gitea_admin/Homelabv4
1
0
Fork 0
mirror of https://gitlab.kube.huskypup.net/Scooby/Homelabv4.git synced 2026-08-23 12:56:46 +00:00
Code Issues Packages Projects Releases Wiki Activity

GitLab cross-site replication Phase 1c (stage 2): live streaming replication

Browse Source 
Adds externalClusters connectionParameters + replica.self/primary/source
to all four Cluster CRs (home pg-gitlab/pg-praefect, VPS
pg-gitlab/pg-praefect), turning last commit's recovery-only replicas
into real CNPG streaming replicas - exact pattern already proven for
pg-authentik. TLS certs copied cross-cluster manually (kubectl, not
git, same as every other cross-cluster secret in this plan).

Also adds pg-gitlab-app/pg-praefect-app password sync (PushSecret home
-> Vault -> ExternalSecret VPS, Merge policy) - CNPG-generated
passwords stay in sync via WAL replication but the K8s Secret OBJECTS
never resync on their own, same gap already closed for pg-authentik-app.

VPS's standalone clusters were already destroyed and recreated as
recovery-mode replicas in the prior commit (with the user's explicit
help running the classifier-blocked kubectl delete) - this commit turns
on the actual streaming replication on top of that.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
Scooby Husky
2026-08-22 13:31:09 -05:00
co-authored by Claude Sonnet 5
parent 83c06a888d
commit 4a0de188df
6 changed files with 284 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
infrastructure/vps-standby/gitlab/manifests/ha-postgres-app-externalsecret.yaml
+45
View File
@@ -0,0 +1,45 @@
# GitLab cross-site replication - VPS's half of the Vault pipeline
# (apps/gitlab/manifests/ha-postgres-app-pushsecret.yaml has home's half).
# Pulls the authoritative app-role passwords back down here.
#
# Merge (not Owner/Replace): only overwrites the `password` key, leaving
# CNPG's own generated host/dbname/username fields intact - those are
# correctly LOCAL to each site (this secret's `host` key points at the
# VPS's own local -rw service, which CNPG itself still needs internally).
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
name: pg-gitlab-app-password
namespace: gitlab
spec:
refreshInterval: 5m
secretStoreRef:
name: vault-backend
kind: ClusterSecretStore
target:
name: pg-gitlab-app
creationPolicy: Merge
data:
- secretKey: password
remoteRef:
key: vps/pg-gitlab-app
property: password
---
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
name: pg-praefect-app-password
namespace: gitlab
spec:
refreshInterval: 5m
secretStoreRef:
name: vault-backend
kind: ClusterSecretStore
target:
name: pg-praefect-app
creationPolicy: Merge
data:
- secretKey: password
remoteRef:
key: vps/pg-praefect-app
property: password