home-network-k3s-impl/platform/cnpg/README.md

platform/cnpg

CloudNativePG — the PostgreSQL operator that runs Keycloak's DR-critical database.

• Governing ADR: ADR-0014 — IdP: Keycloak
• Serves: R-IDP-05 (DR-critical datastore), supports R-IDP-01
• Owner: WS-SEC

Why CNPG (not the Bitnami-bundled Postgres)

The original Keycloak stub used the Bitnami Keycloak chart with a bundled Bitnami PostgreSQL. Bitnami's free Docker Hub images were purged/relocated (DECISIONS-LOG F-KY1) — a deploy on stock Bitnami tags ImagePullBackOffs. CloudNativePG:

• ships from ghcr.io/cloudnative-pg (unaffected by the Bitnami purge),
• runs Postgres as a replicated Cluster on Longhorn (3 instances → survives node loss),
• gives declarative backup/restore (ScheduledBackup + Barman object store) — the clean DR hook for R-IDP-05 (off-cluster backup) once the backup target lands (OQ-BKP, Phase 4).

Controllers/configs split (F-MON1)

This directory installs only the operator + CRDs (controllers). The keycloak database Cluster CR lives in ../../platform-config (dependsOn: platform, wait) so the postgresql.cnpg.io CRDs exist before the CR applies.