History

Haitao Pan dffcda8063 feat(gitops): switch postgresql tls to acme issuers		2026-04-04 10:38:10 +08:00
..
helmrelease.yaml	refactor(gitops): consolidate database services and prune legacy assets	2026-04-03 15:52:23 +08:00
initdb-configmap.yaml	refactor(gitops): consolidate database services and prune legacy assets	2026-04-03 15:52:23 +08:00
kustomization.yaml	refactor(gitops): consolidate database services and prune legacy assets	2026-04-03 15:52:23 +08:00
oci-repository.yaml	fix(gitops): point postgresql chart to published tag	2026-04-04 06:54:44 +08:00
README.md	feat(gitops): switch postgresql tls to acme issuers	2026-04-04 10:38:10 +08:00
stunnel-client-configmap.yaml	refactor(gitops): consolidate database services and prune legacy assets	2026-04-03 15:52:23 +08:00
stunnel-client-deployment.yaml	fix(gitops): align postgresql ghcr paths	2026-04-03 21:19:12 +08:00
stunnel-client-service.yaml	refactor(gitops): consolidate database services and prune legacy assets	2026-04-03 15:52:23 +08:00
stunnel-server-configmap.yaml	refactor(gitops): consolidate database services and prune legacy assets	2026-04-03 15:52:23 +08:00
stunnel-server-deployment.yaml	fix(database): align stunnel secret name with tls sync	2026-04-04 07:49:44 +08:00
stunnel-server-service.yaml	refactor(gitops): consolidate database services and prune legacy assets	2026-04-03 15:52:23 +08:00
values.yaml	fix(gitops): use postgresql auth secret password key	2026-04-04 07:13:22 +08:00

README.md

PostgreSQL GitOps Bootstrap

This stack uses ExternalSecrets to materialize runtime credentials from Vault. The GitOps manifests intentionally do not store secret values.

Vault paths expected by this stack

postgresql.svc.plus
- POSTGRES_USER
- POSTGRES_PASSWORD
- GHCR_USERNAME
- GHCR_TOKEN

Bootstrap rule

Before or during initial reconciliation, the Vault key postgresql.svc.plus must be seeded with the runtime credentials expected by the manifests in this directory. Otherwise the ExternalSecrets controller will report Secret does not exist.

Helper

Use scripts/seed-vault-postgresql.sh from a trusted admin shell to write the expected Vault keys from local environment variables or existing K8s Secrets. The ingress domain is postgresql-prod.svc.plus for this prod cluster. TLS for postgresql-tls is now owned directly by cert-manager in both the platform and database namespaces, so stunnel-server can mount the database-local Secret without any cross-namespace sync job.

Default certificate issuance uses ACME HTTP-01 through the caddy ingress class. A DNS-01 Cloudflare issuer is predeclared for future wildcard and additional subdomain certificates, and selfSigned remains available for internal temporary or fallback use.