Skip to content

Deploy releases/k8s-manifests 254b048 - #227

Merged
themightychris merged 4 commits into
deploys/k8s-manifestsfrom
releases/k8s-manifests
Sep 28, 2026
Merged

themightychris merged 4 commits into
deploys/k8s-manifestsfrom
releases/k8s-manifests

Conversation

@github-actions

Copy link
Copy Markdown

kubectl diff reports that applying 254b048 will change:

diff -uN /tmp/LIVE-58721552/bitnami.com.v1alpha1.SealedSecret.cloudnative-pg.balancer-db-credentials /tmp/MERGED-2108963127/bitnami.com.v1alpha1.SealedSecret.cloudnative-pg.balancer-db-credentials
--- /tmp/LIVE-58721552/bitnami.com.v1alpha1.SealedSecret.cloudnative-pg.balancer-db-credentials	2026-09-28 20:12:11.845973209 +0000
+++ /tmp/MERGED-2108963127/bitnami.com.v1alpha1.SealedSecret.cloudnative-pg.balancer-db-credentials	2026-09-28 20:12:11.862973142 +0000
@@ -1 +1,14 @@
-{}
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: balancer-db-credentials
+  namespace: cloudnative-pg
+spec:
+  encryptedData:
+    password: AgBcEHUAKYZitDG0dG2GbhGvxXVfjKzPnSa1OEsG+TPEdqfIEp92huTUEQeHPoABZ0MtzlHASkZiU4xvMdUoGlaMKqP+XWS2Ks8VKXyLvsL5Xdh8yDBhezgi13hN5ELu9fx8kkbds3bYhsz8+WPOu6vUpSpehOQ+Qfdy5LvA+FZUL93Ks0eZGxgYwSBzPLc0m70QiQ7ocyqpExSoFXYvIDWo6UGk1FHr/8nSgA5gA5XrrjZT+fD4lRzWSxKDEnEHGZPXQtvvLizg0G7rD4aoemySLvDlPDlMQ/r7WAXlMHpxgFJsM/TRGH8R7eyhtTfb+u0NmkNUvDV5yCEosEG17gGTOyIEDxxGTS5/kttAUthBoqq+3ugOiZDr0QpLNCregie9Fu12E7E32sUYNH+ITj7wh61N4LM6/GlCE3cFnEB07btbQeaB54/aVJt0rDcIU5Kg/chGhg3g/Wt8CHi0s2LCxjIzBcPKfD4T1TM+84h5tnF+H5k2PqsjtUR+kbrXtHA0E7noHzcrUYY3bK7dAZQlj/bzYtA9gwFzMsR+94wrfucRnu81wjHBn4altMkzzAStDfIRsl2m+j44V4U94gkrUtoUjp/Ffd5TIRjb3ymioRrlsKdjfdSFOdcybYI/rF7b9WoH5fjDoNS7s6qdszA93HYj0rdnghqW3m7ql8Rylx0VwRJn4yTEJ4YIs2/CyJiKF5VcwzgCbt78SqF8CtIkZNfwA8TykeSkyATjyna7ZqKAdS1tG0Qm
+    username: AgBmC/873NnIntMIFo6VKrcAjsbKAecDwJpbGyRZ5bRwTQxbGWTwm3PTOL5hoMbINlEdLp8/T+1wCxaVHlA6GrMjmVqUIAxOuOLlKNeGH5uDVJ6xu7AD0MGOgyqYPqiKwMpJz9r8aYEmKJ1WlX/BKgYvgsOZ9IuNaopqxvGYQAyGh2du1aRicXveYcfnLcomIWjNpv+KV5avtg0B1MF5aZIVAOeVBqCuhQnyK3WjzB6YytSR1s4igCqx2C8n7zm4JKdHBYCw9faVsF8aKfc5cQqomdvOesnCmKy/bZWG6M+9Zx/3iO/HCsjiQZutDiME2f0G8ff0wzW3/OL/4FRfQpDarqUfT5FXrsEYpc7Rj/pok8ZbqdHo+2RHrh0nwMG9gZShhyXVsq2kCyh61DsEZQRZpJsdKz24j3Sf7qzD1XhUPZKZT/lKC7lcdFgKDNSY0bcUgv+/GDzkOLdkJE14fnS4dpcGe3fNGC6JJru8VPFXjQ32zWGvpt8gVFOOlb8hqQmHY52/Di9SvHJ/r5bHuiP23Ih/O6bAVWRgk91BbmNe9QAyMN0Q1LgYzjjIsnLjQsImmzTGGjGH4yLcZa3HKXGGD5GR1RfERVfIixgX/tRlS1/essRZxQrpdJou1yhY7+BFMDgHZCEMK36Xb/B4fIAnAx4KlhKGbjbJCicJkJVTEx6WWFGDifAnmeRApPE0S5PQiYYutUnhPw==
+  template:
+    metadata:
+      name: balancer-db-credentials
+      namespace: cloudnative-pg
+    type: kubernetes.io/basic-auth
diff -uN /tmp/LIVE-58721552/postgresql.cnpg.io.v1.Cluster.cloudnative-pg.shared-cluster /tmp/MERGED-2108963127/postgresql.cnpg.io.v1.Cluster.cloudnative-pg.shared-cluster
--- /tmp/LIVE-58721552/postgresql.cnpg.io.v1.Cluster.cloudnative-pg.shared-cluster	2026-09-28 20:12:11.849973193 +0000
+++ /tmp/MERGED-2108963127/postgresql.cnpg.io.v1.Cluster.cloudnative-pg.shared-cluster	2026-09-28 20:12:11.865973131 +0000
@@ -19,6 +19,15 @@
   imageName: ghcr.io/cloudnative-pg/postgis:18-3-system-trixie
   instances: 2
   logLevel: info
+  managed:
+    roles:
+    - connectionLimit: -1
+      ensure: present
+      inherit: true
+      login: true
+      name: balancer
+      passwordSecret:
+        name: balancer-db-credentials
   maxSyncReplicas: 0
   minSyncReplicas: 0
   monitoring:
diff -uN /tmp/LIVE-58721552/postgresql.cnpg.io.v1.Database.cloudnative-pg.balancer /tmp/MERGED-2108963127/postgresql.cnpg.io.v1.Database.cloudnative-pg.balancer
--- /tmp/LIVE-58721552/postgresql.cnpg.io.v1.Database.cloudnative-pg.balancer	2026-09-28 20:12:11.849973193 +0000
+++ /tmp/MERGED-2108963127/postgresql.cnpg.io.v1.Database.cloudnative-pg.balancer	2026-09-28 20:12:11.865973131 +0000
@@ -1 +1,15 @@
-{}
+apiVersion: postgresql.cnpg.io/v1
+kind: Database
+metadata:
+  name: balancer
+  namespace: cloudnative-pg
+spec:
+  cluster:
+    name: shared-cluster
+  databaseReclaimPolicy: retain
+  ensure: present
+  extensions:
+  - ensure: present
+    name: vector
+  name: balancer
+  owner: balancer

