# External TCP LoadBalancer for direct psql access to the CNPG primary.
#
# Hostname: pg.0.knoe.dev (DNS A record pointed manually at Namecheap to the
# IP allocated by this Service).
#
# Auth model:
#   - Phase 1 (current): per-engineer postgres roles with strong passwords +
#     VALID UNTIL 30d. SCRAM-SHA-256 over TLS (hostssl in pg_hba).
#   - Phase 2 (queued):  PostgreSQL 18 OAUTHBEARER with a custom validator
#     library (knoe_oauth.so) that maps Google email -> postgres role.
#     Connection target stays the same; only the credential issuance changes.
#
# TLS: CNPG issues the server cert and auto-rotates it. The cluster spec's
# `certificates.serverAltDnsNames` is extended with `pg.0.knoe.dev` so the
# auto-issued cert validates externally. Engineers download the CNPG-issued
# CA cert (kubectl get secret knoe-db-ca -n knoe-db-0 -o jsonpath='{.data.ca\.crt}' | base64 -d)
# and use `sslmode=verify-full sslrootcert=<ca.crt>`.
#
# Source-IP allowlist: open today (loadBalancerSourceRanges: 0.0.0.0/0). Tighten
# to known engineer/CI IP ranges in a follow-up; SCRAM-SHA-256 is brute-force-
# resistant so the open window is acceptable for the Phase 1 horizon (~30d).
#
# Phase 1 verification (after DNS A record is up):
#   psql "host=pg.0.knoe.dev port=5432 user=chrisfu dbname=postgres sslmode=verify-full sslrootcert=$HOME/.knoe/knoe-db-ca.crt"
---
apiVersion: v1
kind: Service
metadata:
  name: knoe-db-rw-elb
  namespace: knoe-db-0
  labels:
    app.kubernetes.io/name: knoe-db
    app.kubernetes.io/component: postgres-external
    app.kubernetes.io/managed-by: knoe-installer
  annotations:
    # GKE L4 Regional Backend Service (newer LB type; required for SCTP and
    # for some traffic-policy combinations; allocates faster than the legacy
    # network LB on this cluster).
    cloud.google.com/l4-rbs: "enabled"
spec:
  type: LoadBalancer
  # `Local` preserves the client's real source IP at the postgres backend
  # (vs `Cluster` which SNATs to the receiving node IP, making external
  # clients look like they live in the cluster's 10.0.0.0/8 range and bypass
  # the `hostnossl reject` rule in pg_hba).
  externalTrafficPolicy: Local
  loadBalancerSourceRanges:
    # Phase 1: open. Tighten in a follow-up once we have an engineer IP allowlist
    # or a corp VPN egress range.
    - 0.0.0.0/0
  selector:
    cnpg.io/cluster: knoe-db
    cnpg.io/instanceRole: primary
  ports:
    - name: psql
      port: 5432
      targetPort: 5432
      protocol: TCP