NG: web_petting database in main PostgreSQL cluster

Co-Authored-By: Claude <noreply@anthropic.com>

k8s-ng/core/postgresql/databases/web-petting.yaml

@@ -0,0 +1,81 @@
+# Database "web_petting": password, role, database and read access for the app.
+# To add another database copy this file and replace the name.
+
+# Generated once; the role and the application both read this Secret.
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: web-petting-db
+  namespace: psql
+spec:
+  refreshPolicy: CreatedOnce
+  target:
+    name: web-petting-db
+    template:
+      type: kubernetes.io/basic-auth
+      metadata:
+        labels:
+          cnpg.io/reload: "true"
+      data:
+        username: web_petting
+        password: "{{ .password }}"
+  dataFrom:
+    - sourceRef:
+        generatorRef:
+          apiVersion: generators.external-secrets.io/v1alpha1
+          kind: Password
+          name: db-password
+---
+apiVersion: postgresql.cnpg.io/v1
+kind: DatabaseRole
+metadata:
+  name: main-web-petting
+  namespace: psql
+spec:
+  cluster:
+    name: main
+  name: web_petting
+  login: true
+  passwordSecret:
+    name: web-petting-db
+---
+apiVersion: postgresql.cnpg.io/v1
+kind: Database
+metadata:
+  name: main-web-petting
+  namespace: psql
+spec:
+  cluster:
+    name: main
+  name: web_petting
+  owner: web_petting
+  databaseReclaimPolicy: retain
+---
+# Lets the web-petting namespace read only its own credentials Secret.
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: web-petting-db-reader
+  namespace: psql
+rules:
+  - apiGroups: [""]
+    resources: [secrets]
+    resourceNames: [web-petting-db]
+    verbs: [get, list, watch]
+  - apiGroups: [authorization.k8s.io]
+    resources: [selfsubjectrulesreviews]
+    verbs: [create]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: web-petting-db-reader
+  namespace: psql
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: web-petting-db-reader
+subjects:
+  - kind: ServiceAccount
+    name: db-credentials-reader
+    namespace: web-petting

k8s-ng/core/postgresql/kustomization.yaml

@@ -7,3 +7,4 @@ resources:
   - databases/vaultwarden.yaml
   - databases/keycloak.yaml
   - databases/furumi.yaml
+  - databases/web-petting.yaml