TineoC and others added 4 commits September 28, 2026 15:55
Second half of standing cnpg up for Balancer (CodeForPhilly/balancer-main#526).
Creates an empty `balancer` database on shared-cluster with pgvector enabled,
so the RDS dump has somewhere to be restored to. Still no cutover: the app's
sealed SQL_HOST is untouched and production keeps reading from RDS.

Splits balancer/ into app/ + cnpg/ to match cfp-sandbox-cluster. The Database CR
has to stay in the cloudnative-pg namespace — cnpg requires it to sit beside the
Cluster it targets — so it cannot live under the kustomization that rewrites
everything to `balancer`. The existing kustomization moves to app/ unchanged,
along with its holomapping.

The managed role names balancer-db-credentials, which must be sealed into
cloudnative-pg.secrets/ before this merges or cnpg will report a role reconcile
error. Note cnpg does not pick up a newly-created passwordSecret on its periodic
resync — force it with:

  kubectl annotate cluster -n cloudnative-pg shared-cluster \
    cnpg.io/reconciliationLoop="$(date +%s)" --overwrite

Refs CodeForPhilly/balancer-main#526, CodeForPhilly/cfp-sandbox-cluster#162
Password for the managed balancer role on shared-cluster. Generated locally,
sealed against the live controller, never stored elsewhere — at cutover read
it back from the unsealed Secret in-cluster.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
feat(balancer): declare the cnpg balancer role and Database
Source-holobranch: k8s-manifests-github
Source-commit: beb4c59
Source: beb4c59
@themightychris
themightychris merged commit fe74ab1 into deploys/k8s-manifests Sep 28, 2026
1 check passed
@github-actions

Copy link
Copy Markdown
Author

kubectl apply output (excluding unchanged) for fe74ab1 was:

