feat(add-ons): Add redoost database to Postgres

add-ons/postgres/cluster.yaml

@@ -24,6 +24,11 @@ spec:
         name: legislative
         passwordSecret:
           name: legislative-db
+      - ensure: present
+        login: true
+        name: redoost
+        passwordSecret:
+          name: redoost-db
   postgresql:
     # Each app role may only connect to the database of the same name.
     pg_hba:

add-ons/postgres/kustomization.yaml

@@ -8,3 +8,5 @@ resources:
   - grafana-database.yaml
   - legislative-db-sealedsecret.yaml
   - legislative-database.yaml
+  - redoost-db-sealedsecret.yaml
+  - redoost-database.yaml

add-ons/postgres/redoost-database.yaml

@@ -0,0 +1,11 @@
+apiVersion: postgresql.cnpg.io/v1
+kind: Database
+metadata:
+  name: redoost
+  namespace: postgres
+spec:
+  cluster:
+    name: postgres
+  databaseReclaimPolicy: retain
+  name: redoost
+  owner: redoost

add-ons/postgres/redoost-db-sealedsecret.yaml

@@ -0,0 +1,17 @@
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: redoost-db
+  namespace: postgres
+spec:
+  encryptedData:
+    password: AgBOLny607zrRCeoMDQkT5uN/5kB1W74ju1cufJiyqiCtLtnhEJjD57/9FXg8ic21YrrjWBdHaWxv5Sonz3CY6m6OC/pF2t/7pBDq/Yw63PT5bx8TLvOXLwb+2cb7boo52k0kFm0MpA3GIktIsx1GQjuPAl7KdeotAnaKSUQkH3I8IAF+v+njpWFS7nrQJnz+NHvlmKLT8hD8SFC7NPCYz0awXJ/CENJKKdQuFtTXh3YBV0BignILIAUR047Nqzg//dxOCT2DUuxFLyddt4iFmUCq7bpLxD1HWceS0Vsts3cXto9AObkjNXHKAVb0SGpGv3dJg6tfqb5Yls+zSxfIiDFzUVkwsV6/SCEdfEhAPShRBiqDu7Dv6G1+8NbcFujCat3TDNw50pZqwCuETvqdlyO39VdQ4P2Eecz2APYjDlZMCsulgdB4co/x7Ix+pzexCVhxWKc11A59crwIie+RdHmPT6yEew337P8ojU2p0H9NzbJheEQBhSLrlQ38Mpm/YdYN25fu2WislqxkrsJ3QdtOliEsWqBgV3TOTbYYt9vWE4Y+psg7SHcka+YsX8nuw72ouc7CIK5hvJkMa/qM0bW3WghQFbEHs0IdSiYmpQhbwPrXPexPO5vmzUJstiKwUB0wDtsyfXlWr/imySdjLt6lNSjQk3awf4fO5HLofcVO/zxtg1lAaLZWl5FVP8dW3Wh97Yfla10uIOWALUXTEw7TnePHqLe3G+FrcHjOMAebt/FJrc4P48GeXRve5SpAR1hKOG9s+7ARydrWKdrb8Sv
+    username: AgBOzETvCTrajt+s4rPrmfB15lzQGIDTv5ArvaDLAnUf6cP4MdikbypuNyieT5YVpAXiUpVJqUefHRUkONxcvq51iFd/NKE7K6VCv0i8xQVgrmX55fgc5FCB1VkNDilFxQhDp1DBIl+oCpGSS8AafkKKXECoGDdvG3ldj5i6Us0jDD3EyjPayZGPV6ULeABTbFWodAOBeieKs4WzCS1Npyz0rzGqoj4H9dW6LnDZlCGPq8sL6rkP85DceatKUyzmSSxhDMWsuwL0TLpQBeQnLr06G3uQlZHvUp/PiAykqjXz8/YW/HQZzFm0GOJmiKTtv99J9ErnJ9iriMFrGsfNnv0jAhXSmwy8EGlo7WkzstVQGtwFCKKQtG2l9GavHh0nlOIaFYriB2WFRaujJVMgqTDcVrP1qX6uozqwblDXuYYJ8KFsbSJC3stGECc26kL1MmpyGihsCIh9bXPEg6DANi25amcjR0OVImGPEDlOQitWEdJ76CjqiPt2ehrFin7BF3dg6DK3fsRR7KkCXQHyTRR6RnJ/7Nl7zLOCMUl5WFltUIRApT2EGAgVLiSMpFC5ITw2OFAvKeSjqOlSo3FdMlX8lSkQXGBjeIGb9t9bpMAyLh/PoqfB5hyCQxfV3CE4nUJkrpL78BqbozUOG8tnz9kWri2LCAn7+k+dSYnOoimHDfG+YxAImgoI/k4rqnHLAKknHjtnbm20
+  template:
+    metadata:
+      labels:
+        cnpg.io/reload: "true"
+      name: redoost-db
+      namespace: postgres
+    type: kubernetes.io/basic-auth

