mirror of
https://gitlab.kube.huskypup.net/Scooby/Homelabv4.git
synced 2026-08-23 12:56:46 +00:00
Scooby HuskyandClaude Sonnet 5
4a0de188df
Adds externalClusters connectionParameters + replica.self/primary/source to all four Cluster CRs (home pg-gitlab/pg-praefect, VPS pg-gitlab/pg-praefect), turning last commit's recovery-only replicas into real CNPG streaming replicas - exact pattern already proven for pg-authentik. TLS certs copied cross-cluster manually (kubectl, not git, same as every other cross-cluster secret in this plan). Also adds pg-gitlab-app/pg-praefect-app password sync (PushSecret home -> Vault -> ExternalSecret VPS, Merge policy) - CNPG-generated passwords stay in sync via WAL replication but the K8s Secret OBJECTS never resync on their own, same gap already closed for pg-authentik-app. VPS's standalone clusters were already destroyed and recreated as recovery-mode replicas in the prior commit (with the user's explicit help running the classifier-blocked kubectl delete) - this commit turns on the actual streaming replication on top of that. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
51 lines
1.5 KiB
YAML
51 lines
1.5 KiB
YAML
# GitLab cross-site replication (see
|
|
# /home/scooby/.claude/plans/jiggly-snacking-iverson.md) - same pattern
|
|
# and same reasoning as
|
|
# infrastructure/authentik/manifests/ha-postgres-app-pushsecret.yaml:
|
|
# pg-gitlab-app/pg-praefect-app are CNPG-generated, not Vault-native -
|
|
# each cluster independently generated its own random `app` role
|
|
# password at bootstrap time. Streaming replication keeps the two
|
|
# clusters' actual live passwords in sync (WAL includes role/password
|
|
# changes), but the two clusters' K8s Secret OBJECTS never resync on
|
|
# their own - this closes that gap, self-healing on refreshInterval
|
|
# instead of a one-time fix that goes stale on the next rotation.
|
|
apiVersion: external-secrets.io/v1alpha1
|
|
kind: PushSecret
|
|
metadata:
|
|
name: pg-gitlab-app-to-vps
|
|
namespace: gitlab
|
|
spec:
|
|
refreshInterval: 5m
|
|
secretStoreRefs:
|
|
- name: vault-backend
|
|
kind: ClusterSecretStore
|
|
selector:
|
|
secret:
|
|
name: pg-gitlab-app
|
|
data:
|
|
- match:
|
|
secretKey: password
|
|
remoteRef:
|
|
remoteKey: vps/pg-gitlab-app
|
|
property: password
|
|
---
|
|
apiVersion: external-secrets.io/v1alpha1
|
|
kind: PushSecret
|
|
metadata:
|
|
name: pg-praefect-app-to-vps
|
|
namespace: gitlab
|
|
spec:
|
|
refreshInterval: 5m
|
|
secretStoreRefs:
|
|
- name: vault-backend
|
|
kind: ClusterSecretStore
|
|
selector:
|
|
secret:
|
|
name: pg-praefect-app
|
|
data:
|
|
- match:
|
|
secretKey: password
|
|
remoteRef:
|
|
remoteKey: vps/pg-praefect-app
|
|
property: password
|