customresourcedefinition.apiextensions.k8s.io/backends.gateway.envoyproxy.io serverside-applied
customresourcedefinition.apiextensions.k8s.io/backendtlspolicies.gateway.networking.k8s.io serverside-applied
customresourcedefinition.apiextensions.k8s.io/backendtrafficpolicies.gateway.envoyproxy.io serverside-applied
customresourcedefinition.apiextensions.k8s.io/backups.postgresql.cnpg.io serverside-applied
customresourcedefinition.apiextensions.k8s.io/certificaterequests.cert-manager.io serverside-applied
customresourcedefinition.apiextensions.k8s.io/certificates.cert-manager.io serverside-applied
customresourcedefinition.apiextensions.k8s.io/challenges.acme.cert-manager.io serverside-applied
customresourcedefinition.apiextensions.k8s.io/clienttrafficpolicies.gateway.envoyproxy.io serverside-applied
customresourcedefinition.apiextensions.k8s.io/clusterimagecatalogs.postgresql.cnpg.io serverside-applied
customresourcedefinition.apiextensions.k8s.io/clusterissuers.cert-manager.io serverside-applied
customresourcedefinition.apiextensions.k8s.io/clusters.postgresql.cnpg.io serverside-applied
customresourcedefinition.apiextensions.k8s.io/databaseroles.postgresql.cnpg.io serverside-applied
customresourcedefinition.apiextensions.k8s.io/databases.postgresql.cnpg.io serverside-applied
customresourcedefinition.apiextensions.k8s.io/envoyextensionpolicies.gateway.envoyproxy.io serverside-applied
customresourcedefinition.apiextensions.k8s.io/envoypatchpolicies.gateway.envoyproxy.io serverside-applied
customresourcedefinition.apiextensions.k8s.io/envoyproxies.gateway.envoyproxy.io serverside-applied
customresourcedefinition.apiextensions.k8s.io/failoverquorums.postgresql.cnpg.io serverside-applied
customresourcedefinition.apiextensions.k8s.io/gatewayclasses.gateway.networking.k8s.io serverside-applied
customresourcedefinition.apiextensions.k8s.io/gateways.gateway.networking.k8s.io serverside-applied
customresourcedefinition.apiextensions.k8s.io/grpcroutes.gateway.networking.k8s.io serverside-applied
customresourcedefinition.apiextensions.k8s.io/httproutefilters.gateway.envoyproxy.io serverside-applied
customresourcedefinition.apiextensions.k8s.io/httproutes.gateway.networking.k8s.io serverside-applied
customresourcedefinition.apiextensions.k8s.io/imagecatalogs.postgresql.cnpg.io serverside-applied
customresourcedefinition.apiextensions.k8s.io/issuers.cert-manager.io serverside-applied
customresourcedefinition.apiextensions.k8s.io/listenersets.gateway.networking.k8s.io serverside-applied
customresourcedefinition.apiextensions.k8s.io/objectstores.barmancloud.cnpg.io serverside-applied
customresourcedefinition.apiextensions.k8s.io/orders.acme.cert-manager.io serverside-applied
customresourcedefinition.apiextensions.k8s.io/poolers.postgresql.cnpg.io serverside-applied
customresourcedefinition.apiextensions.k8s.io/publications.postgresql.cnpg.io serverside-applied
customresourcedefinition.apiextensions.k8s.io/referencegrants.gateway.networking.k8s.io serverside-applied
customresourcedefinition.apiextensions.k8s.io/scheduledbackups.postgresql.cnpg.io serverside-applied
customresourcedefinition.apiextensions.k8s.io/sealedsecrets.bitnami.com serverside-applied
customresourcedefinition.apiextensions.k8s.io/securitypolicies.gateway.envoyproxy.io serverside-applied
customresourcedefinition.apiextensions.k8s.io/subscriptions.postgresql.cnpg.io serverside-applied
customresourcedefinition.apiextensions.k8s.io/tlsroutes.gateway.networking.k8s.io serverside-applied
