mirror of
https://gitlab.kube.huskypup.net/Scooby/Homelabv4.git
synced 2026-08-23 12:56:46 +00:00
Scooby HuskyandClaude Sonnet 5
4a0de188df
Adds externalClusters connectionParameters + replica.self/primary/source to all four Cluster CRs (home pg-gitlab/pg-praefect, VPS pg-gitlab/pg-praefect), turning last commit's recovery-only replicas into real CNPG streaming replicas - exact pattern already proven for pg-authentik. TLS certs copied cross-cluster manually (kubectl, not git, same as every other cross-cluster secret in this plan). Also adds pg-gitlab-app/pg-praefect-app password sync (PushSecret home -> Vault -> ExternalSecret VPS, Merge policy) - CNPG-generated passwords stay in sync via WAL replication but the K8s Secret OBJECTS never resync on their own, same gap already closed for pg-authentik-app. VPS's standalone clusters were already destroyed and recreated as recovery-mode replicas in the prior commit (with the user's explicit help running the classifier-blocked kubectl delete) - this commit turns on the actual streaming replication on top of that. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
46 lines
1.2 KiB
YAML
46 lines
1.2 KiB
YAML
# GitLab cross-site replication - VPS's half of the Vault pipeline
|
|
# (apps/gitlab/manifests/ha-postgres-app-pushsecret.yaml has home's half).
|
|
# Pulls the authoritative app-role passwords back down here.
|
|
#
|
|
# Merge (not Owner/Replace): only overwrites the `password` key, leaving
|
|
# CNPG's own generated host/dbname/username fields intact - those are
|
|
# correctly LOCAL to each site (this secret's `host` key points at the
|
|
# VPS's own local -rw service, which CNPG itself still needs internally).
|
|
apiVersion: external-secrets.io/v1
|
|
kind: ExternalSecret
|
|
metadata:
|
|
name: pg-gitlab-app-password
|
|
namespace: gitlab
|
|
spec:
|
|
refreshInterval: 5m
|
|
secretStoreRef:
|
|
name: vault-backend
|
|
kind: ClusterSecretStore
|
|
target:
|
|
name: pg-gitlab-app
|
|
creationPolicy: Merge
|
|
data:
|
|
- secretKey: password
|
|
remoteRef:
|
|
key: vps/pg-gitlab-app
|
|
property: password
|
|
---
|
|
apiVersion: external-secrets.io/v1
|
|
kind: ExternalSecret
|
|
metadata:
|
|
name: pg-praefect-app-password
|
|
namespace: gitlab
|
|
spec:
|
|
refreshInterval: 5m
|
|
secretStoreRef:
|
|
name: vault-backend
|
|
kind: ClusterSecretStore
|
|
target:
|
|
name: pg-praefect-app
|
|
creationPolicy: Merge
|
|
data:
|
|
- secretKey: password
|
|
remoteRef:
|
|
key: vps/pg-praefect-app
|
|
property: password
|