use official cnpg postgresql cluster chart (#1771)

Author: jessebot

forgejo/app_of_apps/forgejo_argocd_appset.yaml

@@ -267,17 +267,16 @@ spec:
             # - name: postgres-ssl-vol
             #   secret:
             #     secretName: gitea-postgres-ssl
-            extraVolumes:
-              - name: postgres-ca
-                secret:
-                  secretName: forgejo-postgres-server-ca-key-pair
-                  defaultMode: 438
-
-              - name: postgres-client-certs
-                secret:
-                  secretName: forgejo-postgres-forgejo-cert
-                  defaultMode: 438
-
+            # extraVolumes:
+            #   - name: postgres-ca
+            #     secret:
+            #       secretName: forgejo-postgres-server-ca-key-pair
+            #       defaultMode: 438
+
+            #   - name: postgres-client-certs
+            #     secret:
+            #       secretName: forgejo-postgres-forgejo-cert
+            #       defaultMode: 438
               #- name: postgres-certs
               #  persistentVolumeClaim:
               #    claimName: postgres-certs
@@ -289,12 +288,12 @@ spec:
             # - name: postgres-ssl-vol
             #   readOnly: true
             #   mountPath: "/pg-ssl"
-            extraVolumeMounts:
-              - name: postgres-ca
-                mountPath: /etc/secrets/ca
+            # extraVolumeMounts:
+            #   - name: postgres-ca
+            #     mountPath: /etc/secrets/ca
 
-              - name: postgres-client-certs
-                mountPath: /etc/secrets/app
+            #   - name: postgres-client-certs
+            #     mountPath: /etc/secrets/app
 
               #- name: postgres-certs
               #  mountPath: /data/git/.postgresql
@@ -452,7 +451,6 @@ spec:
                   NAME: forgejo
                   FROM: forgejo
 
-
                 # Settings for what content is indexed and how
                 indexer: {}
 

forgejo/app_of_apps/postgres_argocd_appset.yaml

@@ -40,63 +40,75 @@ spec:
           selfHeal: true
 
       source:
-        repoURL: https://small-hack.github.io/cloudnative-pg-cluster-chart
-        chart: cnpg-cluster
-        targetRevision: 0.5.0
+        # repoURL: https://small-hack.github.io/cloudnative-pg-cluster-chart
+        # chart: cnpg-cluster
+        repoURL: https://cloudnative-pg.github.io/charts
+        chart: cluster
+        targetRevision: 0.3.1
         helm:
           releaseName: forgejo-postgres-cluster
+          # https://github.com/cloudnative-pg/charts/blob/main/charts/cluster/values.yaml
           valuesObject:
+            type: postgresql
+
             name: forgejo-postgres
             instances: 2
 
-            bootstrap:
+            cluster:
+              # annotations for the cluster object
+              annotations:
+                cnpg.io/skipEmptyWalArchiveCheck: enabled
+
+              # initdb for postgresql in the cluster object
               initdb:
                 database: forgejo
                 owner: forgejo
                 secret:
                   name: forgejo-pgsql-credentials
 
-            backup:
-              # barman is a utility for backing up postgres to s3
-              barmanObjectStore:
-                destinationPath: "s3://forgejo-postgres"
-                endpointURL: "https://{{ .forgejo_s3_endpoint }}"
-                s3Credentials:
-                  accessKeyId:
-                    name: s3-postgres-credentials
-                    key: "accessKeyId"
-                  secretAccessKey:
-                    name: s3-postgres-credentials
-                    key: "secretAccessKey"
-                wal:
-                  compression: gzip
-                  maxParallel: 8
-                  encryption: AES256
-              retentionPolicy: "7d"
-
-            certificates:
-              server:
-                enabled: true
-                generate: true
-              client:
-                enabled: true
-                generate: true
-              user:
+              # enable monitoring for the cluster
+              monitoring:
                 enabled: true
-                username:
-                  - forgejo
+                podMonitor:
+                  enabled: true
+
+            backups:
+              # backups are disabled by default. This enables them
+              enabled: true
+              # Overrides the provider specific default endpoint. Defaults to:
+              # S3: https://s3.<region>.amazonaws.com"
+              endpointURL: "https://{{ .forgejo_s3_endpoint }}"
+              # Overrides the provider specific default path
+              destinationPath: "s3://forgejo-postgres"
+
+              # -- One of `s3`, `azure` or `google`
+              provider: s3
+
+              s3:
+                region: auto
+                bucket: forgejo-postgres
+
+              # existing secret for the s3 credentials
+              secret:
+                create: false
+                name: s3-postgres-credentials
+
+              # wal backup details
+              wal:
+                compression: gzip
+                maxParallel: 8
+                encryption: AES256
 
-            scheduledBackup:
-              name: forgejo-pg-backup
-              spec:
-                # Midnight daily backups for postgres data
-                schedule: '{{ .forgejo_postgres_backup_schedule }}'
-                backupOwnerReference: self
-                cluster:
-                  name: forgejo-postgres
+              # -- Retention policy for backups
+              retentionPolicy: "2d"
 
-            monitoring:
-              enablePodMonitor: true
+              scheduledBackups:
+                - name: forgejo-pg-backup
+                  schedule: '{{ .forgejo_postgres_backup_schedule }}'
+                  # Midnight daily backups for postgres data
+                  backupOwnerReference: self
+                  # Backup method: barmanObjectStore or volumeSnapshot
+                  method: barmanObjectStore
 
             postgresql:
               pg_hba:

forgejo/external_secrets/templates/bitwarden/s3_postgres_credentials.yaml

@@ -12,9 +12,9 @@ spec:
     template:
       type: Opaque
       data:
-        accessKeyId: |-
+        ACCESS_KEY_ID: |-
           {{ `{{ .accessKeyId }}` }}
-        secretAccessKey: |-
+        ACCESS_SECRET_KEY: |-
           {{ `{{ .secretAccessKey }}` }}
   data:
     - secretKey: accessKeyId