apps/redoost/database-sealedsecret.yaml

@@ -0,0 +1,14 @@
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: redoost-db
+  namespace: redoost
+spec:
+  encryptedData:
+    REDOOST_DATABASE_URL: AgAhLopkno58mbcOJtZmrUPMu3RNBSiGK3GH1XRPTgIFxXwtbZhcavqHcZr8cqJQetlpoyLsHptzrusTcBjmCHUT0x5muKDybGbnWb11CgrNRy6TpTSo5y8lY8Ont66huL5FHmz/Mvl2hGcXOG/puk6aIvSDyJhq10fh5XJuUuzB9Nl7PTF4wRmrGn3rZbiDHHiyY5B0Hw/syXsVT2wyi/xI7YVBF30EgKZTjNLJXckGiwI8qewk/H+N2U92e0lm38iglw3OSxjRg6U/7YoWmQmRu5tS98tgml1e7Ib96q3l2+RSfrSAsEzWpemcgJIMUv5FM+Je7u6T9FWujGA3UzLRjvVKdkWlkkhoyLdjWqYII4nfREs4K3GyLok0U0x61LPgu5S/xhWeku67evgZow+PwFxAXB+umurwQhn9+YLguuEec0mXTAMPeacxA4ElRUDeHaKP+U3nPPa0kakCuqxsu2N3gqZeRJlca4npUK8QsFzHowysmTUPXZJ3OnthVBKCfZCMKWNGKd4UgKUsqj8ubcfZYwwjdSHpqMtZ6U+IKnTWxUe8Uz52at4p3GmQj3Dt2wLKfMsWg7NEzz6yXjFMC1o9dsU2CetinQ/1yhLkCFl5UtRQveC9K14MnzN9jJovGyFOqh6hR6/kJKTG70dWh1jm1DGa3uPcN6IEFYc7xl67CcLNr6Qq6I0uG0yqh9HkJZAfVc3Z+EGHRnxyqh60G/1j/ZFIRWrBMJFP6N2JcNxpu0nd32d9BJRzjhgCLQjKdu9jF8Y4HktWLtSIl+jFSJ9PVKZZHLmWsenTx1ml+J1csiO9GnQpT2Xol8114cTlehnws3IEmo54DnIZdoP/lW+McWAoB6ZgPvOIi7Ft5LNCW4BDfhFdFIw3J+jNLn2i
+  template:
+    metadata:
+      name: redoost-db
+      namespace: redoost
+    type: Opaque

apps/redoost/kustomization.yaml

@@ -2,3 +2,4 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - sealed-secret.yaml
+  - database-sealedsecret.yaml

argocd-apps/apps/redoost.yaml

@@ -39,6 +39,8 @@ spec:
             websiteUpstream: garage.garage.svc.cluster.local:3902
             bucket: redoost-sites
             existingSecret: redoost-s3
+          database:
+            existingSecret: redoost-db
           networkPolicy:
             enabled: true
             gateway:
@@ -52,6 +54,13 @@ spec:
                 podSelector:
                   matchLabels:
                     app.kubernetes.io/name: garage
+            database:
+              - namespaceSelector:
+                  matchLabels:
+                    kubernetes.io/metadata.name: postgres
+                podSelector:
+                  matchLabels:
+                    cnpg.io/cluster: postgres
     - path: apps/redoost
       repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git
       targetRevision: main