Initial commit of the Crunchy PGO

[joryirving]

Notes:
This potentially eliminates postgres-init containers, which should be cleaned up.
I have no way of getting the credentials from the created users at this time, automatically.
I have to manually manage the postgres user list.

[smurf-bot]

--- kubernetes/teyvat/apps Kustomization: flux-system/cluster-apps Kustomization: flux-system/crunchy-postgres-operator

+++ kubernetes/teyvat/apps Kustomization: flux-system/cluster-apps Kustomization: flux-system/crunchy-postgres-operator

@@ -0,0 +1,38 @@

+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  labels:
+    kustomize.toolkit.fluxcd.io/name: cluster-apps
+    kustomize.toolkit.fluxcd.io/namespace: flux-system
+  name: crunchy-postgres-operator
+  namespace: flux-system
+spec:
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: crunchy-postgres-operator
+  decryption:
+    provider: sops
+    secretRef:
+      name: sops-age
+  interval: 30m
+  path: ./kubernetes/teyvat/apps/database/crunchy-postgres-operator/app
+  postBuild:
+    substituteFrom:
+    - kind: ConfigMap
+      name: cluster-settings
+    - kind: Secret
+      name: cluster-secrets
+    - kind: ConfigMap
+      name: cluster-settings-user
+    - kind: Secret
+      name: cluster-secrets-user
+  prune: true
+  retryInterval: 1m
+  sourceRef:
+    kind: GitRepository
+    name: home-kubernetes
+  targetNamespace: database
+  timeout: 5m
+  wait: true
+
--- kubernetes/teyvat/apps Kustomization: flux-system/cluster-apps Kustomization: flux-system/crunchy-postgres-operator-cluster

+++ kubernetes/teyvat/apps Kustomization: flux-system/cluster-apps Kustomization: flux-system/crunchy-postgres-operator-cluster

@@ -0,0 +1,42 @@

+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  labels:
+    kustomize.toolkit.fluxcd.io/name: cluster-apps
+    kustomize.toolkit.fluxcd.io/namespace: flux-system
+  name: crunchy-postgres-operator-cluster
+  namespace: flux-system
+spec:
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: crunchy-postgres-operator-cluster
+  decryption:
+    provider: sops
+    secretRef:
+      name: sops-age
+  dependsOn:
+  - name: crunchy-postgres-operator
+  - name: external-secrets-bitwarden
+  - name: minio
+  interval: 30m
+  path: ./kubernetes/teyvat/apps/database/crunchy-postgres-operator/cluster
+  postBuild:
+    substituteFrom:
+    - kind: ConfigMap
+      name: cluster-settings
+    - kind: Secret
+      name: cluster-secrets
+    - kind: ConfigMap
+      name: cluster-settings-user
+    - kind: Secret
+      name: cluster-secrets-user
+  prune: true
+  retryInterval: 1m
+  sourceRef:
+    kind: GitRepository
+    name: home-kubernetes
+  targetNamespace: database
+  timeout: 5m
+  wait: true
+
--- kubernetes/teyvat/flux Kustomization: flux-system/cluster HelmRepository: flux-system/crunchydata

+++ kubernetes/teyvat/flux Kustomization: flux-system/cluster HelmRepository: flux-system/crunchydata

@@ -0,0 +1,14 @@

+---
+apiVersion: source.toolkit.fluxcd.io/v1beta2
+kind: HelmRepository
+metadata:
+  labels:
+    kustomize.toolkit.fluxcd.io/name: cluster
+    kustomize.toolkit.fluxcd.io/namespace: flux-system
+  name: crunchydata
+  namespace: flux-system
+spec:
+  interval: 5m
+  type: oci
+  url: oci://registry.developers.crunchydata.com/crunchydata
+
--- kubernetes/teyvat/apps/database/crunchy-postgres-operator/app Kustomization: flux-system/crunchy-postgres-operator HelmRelease: database/crunchy-postgres-operator

+++ kubernetes/teyvat/apps/database/crunchy-postgres-operator/app Kustomization: flux-system/crunchy-postgres-operator HelmRelease: database/crunchy-postgres-operator

@@ -0,0 +1,37 @@

+---
+apiVersion: helm.toolkit.fluxcd.io/v2beta2
+kind: HelmRelease
+metadata:
+  labels:
+    app.kubernetes.io/name: crunchy-postgres-operator
+    kustomize.toolkit.fluxcd.io/name: crunchy-postgres-operator
+    kustomize.toolkit.fluxcd.io/namespace: flux-system
+  name: crunchy-postgres-operator
+  namespace: database
+spec:
+  chart:
+    spec:
+      chart: pgo
+      sourceRef:
+        kind: HelmRepository
+        name: crunchydata
+        namespace: flux-system
+      version: 5.5.0
+  install:
+    crds: CreateReplace
+    remediation:
+      retries: 3
+  interval: 30m
+  maxHistory: 2
+  uninstall:
+    keepHistory: false
+  upgrade:
+    cleanupOnFail: true
+    crds: CreateReplace
+    remediation:
+      retries: 3
+  values:
+    install:
+      clusterLabels:
+        app.kubernetes.io/name: pgo
+
--- kubernetes/teyvat/apps/database/crunchy-postgres-operator/cluster Kustomization: flux-system/crunchy-postgres-operator-cluster PostgresCluster: database/postgres

