mirror of
https://gitlab.kube.huskypup.net/Scooby/Homelabv4.git
synced 2026-08-21 05:26:49 +00:00
Scooby HuskyandClaude Sonnet 5
2c8d29c51f
Discovered while debugging pg-n8n's recurring 'Instance Status Extraction Error': the root cause is the same missing pod-egress route to the Netbird mesh found tonight while fixing CrowdSec - continuousArchiving kept failing to connect to vps-minio.netbird.internal, and CNPG correctly holds Ready=False while archiving is broken (a real condition, not cosmetic). That's what was driving these three apps' ArgoCD health flapping. No node in the cluster has any route into 100.108.0.0/16 for pod-originated traffic - the per-namespace netbird 'router' pods (gitlab, vault, argocd, etc.) are inbound-only infrastructure, not egress gateways. gitlab's own CNPG backup is unaffected (points at a local in-cluster MinIO, not the VPS). Commented out rather than deleted - re-enable once real pod-egress routing exists, tracked as a separate task. No data loss: this is WAL archiving/backup, not the live database. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
77 lines
2.0 KiB
YAML
77 lines
2.0 KiB
YAML
apiVersion: postgresql.cnpg.io/v1
|
|
kind: Cluster
|
|
metadata:
|
|
name: pg-authentik
|
|
namespace: authentik
|
|
spec:
|
|
imageName: ghcr.io/cloudnative-pg/postgresql:16
|
|
instances: 2
|
|
|
|
# Resource limits to prevent OOM
|
|
resources:
|
|
requests:
|
|
memory: "512Mi"
|
|
cpu: "25m"
|
|
limits:
|
|
memory: "2Gi"
|
|
cpu: "250m"
|
|
|
|
# Spread replicas across different nodes
|
|
affinity:
|
|
topologyKey: kubernetes.io/hostname
|
|
|
|
storage:
|
|
size: 5Gi
|
|
storageClass: rook-ceph-block
|
|
|
|
primaryUpdateStrategy: unsupervised
|
|
|
|
# PostgreSQL configuration for better performance
|
|
postgresql:
|
|
parameters:
|
|
max_connections: "200"
|
|
shared_buffers: "512MB"
|
|
effective_cache_size: "1536MB"
|
|
maintenance_work_mem: "128MB"
|
|
checkpoint_completion_target: "0.9"
|
|
wal_buffers: "16MB"
|
|
default_statistics_target: "100"
|
|
random_page_cost: "1.1"
|
|
effective_io_concurrency: "200"
|
|
work_mem: "2621kB"
|
|
min_wal_size: "1GB"
|
|
max_wal_size: "4GB"
|
|
|
|
bootstrap:
|
|
initdb:
|
|
database: app
|
|
owner: app
|
|
|
|
# Backup to VPS MinIO - DISABLED 2026-08-17. No node in the cluster has
|
|
# any route into the Netbird mesh for pod-originated (egress) traffic;
|
|
# the per-namespace netbird "router" pods are inbound-only infrastructure.
|
|
# continuousArchiving kept failing to connect to vps-minio.netbird.internal,
|
|
# which held Ready=False permanently (real condition, not cosmetic).
|
|
# Re-enable once real pod-egress routing to the VPS exists (tracked as a
|
|
# separate task) - no other change needed, this block is otherwise
|
|
# complete/correct.
|
|
# backup:
|
|
# barmanObjectStore:
|
|
# destinationPath: s3://cnpg-backups/pg-authentik
|
|
# endpointURL: http://vps-minio.netbird.internal:30900
|
|
# s3Credentials:
|
|
# accessKeyId:
|
|
# name: vps-minio-secret
|
|
# key: accesskey
|
|
# secretAccessKey:
|
|
# name: vps-minio-secret
|
|
# key: secretkey
|
|
# wal:
|
|
# compression: gzip
|
|
# maxParallel: 2
|
|
# retentionPolicy: "30d"
|
|
|
|
monitoring:
|
|
enablePodMonitor: true
|
|
|