cluster
metadata:
  name: cnpg-cluster
  annotations:
    argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
    argocd.argoproj.io/sync-wave: "-1"
spec:
  # https://github.com/voltade/voltade-os/pkgs/container/postgres
  imageName: ghcr.io/voltade/postgres:17.5-20250821-cac6877
  instances: 1
  certificates:
    serverCASecret: platform-server-tls
    serverTLSSecret: platform-server-tls
  storage:
    size: 4Gi
  postgresql:
    parameters:
      pgsodium.enable_event_trigger: "off"
      pgsodium.getkey_script: /usr/share/postgresql/17/extension/pgsodium_getkey
    shared_preload_libraries:
      - supabase_vault
  managed:
    roles:
      - name: platform_admin
        login: true
        passwordSecret:
          name: cnpg-platform-admin

      - name: platform_migrator
        login: true
        connectionLimit: 1
        inRoles:
          - platform_admin
        passwordSecret:
          name: cnpg-platform-migrator

      - name: openfga_admin
        login: true
        passwordSecret:
          name: cnpg-openfga-admin

  bootstrap:
    initdb:
      database: platform
      owner: platform_admin
      dataChecksums: true
      postInitApplicationSQL:
        - create schema if not exists extensions;
        - create extension supabase_vault cascade;
        - grant usage on schema vault to platform_admin;
        - grant execute on all functions in schema vault to platform_admin;
        - grant select on all tables in schema vault to platform_admin;
        - grant delete on all tables in schema vault to platform_admin;
        - grant references on all tables in schema vault to platform_admin;