+++ kubernetes/teyvat/apps/database/crunchy-postgres-operator/cluster Kustomization: flux-system/crunchy-postgres-operator-cluster PostgresCluster: database/postgres

@@ -0,0 +1,144 @@

+---
+apiVersion: postgres-operator.crunchydata.com/v1beta1
+kind: PostgresCluster
+metadata:
+  labels:
+    app.kubernetes.io/name: crunchy-postgres-operator-cluster
+    kustomize.toolkit.fluxcd.io/name: crunchy-postgres-operator-cluster
+    kustomize.toolkit.fluxcd.io/namespace: flux-system
+  name: postgres
+  namespace: database
+spec:
+  backups:
+    pgbackrest:
+      configuration:
+      - secret:
+          name: crunchy-postgres
+      global:
+        archive-push-queue-max: 4GiB
+        archive-timeout: '60'
+        compress-level: '9'
+        compress-type: bz2
+        delta: y
+        repo1-path: /crunchy-pgo
+        repo1-retention-diff: '30'
+        repo1-retention-full: '14'
+        repo1-retention-full-type: time
+        repo1-s3-uri-style: path
+        repo2-block: y
+        repo2-bundle: y
+        repo2-cipher-type: aes-256-cbc
+        repo2-path: /crunchy-pgo
+        repo2-retention-diff: '7'
+        repo2-retention-full: '2'
+        repo2-retention-full-type: time
+        repo2-s3-uri-style: path
+        repo3-block: y
+        repo3-bundle: y
+        repo3-cipher-type: aes-256-cbc
+        repo3-retention-diff: '30'
+        repo3-retention-full: '5'
+        repo3-retention-full-type: time
+        repo3-s3-uri-style: path
+      manual:
+        options:
+        - --type=full
+        repoName: repo1
+      metadata:
+        labels:
+          app.kubernetes.io/name: crunchy-postgres-backup
+      repos:
+      - name: repo1
+        s3:
+          bucket: postgresql
+          endpoint: s3.${SECRET_DOMAIN}
+          region: ca-west-1
+        schedules:
+          differential: 0 1 * * 1-6
+          full: 0 1 * * 0
+          incremental: 0 2-23 * * *
+      - name: repo2
+        s3:
+          bucket: postgresql
+          endpoint: ${SECRET_PGBACKREST_WAL_R2_ENDPOINT}
+          region: ca-west-1
+        schedules:
+          differential: 0 2 * * 1-6
+          full: 0 2 * * 0
+  instances:
+  - dataVolumeClaimSpec:
+      accessModes:
+      - ReadWriteOnce
+      resources:
+        requests:
+          storage: 20Gi
+      storageClassName: local-hostpath
+    metadata:
+      labels:
+        app.kubernetes.io/name: crunchy-postgres
+    name: postgres
+    replicas: 3
+    topologySpreadConstraints:
+    - labelSelector:
+        matchLabels:
+          postgres-operator.crunchydata.com/data: postgres
+      maxSkew: 1
+      topologyKey: kubernetes.io/hostname
+      whenUnsatisfiable: DoNotSchedule
+  metadata:
+    annotations:
+      replicator.v1.mittwald.de/replication-allowed: 'true'
+      replicator.v1.mittwald.de/replication-allowed-namespaces: '*'
+  patroni:
+    dynamicConfiguration:
+      postgresql:
+        synchronous_commit: 'on'
+      synchronous_mode: true
+  postgresVersion: 16
+  proxy:
+    pgBouncer:
+      port: 5432
+      replicas: 3
+      topologySpreadConstraints:
+      - labelSelector:
+          matchLabels:
+            postgres-operator.crunchydata.com/cluster: postgres
+            postgres-operator.crunchydata.com/role: pgbouncer
+        maxSkew: 1
+        topologyKey: kubernetes.io/hostname
+        whenUnsatisfiable: DoNotSchedule
+  service:
+    type: LoadBalancer
+  users:
+  - databases:
+    - atuin
+    name: atuin
+  - databases:
+    - authentik
+    name: authentik
+  - databases:
+    - bazarr
+    name: bazarr
+  - databases:
+    - gatus
+    name: gatus
+  - databases:
+    - grafana
+    name: grafana
+  - databases:
+    - paperless
+    name: paperless
+  - name: postgres
+  - databases:
+    - prowlarr_main, prowlarr_log
+    name: prowlarr
+  - databases:
+    - radarr_main, radarr_log
+    name: radarr
+  - databases:
+    - readarr_cache, readarr_main, readarr_log
+    name: readarr
+  - databases:
+    - sonarr_main, sonarr_log
+    name: sonarr
+
--- kubernetes/teyvat/apps/database/crunchy-postgres-operator/cluster Kustomization: flux-system/crunchy-postgres-operator-cluster ExternalSecret: database/crunchy-postgres

+++ kubernetes/teyvat/apps/database/crunchy-postgres-operator/cluster Kustomization: flux-system/crunchy-postgres-operator-cluster ExternalSecret: database/crunchy-postgres

@@ -0,0 +1,29 @@

+---
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  labels:
+    app.kubernetes.io/name: crunchy-postgres-operator-cluster
+    kustomize.toolkit.fluxcd.io/name: crunchy-postgres-operator-cluster
+    kustomize.toolkit.fluxcd.io/namespace: flux-system
+  name: crunchy-postgres
+  namespace: database
+spec:
+  dataFrom:
+  - extract:
+      key: postgresql_bucket
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: bitwarden-secrets-manager
+  target:
+    name: crunchy-postgres
+    template:
+      data:
+        s3.conf: |
+          [global]
+          repo1-s3-key={{ .MINIO_POSTGRES_ACCESS_KEY }}
+          repo1-s3-key-secret={{ .MINIO_POSTGRES_SECRET_KEY }}
+          rpeo2-s3-key={{ .CLOUDFLARE_POSTGRES_ACCESS_KEY }}
+          repo2-s3-key-secret={{ .CLOUDFLARE_POSTGRES_SECRET_KEY }}
+      engineVersion: v2
+

[smurf-bot]

--- HelmRelease: database/crunchy-postgres-operator ServiceAccount: database/pgo

+++ HelmRelease: database/crunchy-postgres-operator ServiceAccount: database/pgo

@@ -0,0 +1,11 @@

+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: pgo
+  labels:
+    app.kubernetes.io/name: pgo
+    app.kubernetes.io/instance: crunchy-postgres-operator
+    app.kubernetes.io/managed-by: Helm
+    postgres-operator.crunchydata.com/control-plane: pgo
+
--- HelmRelease: database/crunchy-postgres-operator ClusterRole: database/pgo

+++ HelmRelease: database/crunchy-postgres-operator ClusterRole: database/pgo

@@ -0,0 +1,152 @@

+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: pgo
+  labels:
+    app.kubernetes.io/name: pgo
+    app.kubernetes.io/instance: crunchy-postgres-operator
+    app.kubernetes.io/managed-by: Helm
+    postgres-operator.crunchydata.com/control-plane: pgo
+rules:
+- apiGroups:
+  - ''
+  resources:
+  - configmaps
+  - persistentvolumeclaims
+  - secrets
+  - services
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - watch
+- apiGroups:
+  - ''
+  resources:
+  - endpoints
+  verbs:
+  - create
+  - delete
+  - deletecollection
+  - get
+  - list
+  - patch
+  - watch
+- apiGroups:
+  - ''
+  resources:
+  - endpoints/restricted
+  - pods/exec
+  verbs:
+  - create
+- apiGroups:
+  - ''
+  resources:
+  - events
+  verbs:
+  - create
+  - patch
+- apiGroups:
+  - ''
+  resources:
+  - pods
+  verbs:
+  - delete
+  - get
+  - list
+  - patch
+  - watch
+- apiGroups:
+  - ''
+  resources:
+  - serviceaccounts
+  verbs:
+  - create
+  - get
+  - list
+  - patch
+  - watch
+- apiGroups:
+  - apps
+  resources:
+  - deployments
+  - statefulsets
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - watch
+- apiGroups:
+  - batch
+  resources:
+  - cronjobs
+  - jobs
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - watch
+- apiGroups:
+  - policy
+  resources:
+  - poddisruptionbudgets
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - watch
+- apiGroups:
+  - postgres-operator.crunchydata.com
+  resources:
+  - pgadmins
+  - pgupgrades
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - postgres-operator.crunchydata.com
+  resources:
+  - pgadmins/finalizers
+  - pgupgrades/finalizers
+  - postgresclusters/finalizers
+  verbs:
+  - update
+- apiGroups:
+  - postgres-operator.crunchydata.com
+  resources:
+  - pgadmins/status
+  - pgupgrades/status
+  - postgresclusters/status
+  verbs:
+  - patch
+- apiGroups:
+  - postgres-operator.crunchydata.com
+  resources:
+  - postgresclusters
+  verbs:
+  - get
+  - list
+  - patch
+  - watch
+- apiGroups:
+  - rbac.authorization.k8s.io
+  resources:
+  - rolebindings
+  - roles
+  verbs:
+  - create
+  - get
+  - list
+  - patch
+  - watch
+
--- HelmRelease: database/crunchy-postgres-operator ClusterRoleBinding: database/pgo

