gitea_admin/Homelabv4
1
0
Fork 0
mirror of https://gitlab.kube.huskypup.net/Scooby/Homelabv4.git synced 2026-08-23 12:56:46 +00:00
Code Issues Packages Projects Releases Wiki Activity

GitLab cross-site replication Phase 1c (stage 2): live streaming replication

Browse Source 
Adds externalClusters connectionParameters + replica.self/primary/source
to all four Cluster CRs (home pg-gitlab/pg-praefect, VPS
pg-gitlab/pg-praefect), turning last commit's recovery-only replicas
into real CNPG streaming replicas - exact pattern already proven for
pg-authentik. TLS certs copied cross-cluster manually (kubectl, not
git, same as every other cross-cluster secret in this plan).

Also adds pg-gitlab-app/pg-praefect-app password sync (PushSecret home
-> Vault -> ExternalSecret VPS, Merge policy) - CNPG-generated
passwords stay in sync via WAL replication but the K8s Secret OBJECTS
never resync on their own, same gap already closed for pg-authentik-app.

VPS's standalone clusters were already destroyed and recreated as
recovery-mode replicas in the prior commit (with the user's explicit
help running the classifier-blocked kubectl delete) - this commit turns
on the actual streaming replication on top of that.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
Scooby Husky
2026-08-22 13:31:09 -05:00
co-authored by Claude Sonnet 5
parent 83c06a888d
commit 4a0de188df
6 changed files with 284 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
apps/gitlab/manifests/ha-postgres-app-pushsecret.yaml
+50
View File
@@ -0,0 +1,50 @@
# GitLab cross-site replication (see
# /home/scooby/.claude/plans/jiggly-snacking-iverson.md) - same pattern
# and same reasoning as
# infrastructure/authentik/manifests/ha-postgres-app-pushsecret.yaml:
# pg-gitlab-app/pg-praefect-app are CNPG-generated, not Vault-native -
# each cluster independently generated its own random `app` role
# password at bootstrap time. Streaming replication keeps the two
# clusters' actual live passwords in sync (WAL includes role/password
# changes), but the two clusters' K8s Secret OBJECTS never resync on
# their own - this closes that gap, self-healing on refreshInterval
# instead of a one-time fix that goes stale on the next rotation.
apiVersion: external-secrets.io/v1alpha1
kind: PushSecret
metadata:
name: pg-gitlab-app-to-vps
namespace: gitlab
spec:
refreshInterval: 5m
secretStoreRefs:
- name: vault-backend
kind: ClusterSecretStore
selector:
secret:
name: pg-gitlab-app
data:
- match:
secretKey: password
remoteRef:
remoteKey: vps/pg-gitlab-app
property: password
---
apiVersion: external-secrets.io/v1alpha1
kind: PushSecret
metadata:
name: pg-praefect-app-to-vps
namespace: gitlab
spec:
refreshInterval: 5m
secretStoreRefs:
- name: vault-backend
kind: ClusterSecretStore
selector:
secret:
name: pg-praefect-app
data:
- match:
secretKey: password
remoteRef:
remoteKey: vps/pg-praefect-app
property: password