mirror of
https://gitlab.kube.huskypup.net/Scooby/Homelabv4.git
synced 2026-08-21 05:26:49 +00:00
Scooby Husky
a095c27500
Confirmed live against the vcluster.cnpg.io admission webhook: (1) replica.enabled is mutually exclusive with primary/self - they're two different mechanisms (old single-source replica-cluster mode vs the newer distributed-topology model), not composable. (2) Both replica.self and replica.primary must reference names present in THAT cluster's own externalClusters list - including a self-referencing entry, even though it describes the cluster itself. Renamed VPS's 'home-backup' external cluster to 'home' throughout (bootstrap.recovery.source too) so one name consistently satisfies barmanObjectStore, connectionParameters, and the primary reference; added matching self-referencing entries on both sides.
155 lines
5.3 KiB
YAML
155 lines
5.3 KiB
YAML
apiVersion: postgresql.cnpg.io/v1
|
|
kind: Cluster
|
|
metadata:
|
|
name: pg-authentik
|
|
namespace: authentik
|
|
spec:
|
|
imageName: ghcr.io/cloudnative-pg/postgresql:16
|
|
instances: 2
|
|
|
|
# Resource limits to prevent OOM
|
|
resources:
|
|
requests:
|
|
memory: "512Mi"
|
|
cpu: "25m"
|
|
limits:
|
|
memory: "2Gi"
|
|
cpu: "250m"
|
|
|
|
# Spread replicas across different nodes
|
|
affinity:
|
|
topologyKey: kubernetes.io/hostname
|
|
|
|
storage:
|
|
size: 5Gi
|
|
storageClass: rook-ceph-block
|
|
|
|
primaryUpdateStrategy: unsupervised
|
|
|
|
# PostgreSQL configuration for better performance
|
|
postgresql:
|
|
parameters:
|
|
max_connections: "200"
|
|
shared_buffers: "512MB"
|
|
effective_cache_size: "1536MB"
|
|
maintenance_work_mem: "128MB"
|
|
checkpoint_completion_target: "0.9"
|
|
wal_buffers: "16MB"
|
|
default_statistics_target: "100"
|
|
random_page_cost: "1.1"
|
|
effective_io_concurrency: "200"
|
|
work_mem: "2621kB"
|
|
min_wal_size: "1GB"
|
|
max_wal_size: "4GB"
|
|
|
|
bootstrap:
|
|
initdb:
|
|
database: app
|
|
owner: app
|
|
|
|
# Backup to VPS MinIO - RE-ENABLED 2026-08-18. Real pod-egress routing to
|
|
# the VPS now exists (netbird-egress DaemonSet, hostNetwork + per-node
|
|
# route into 100.108.0.0/16 - see infrastructure/netbird/manifests/
|
|
# egress-daemonset.yaml). Endpoint changed from the NodePort
|
|
# (vps-minio.netbird.internal:30900 - never resolvable anyway, Netbird has
|
|
# no DNS configured, and separately blocked by Netbird's own ACL model,
|
|
# which only permits *established* forwarded connections through a peer,
|
|
# never new ones) to a locally-terminated socat forward on the VPS host
|
|
# itself (100.108.113.41:9000 - see minio-forward.service on the VPS),
|
|
# mirroring the pattern that already worked for the CrowdSec CAPI proxy.
|
|
backup:
|
|
barmanObjectStore:
|
|
destinationPath: s3://cnpg-backups/pg-authentik
|
|
endpointURL: http://100.108.113.41:9000
|
|
s3Credentials:
|
|
accessKeyId:
|
|
name: vps-minio-secret
|
|
key: accesskey
|
|
secretAccessKey:
|
|
name: vps-minio-secret
|
|
key: secretkey
|
|
wal:
|
|
compression: gzip
|
|
maxParallel: 2
|
|
retentionPolicy: "30d"
|
|
|
|
monitoring:
|
|
enablePodMonitor: true
|
|
|
|
# Multi-site active failover pilot (see
|
|
# /home/scooby/.claude/plans/jiggly-snacking-iverson.md) - streaming
|
|
# replication to/from the VPS's pg-authentik cluster, alongside (not
|
|
# replacing) the barmanObjectStore backup above.
|
|
#
|
|
# Auth: reuses CNPG's own generated streaming_replica client cert
|
|
# (CN=streaming_replica, issued by the VPS's own pg-authentik CA) -
|
|
# copied here manually as pg-authentik-vps-{ca,replication} (kubectl,
|
|
# not git - same pattern as every other cross-cluster secret tonight).
|
|
# This is the exact credential CNPG's own pg_hba.conf already trusts
|
|
# for streaming replication, nothing new to provision.
|
|
#
|
|
# sslmode: verify-ca (not verify-full) - the VPS's server cert was
|
|
# issued for its in-cluster DNS names, not for the NodePort IP address
|
|
# (100.108.113.41) home actually dials; verify-ca still validates the
|
|
# cert chain/CA trust and encrypts the connection, just skips hostname
|
|
# matching.
|
|
#
|
|
# Reachable via 100.108.113.41 (VPS's Netbird IP) - home reaching OUT
|
|
# to the VPS already works today via the netbird-egress DaemonSet's
|
|
# route (same path used for MinIO/CrowdSec backups all session) - no
|
|
# UniFi port-forward needed for this direction, only the reverse
|
|
# (VPS/witness reaching INTO home) needed that.
|
|
# CNPG's distributed-topology validation requires both replica.self and
|
|
# replica.primary to reference names present in THIS cluster's OWN
|
|
# externalClusters list - including a self-referencing entry (confirmed
|
|
# live: "External cluster home not found" until one was added, even
|
|
# though "home" is this very cluster). The "home" entry's
|
|
# connectionParameters point at its own local -rw service - never
|
|
# actually dialed while primary: home (that's this cluster), it only
|
|
# exists to satisfy the name-reference validation.
|
|
externalClusters:
|
|
- name: home
|
|
connectionParameters:
|
|
host: pg-authentik-rw
|
|
port: "5432"
|
|
dbname: app
|
|
user: streaming_replica
|
|
sslmode: verify-ca
|
|
sslCert:
|
|
name: pg-authentik-replication
|
|
key: tls.crt
|
|
sslKey:
|
|
name: pg-authentik-replication
|
|
key: tls.key
|
|
sslRootCert:
|
|
name: pg-authentik-ca
|
|
key: ca.crt
|
|
- name: vps
|
|
connectionParameters:
|
|
host: 100.108.113.41
|
|
port: "32433"
|
|
dbname: app
|
|
user: streaming_replica
|
|
sslmode: verify-ca
|
|
sslCert:
|
|
name: pg-authentik-vps-replication
|
|
key: tls.crt
|
|
sslKey:
|
|
name: pg-authentik-vps-replication
|
|
key: tls.key
|
|
sslRootCert:
|
|
name: pg-authentik-vps-ca
|
|
key: ca.crt
|
|
|
|
# Distributed topology: both sides agree home is primary today. Failover
|
|
# flips the VPS's replica.primary to "vps" (+ promotion token) - see the
|
|
# plan doc's failover-watcher section. Failback is the same in reverse,
|
|
# deliberately manual. No replica.enabled here - that flag belongs to
|
|
# CNPG's older single-source replica-cluster mode and is mutually
|
|
# exclusive with primary/self (confirmed live: "replica mode enabled is
|
|
# not compatible with the primary field").
|
|
replica:
|
|
self: home
|
|
primary: home
|
|
|