clusterrole.rbac.authorization.k8s.io/envoy-gateway-gateway-helm-envoy-gateway-role configured
clusterrole.rbac.authorization.k8s.io/grafana-clusterrole configured
clusterrole.rbac.authorization.k8s.io/prometheus-alertmanager configured
clusterrole.rbac.authorization.k8s.io/prometheus-pushgateway configured
clusterrolebinding.rbac.authorization.k8s.io/sealed-secrets configured
mutatingwebhookconfiguration.admissionregistration.k8s.io/cert-manager-webhook configured
mutatingwebhookconfiguration.admissionregistration.k8s.io/cnpg-mutating-webhook-configuration configured
mutatingwebhookconfiguration.admissionregistration.k8s.io/envoy-gateway-topology-injector.envoy-gateway-system configured
validatingadmissionpolicy.admissionregistration.k8s.io/safe-upgrades.gateway.networking.k8s.io configured
validatingadmissionpolicybinding.admissionregistration.k8s.io/safe-upgrades.gateway.networking.k8s.io configured
validatingwebhookconfiguration.admissionregistration.k8s.io/cert-manager-webhook configured
validatingwebhookconfiguration.admissionregistration.k8s.io/cnpg-validating-webhook-configuration configured
gateway.gateway.networking.k8s.io/balancer configured
httproute.gateway.networking.k8s.io/balancer configured
gateway.gateway.networking.k8s.io/chime configured
httproute.gateway.networking.k8s.io/chime configured
gateway.gateway.networking.k8s.io/choose-native-plants configured
httproute.gateway.networking.k8s.io/choose-native-plants configured
cluster.postgresql.cnpg.io/shared-cluster configured
configmap/cnpg-controller-manager-config configured
database.postgresql.cnpg.io/balancer created
sealedsecret.bitnami.com/balancer-db-credentials created
deployment.apps/code-for-philly configured
gateway.gateway.networking.k8s.io/code-for-philly configured
httproute.gateway.networking.k8s.io/code-for-philly configured
deployment.apps/codeforphilly configured
gateway.gateway.networking.k8s.io/codeforphilly configured
httproute.gateway.networking.k8s.io/codeforphilly configured
gateway.gateway.networking.k8s.io/echo-http configured
httproute.gateway.networking.k8s.io/echo-http configured
deployment.apps/envoy-gateway configured
httproute.gateway.networking.k8s.io/http-redirect configured
configmap/grafana-dashboards-default configured
deployment.apps/grafana configured
gateway.gateway.networking.k8s.io/grafana configured
httproute.gateway.networking.k8s.io/grafana configured
deployment.apps/metrics-server configured
secret/promtail configured
statefulset.apps/loki configured
deployment.apps/prometheus-alertmanager configured
deployment.apps/prometheus-kube-state-metrics configured
deployment.apps/prometheus-pushgateway configured
deployment.apps/prometheus-server configured
serviceaccount/prometheus-kube-state-metrics configured
deployment.apps/sealed-secrets configured
gateway.gateway.networking.k8s.io/sealed-secrets configured
httproute.gateway.networking.k8s.io/sealed-secrets configured
rolebinding.rbac.authorization.k8s.io/sealed-secrets-key-admin configured
service/sealed-secrets configured
gateway.gateway.networking.k8s.io/third-places configured
httproute.gateway.networking.k8s.io/third-places configured
statefulset.apps/third-places-postgresql configured
gateway.gateway.networking.k8s.io/vaultwarden configured
httproute.gateway.networking.k8s.io/bitwarden-redirect configured
httproute.gateway.networking.k8s.io/vaultwarden configured
statefulset.apps/vaultwarden-postgresql configured

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants