apiVersion: postgresql.cnpg.io/v1 kind: Cluster metadata: name: knoe-db namespace: knoe-db-0 spec: instances: 3 enablePDB: false # Image pulled from GCP Artifact Registry — set ARTIFACT_REGISTRY in conf/prod/gcp.cfg # e.g. us-central1-docker.pkg.dev//knoe-system/knoe-db: imageName: "${ARTIFACT_REGISTRY}/knoe-db:${KNOE_DB_IMAGE_TAG}" postgresUID: 100 postgresGID: 101 maxSyncReplicas: 1 affinity: enablePodAntiAffinity: true # Keep spread as a preference for small dedicated Standard DB clusters so 3 pods can still # schedule while nodes reconcile; strict topology can be enforced in later rollout. podAntiAffinityType: preferred topologyKey: kubernetes.io/hostname # physical node boundary (not zone) tolerations: # Allow scheduling on GKE Spot nodes when explicitly enabled for this DB cluster. # Without this toleration the cluster-autoscaler predicate simulation fails # for any MIG whose nodes carry the spot taint, blocking scale-up entirely. - key: "cloud.google.com/gke-spot" operator: "Equal" value: "true" effect: "NoSchedule" # nodeSelector removed: knoe-cnpg-0 is a dedicated DB cluster — all nodes are # available to CNPG. A workload label selector here causes scheduling failures # when CNPG v1.28 translates it into requiredDuringScheduling nodeAffinity. postgresql: parameters: shared_buffers: 64MB # ~25% of 256Mi request; restore to 128MB when resources increase pg_stat_statements.max: '10000' pg_stat_statements.track: all shared_preload_libraries: - pg_stat_statements - pg_tde pg_hba: - local all postgres trust - local all knoe scram-sha-256 - host all postgres all scram-sha-256 - host knoe knoe-db all scram-sha-256 - host all all all scram-sha-256 - hostssl knoe knoe-db all scram-sha-256 bootstrap: initdb: database: knoe-db owner: knoe localeCollate: 'en_US.utf8' localeCType: 'en_US.utf8' secret: name: knoe-db-user postInitTemplateSQL: - CREATE EXTENSION IF NOT EXISTS pg_stat_statements; postInitSQL: - DO $do$ BEGIN IF NOT EXISTS (SELECT FROM pg_roles WHERE rolname = 'knoe') THEN CREATE ROLE knoe LOGIN NOSUPERUSER NOCREATEDB NOCREATEROLE INHERIT; END IF; END $do$; - DO $do$ DECLARE owner_password text; BEGIN SELECT rolpassword INTO owner_password FROM pg_authid WHERE rolname = 'knoe'; IF owner_password IS NOT NULL THEN EXECUTE format('ALTER ROLE knoe PASSWORD %L', owner_password); END IF; END $do$; - DO $do$ BEGIN IF NOT EXISTS (SELECT FROM pg_roles WHERE rolname = 'knoe_catalog_executor') THEN CREATE ROLE knoe_catalog_executor NOLOGIN; END IF; END $do$; - CREATE SCHEMA IF NOT EXISTS knoe AUTHORIZATION knoe; - ALTER SCHEMA knoe OWNER TO knoe; - REVOKE ALL ON SCHEMA knoe FROM PUBLIC; - ALTER ROLE knoe SET search_path TO knoe, public; - CREATE EXTENSION IF NOT EXISTS pg_tde SCHEMA knoe; - CREATE EXTENSION IF NOT EXISTS pgcrypto SCHEMA knoe; - CREATE EXTENSION IF NOT EXISTS postgis SCHEMA knoe; - CREATE EXTENSION IF NOT EXISTS postgis_topology; - ALTER SCHEMA topology OWNER TO knoe; - CREATE EXTENSION IF NOT EXISTS vector SCHEMA knoe; - CREATE EXTENSION IF NOT EXISTS tds_fdw SCHEMA knoe; - GRANT USAGE ON SCHEMA knoe TO knoe; - GRANT EXECUTE ON ALL FUNCTIONS IN SCHEMA knoe TO knoe; - GRANT USAGE ON SCHEMA knoe TO knoe_catalog_executor; - GRANT EXECUTE ON ALL FUNCTIONS IN SCHEMA knoe TO knoe_catalog_executor; - ALTER DEFAULT PRIVILEGES FOR ROLE knoe IN SCHEMA knoe GRANT EXECUTE ON FUNCTIONS TO knoe_catalog_executor; - GRANT EXECUTE ON ALL FUNCTIONS IN SCHEMA topology TO knoe; - CREATE SCHEMA IF NOT EXISTS storage; - CREATE SCHEMA IF NOT EXISTS graphql_public; - DO $do$ BEGIN IF NOT EXISTS (SELECT FROM pg_roles WHERE rolname = 'anon') THEN CREATE ROLE anon NOLOGIN; END IF; END $do$; - DO $do$ BEGIN IF NOT EXISTS (SELECT FROM pg_roles WHERE rolname = 'authenticator') THEN CREATE ROLE authenticator LOGIN; END IF; END $do$; - GRANT USAGE ON SCHEMA public TO anon; - GRANT USAGE ON SCHEMA storage TO anon; - GRANT USAGE ON SCHEMA graphql_public TO anon; - GRANT anon TO authenticator; # demo schema for guest read-only access (evolves over time) - CREATE SCHEMA IF NOT EXISTS demo; - DO $do$ BEGIN IF NOT EXISTS (SELECT FROM pg_roles WHERE rolname = 'guest') THEN CREATE ROLE guest NOLOGIN; END IF; END $do$; - GRANT USAGE ON SCHEMA demo TO guest; - ALTER DEFAULT PRIVILEGES IN SCHEMA demo GRANT SELECT ON TABLES TO guest; # knoe.user — identity registry (Knoey Users) - CREATE TABLE IF NOT EXISTS knoe.user (id SERIAL PRIMARY KEY, username TEXT NOT NULL UNIQUE, realm TEXT NOT NULL DEFAULT 'PROLE.LOCAL', email TEXT, display_name TEXT, tenant_realm TEXT, is_realm_admin BOOLEAN DEFAULT false, created_at TIMESTAMPTZ DEFAULT now(), updated_at TIMESTAMPTZ DEFAULT now()); - CREATE TABLE IF NOT EXISTS knoe.user_role (user_id INT NOT NULL REFERENCES knoe.user(id) ON DELETE CASCADE, role TEXT NOT NULL, granted_at TIMESTAMPTZ DEFAULT now(), PRIMARY KEY (user_id, role)); - GRANT SELECT, INSERT, UPDATE ON knoe.user TO knoe; - GRANT SELECT, INSERT, UPDATE ON knoe.user_role TO knoe; - GRANT USAGE, SELECT ON SEQUENCE knoe.user_id_seq TO knoe; managed: roles: - name: admin ensure: present login: true superuser: true comment: "Admin principal — full cluster database access" - name: guest ensure: present login: true superuser: false comment: "Guest principal — read-only access to demo schema" - name: developer ensure: present login: false superuser: false comment: "Developer group role — granted to knoe-system user accounts" resources: requests: cpu: "100m" memory: "128Mi" limits: cpu: "500m" memory: "512Mi" enableSuperuserAccess: true storage: size: 50Gi pvcTemplate: accessModes: - ReadWriteOnce resources: requests: storage: 50Gi storageClassName: premium-rwo # pd-ssd; 3×50Gi PGDATA + 3×50Gi WAL = 300Gi total (fits 300GB SSD quota) walStorage: size: 50Gi pvcTemplate: accessModes: - ReadWriteOnce resources: requests: storage: 50Gi storageClassName: premium-rwo # pd-ssd; restore to premium-rwo after quota increase (matches PGDATA above) monitoring: enablePodMonitor: true # kube-prometheus-stack (Prometheus Operator) is installed before CNPG — PodMonitor CRD is present