+++ HelmRelease: database/crunchy-postgres-operator ClusterRoleBinding: database/pgo

@@ -0,0 +1,19 @@

+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: pgo
+  labels:
+    app.kubernetes.io/name: pgo
+    app.kubernetes.io/instance: crunchy-postgres-operator
+    app.kubernetes.io/managed-by: Helm
+    postgres-operator.crunchydata.com/control-plane: pgo
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: pgo
+subjects:
+- kind: ServiceAccount
+  name: pgo
+  namespace: database
+
--- HelmRelease: database/crunchy-postgres-operator Deployment: database/pgo

+++ HelmRelease: database/crunchy-postgres-operator Deployment: database/pgo

@@ -0,0 +1,72 @@

+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: pgo
+  labels:
+    app.kubernetes.io/name: pgo
+    app.kubernetes.io/instance: crunchy-postgres-operator
+    app.kubernetes.io/managed-by: Helm
+    postgres-operator.crunchydata.com/control-plane: pgo
+spec:
+  replicas: 1
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      postgres-operator.crunchydata.com/control-plane: pgo
+  template:
+    metadata:
+      labels:
+        postgres-operator.crunchydata.com/control-plane: pgo
+    spec:
+      serviceAccountName: pgo
+      containers:
+      - name: operator
+        image: registry.developers.crunchydata.com/crunchydata/postgres-operator:ubi8-5.5.0-0
+        env:
+        - name: CRUNCHY_DEBUG
+          value: 'true'
+        - name: PGO_NAMESPACE
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.namespace
+        - name: RELATED_IMAGE_PGADMIN
+          value: registry.developers.crunchydata.com/crunchydata/crunchy-pgadmin4:ubi8-4.30-19
+        - name: RELATED_IMAGE_PGBACKREST
+          value: registry.developers.crunchydata.com/crunchydata/crunchy-pgbackrest:ubi8-2.47-2
+        - name: RELATED_IMAGE_PGBOUNCER
+          value: registry.developers.crunchydata.com/crunchydata/crunchy-pgbouncer:ubi8-1.21-0
+        - name: RELATED_IMAGE_PGEXPORTER
+          value: registry.developers.crunchydata.com/crunchydata/crunchy-postgres-exporter:ubi8-0.15.0-0
+        - name: RELATED_IMAGE_PGUPGRADE
+          value: registry.developers.crunchydata.com/crunchydata/crunchy-upgrade:ubi8-5.5.0-0
+        - name: RELATED_IMAGE_POSTGRES_14
+          value: registry.developers.crunchydata.com/crunchydata/crunchy-postgres:ubi8-14.10-0
+        - name: RELATED_IMAGE_POSTGRES_14_GIS_3.1
+          value: registry.developers.crunchydata.com/crunchydata/crunchy-postgres-gis:ubi8-14.10-3.1-0
+        - name: RELATED_IMAGE_POSTGRES_14_GIS_3.2
+          value: registry.developers.crunchydata.com/crunchydata/crunchy-postgres-gis:ubi8-14.10-3.2-0
+        - name: RELATED_IMAGE_POSTGRES_14_GIS_3.3
+          value: registry.developers.crunchydata.com/crunchydata/crunchy-postgres-gis:ubi8-14.10-3.3-0
+        - name: RELATED_IMAGE_POSTGRES_15
+          value: registry.developers.crunchydata.com/crunchydata/crunchy-postgres:ubi8-15.5-0
+        - name: RELATED_IMAGE_POSTGRES_15_GIS_3.3
+          value: registry.developers.crunchydata.com/crunchydata/crunchy-postgres-gis:ubi8-15.5-3.3-0
+        - name: RELATED_IMAGE_POSTGRES_16
+          value: registry.developers.crunchydata.com/crunchydata/crunchy-postgres:ubi8-16.1-0
+        - name: RELATED_IMAGE_POSTGRES_16_GIS_3.3
+          value: registry.developers.crunchydata.com/crunchydata/crunchy-postgres-gis:ubi8-16.1-3.3-0
+        - name: RELATED_IMAGE_POSTGRES_16_GIS_3.4
+          value: registry.developers.crunchydata.com/crunchydata/crunchy-postgres-gis:ubi8-16.1-3.4-0
+        - name: RELATED_IMAGE_STANDALONE_PGADMIN
+          value: registry.developers.crunchydata.com/crunchydata/crunchy-pgadmin4:ubi8-7.8-0
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
+          readOnlyRootFilesystem: true
+          runAsNonRoot: true
+