From 01561ea2cdcd540b2482d9101749d11839264b11 Mon Sep 17 00:00:00 2001
From: Aleksandr Bogomiakov <git@hexor.cy>
Date: Tue, 6 Oct 2026 16:18:36 +0100
Subject: [PATCH] NG: furumi database in main PostgreSQL cluster

Co-Authored-By: Claude <noreply@anthropic.com>
---
 k8s-ng/core/postgresql/databases/furumi.yaml | 83 ++++++++++++++++++++
 k8s-ng/core/postgresql/kustomization.yaml    |  1 +
 2 files changed, 84 insertions(+)
 create mode 100644 k8s-ng/core/postgresql/databases/furumi.yaml

diff --git a/k8s-ng/core/postgresql/databases/furumi.yaml b/k8s-ng/core/postgresql/databases/furumi.yaml
new file mode 100644
index 0000000..2ca292d
--- /dev/null
+++ b/k8s-ng/core/postgresql/databases/furumi.yaml
@@ -0,0 +1,83 @@
+# Database "furumi": password, role, database and read access for the app.
+# To add another database copy this file and replace the name.
+
+# Generated once; the role and the application both read this Secret.
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: furumi-db
+  namespace: psql
+spec:
+  refreshPolicy: CreatedOnce
+  target:
+    name: furumi-db
+    template:
+      type: kubernetes.io/basic-auth
+      metadata:
+        labels:
+          cnpg.io/reload: "true"
+      data:
+        username: furumi
+        password: "{{ .password }}"
+  dataFrom:
+    - sourceRef:
+        generatorRef:
+          apiVersion: generators.external-secrets.io/v1alpha1
+          kind: Password
+          name: db-password
+---
+apiVersion: postgresql.cnpg.io/v1
+kind: DatabaseRole
+metadata:
+  name: main-furumi
+  namespace: psql
+spec:
+  cluster:
+    name: main
+  name: furumi
+  login: true
+  passwordSecret:
+    name: furumi-db
+---
+apiVersion: postgresql.cnpg.io/v1
+kind: Database
+metadata:
+  name: main-furumi
+  namespace: psql
+spec:
+  cluster:
+    name: main
+  name: furumi
+  owner: furumi
+  extensions:
+    - name: pg_trgm
+  databaseReclaimPolicy: retain
+---
+# Lets the furumi namespace read only its own credentials Secret.
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: furumi-db-reader
+  namespace: psql
+rules:
+  - apiGroups: [""]
+    resources: [secrets]
+    resourceNames: [furumi-db]
+    verbs: [get, list, watch]
+  - apiGroups: [authorization.k8s.io]
+    resources: [selfsubjectrulesreviews]
+    verbs: [create]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: furumi-db-reader
+  namespace: psql
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: furumi-db-reader
+subjects:
+  - kind: ServiceAccount
+    name: db-credentials-reader
+    namespace: furumi
diff --git a/k8s-ng/core/postgresql/kustomization.yaml b/k8s-ng/core/postgresql/kustomization.yaml
index da87b3c..13686ff 100644
--- a/k8s-ng/core/postgresql/kustomization.yaml
+++ b/k8s-ng/core/postgresql/kustomization.yaml
@@ -6,3 +6,4 @@ resources:
   - password-generator.yaml
   - databases/vaultwarden.yaml
   - databases/keycloak.yaml
+  - databases/furumi.yaml