Repository navigation
feat(balancer): declare the cnpg balancer role and Database - #226
Merged
Merged
Conversation
Second half of standing cnpg up for Balancer (CodeForPhilly/balancer-main#526). Creates an empty `balancer` database on shared-cluster with pgvector enabled, so the RDS dump has somewhere to be restored to. Still no cutover: the app's sealed SQL_HOST is untouched and production keeps reading from RDS. Splits balancer/ into app/ + cnpg/ to match cfp-sandbox-cluster. The Database CR has to stay in the cloudnative-pg namespace — cnpg requires it to sit beside the Cluster it targets — so it cannot live under the kustomization that rewrites everything to `balancer`. The existing kustomization moves to app/ unchanged, along with its holomapping. The managed role names balancer-db-credentials, which must be sealed into cloudnative-pg.secrets/ before this merges or cnpg will report a role reconcile error. Note cnpg does not pick up a newly-created passwordSecret on its periodic resync — force it with: kubectl annotate cluster -n cloudnative-pg shared-cluster \ cnpg.io/reconciliationLoop="$(date +%s)" --overwrite Refs CodeForPhilly/balancer-main#526, CodeForPhilly/cfp-sandbox-cluster#162
Password for the managed balancer role on shared-cluster. Generated locally, sealed against the live controller, never stored elsewhere — at cutover read it back from the unsealed Secret in-cluster. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Contributor
|
LGMT |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Supersedes #183: @TineoC's commit rebased onto current
main(which now has cnpg 1.30.1, the Barman Cloud plugin and GCS backups), plus the sealed credentials it was blocked on.shared-clustergainsmanaged.roles: balancerwithpasswordSecret: balancer-db-credentials.cloudnative-pg.secrets/balancer-db-credentials.yaml: the role's password, sealed against the live controller. It lands in the same deploy as the role, so the reconcile-nudge from feat(balancer): declare the cnpg balancer role and Database #183's description shouldn't be needed.Database/balanceronshared-cluster, owned bybalancer, with thevectorextension. Empty until the RDS dump is restored into it.balancer/splits intoapp/+cnpg/to match sandbox. The app kustomization and its holomapping move unchanged.Still no cutover: the app's sealed
SQL_HOSTis untouched and production keeps reading from RDS.Projection QA
git diff --name-status origin/deploys/k8s-manifests <projection>: 3 files incloudnative-pg: the Cluster gainsmanaged.roles;Database/balancerandSealedSecret/balancer-db-credentialsare new. Thebalancernamespace's rendered manifests are byte-identical before and after the split.🤖 Generated with Claude Code