homelab/k8s-ng/core/postgresql/databases/furumi.yaml

# Database "furumi": password, role, database and read access for the app.
# To add another database copy this file and replace the name.

# Generated once; the role and the application both read this Secret.
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  name: furumi-db
  namespace: psql
spec:
  refreshPolicy: CreatedOnce
  target:
    name: furumi-db
    template:
      type: kubernetes.io/basic-auth
      metadata:
        labels:
          cnpg.io/reload: "true"
      data:
        username: furumi
        password: "{{ .password }}"
  dataFrom:
    - sourceRef:
        generatorRef:
          apiVersion: generators.external-secrets.io/v1alpha1
          kind: Password
          name: db-password
---
apiVersion: postgresql.cnpg.io/v1
kind: DatabaseRole
metadata:
  name: main-furumi
  namespace: psql
spec:
  cluster:
    name: main
  name: furumi
  login: true
  passwordSecret:
    name: furumi-db
---
apiVersion: postgresql.cnpg.io/v1
kind: Database
metadata:
  name: main-furumi
  namespace: psql
spec:
  cluster:
    name: main
  name: furumi
  owner: furumi
  extensions:
    # `ensure` is defaulted by the CRD inside list items; spelled out so Argo CD
    # does not see it as drift.
    - name: pg_trgm
      ensure: present
  databaseReclaimPolicy: retain
---
# Lets the furumi namespace read only its own credentials Secret.
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: furumi-db-reader
  namespace: psql
rules:
  - apiGroups: [""]
    resources: [secrets]
    resourceNames: [furumi-db]
    verbs: [get, list, watch]
  - apiGroups: [authorization.k8s.io]
    resources: [selfsubjectrulesreviews]
    verbs: [create]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: furumi-db-reader
  namespace: psql
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: furumi-db-reader
subjects:
  - kind: ServiceAccount
    name: db-credentials-reader
    namespace: furumi