25 lines
1.2 KiB
Markdown
25 lines
1.2 KiB
Markdown
# platform/cnpg
|
|
|
|
**CloudNativePG** — the PostgreSQL operator that runs Keycloak's DR-critical database.
|
|
|
|
- **Governing ADR:** [ADR-0014 — IdP: Keycloak](../../../home-network-k3s/decisions/adr-0014-idp-keycloak.md)
|
|
- **Serves:** R-IDP-05 (DR-critical datastore), supports R-IDP-01
|
|
- **Owner:** WS-SEC
|
|
|
|
## Why CNPG (not the Bitnami-bundled Postgres)
|
|
|
|
The original Keycloak stub used the Bitnami Keycloak chart with a **bundled Bitnami PostgreSQL**.
|
|
Bitnami's free Docker Hub images were purged/relocated (DECISIONS-LOG **F-KY1**) — a deploy on stock
|
|
Bitnami tags ImagePullBackOffs. CloudNativePG:
|
|
|
|
- ships from **ghcr.io/cloudnative-pg** (unaffected by the Bitnami purge),
|
|
- runs Postgres as a replicated `Cluster` on **Longhorn** (3 instances → survives node loss),
|
|
- gives **declarative backup/restore** (`ScheduledBackup` + Barman object store) — the clean DR hook
|
|
for **R-IDP-05** (off-cluster backup) once the backup target lands (OQ-BKP, Phase 4).
|
|
|
|
## Controllers/configs split (F-MON1)
|
|
|
|
This directory installs only the **operator + CRDs** (controllers). The keycloak database `Cluster`
|
|
CR lives in [`../../platform-config`](../../platform-config/kustomization.yaml)
|
|
(`dependsOn: platform`, wait) so the `postgresql.cnpg.io` CRDs exist before the CR applies.
|