prole/deploy/gcp/gke/knoe-db.yaml

apiVersion: postgresql.cnpg.io/v1
kind: Cluster
metadata:
  name: knoe-db
  namespace: ecosystem-0
spec:
  instances: 3
  # Image pulled from GCP Artifact Registry — set ARTIFACT_REGISTRY in conf/prod/gcp.cfg
  # e.g. us-central1-docker.pkg.dev/<project>/prole/knoe-db:18-140
  imageName: "${ARTIFACT_REGISTRY}/knoe-db:18-140"
  postgresUID: 100
  postgresGID: 101
  maxSyncReplicas: 1

  affinity:
    enablePodAntiAffinity: true
    podAntiAffinityType: preferred
    topologyKey: topology.kubernetes.io/zone   # GKE zone-aware spreading

  postgresql:
    parameters:
      shared_buffers: 256MB
      pg_stat_statements.max: '10000'
      pg_stat_statements.track: all
    shared_preload_libraries:
      - pg_stat_statements
      - pg_tde
    pg_hba:
      - local all postgres trust
      - local all prole scram-sha-256
      - host all postgres all scram-sha-256
      - host prole knoe-db all scram-sha-256
      - host all all all scram-sha-256
      - hostssl prole knoe-db all scram-sha-256

  bootstrap:
    initdb:
      database: knoe-db
      owner: prole
      localeCollate: 'en_US.utf8'
      localeCType: 'en_US.utf8'
      secret:
        name: knoe-db-user
      postInitTemplateSQL:
        - CREATE EXTENSION IF NOT EXISTS pg_stat_statements;
      postInitSQL:
        - CREATE EXTENSION IF NOT EXISTS pg_tde;
        - CREATE EXTENSION IF NOT EXISTS pgcrypto;
        - GRANT EXECUTE ON ALL FUNCTIONS IN SCHEMA public TO prole;
        - CREATE EXTENSION IF NOT EXISTS postgis;
        - CREATE EXTENSION IF NOT EXISTS postgis_topology;
        - CREATE EXTENSION IF NOT EXISTS vector;
        - CREATE EXTENSION IF NOT EXISTS tds_fdw;
        - GRANT EXECUTE ON ALL FUNCTIONS IN SCHEMA public TO prole;
        - GRANT EXECUTE ON ALL FUNCTIONS IN SCHEMA topology TO prole;
        - CREATE SCHEMA IF NOT EXISTS storage;
        - CREATE SCHEMA IF NOT EXISTS graphql_public;
        - CREATE ROLE anon NOLOGIN;
        - CREATE ROLE authenticator LOGIN;
        - GRANT USAGE ON SCHEMA public TO anon;
        - GRANT USAGE ON SCHEMA storage TO anon;
        - GRANT USAGE ON SCHEMA graphql_public TO anon;
        - GRANT anon TO authenticator;
        # demo schema for guest read-only access (evolves over time)
        - CREATE SCHEMA IF NOT EXISTS demo;
        - GRANT USAGE ON SCHEMA demo TO guest;
        - ALTER DEFAULT PRIVILEGES IN SCHEMA demo GRANT SELECT ON TABLES TO guest;

  managed:
    roles:
      - name: admin
        ensure: present
        login: true
        superuser: true
        comment: "Admin principal — full cluster database access"
      - name: guest
        ensure: present
        login: true
        superuser: false
        comment: "Guest principal — read-only access to demo schema"
      - name: developer
        ensure: present
        login: false
        superuser: false
        comment: "Developer group role — granted to knoe-system user accounts"

  certificates:
    serverTLSSecret: knoe-db-tls
    serverCASecret: knoe-db-ca

  enableSuperuserAccess: true

  # GCS backup via Workload Identity — see knoe-db-backup-gcs.yaml
  backup:
    barmanObjectStore:
      destinationPath: "gs://knoe-0-backups/"
      googleCredentials:
        applicationCredentials:
          name: ""   # empty = Workload Identity; no static key needed
      wal:
        compression: gzip
      data:
        compression: gzip
    retentionPolicy: "14d"

  storage:
    size: 100Gi
    pvcTemplate:
      accessModes:
        - ReadWriteOnce
      resources:
        requests:
          storage: 100Gi
      storageClassName: premium-rwo   # GCP SSD persistent disk (pd-ssd)

  walStorage:
    size: 20Gi
    pvcTemplate:
      accessModes:
        - ReadWriteOnce
      resources:
        requests:
          storage: 20Gi
      storageClassName: premium-rwo

  monitoring:
    enablePodMonitor: true   # GKE managed Prometheus