From 5f0a3ca3b6e858979d1590c97a1f88761c85a4dd Mon Sep 17 00:00:00 2001
From: Aleksandr Bogomiakov <git@hexor.cy>
Date: Tue, 6 Oct 2026 17:42:49 +0100
Subject: [PATCH] NG: web_petting database in main PostgreSQL cluster

Co-Authored-By: Claude <noreply@anthropic.com>
---
 .../postgresql/databases/web-petting.yaml     | 81 +++++++++++++++++++
 k8s-ng/core/postgresql/kustomization.yaml     |  1 +
 2 files changed, 82 insertions(+)
 create mode 100644 k8s-ng/core/postgresql/databases/web-petting.yaml

diff --git a/k8s-ng/core/postgresql/databases/web-petting.yaml b/k8s-ng/core/postgresql/databases/web-petting.yaml
new file mode 100644
index 0000000..2c5489d
--- /dev/null
+++ b/k8s-ng/core/postgresql/databases/web-petting.yaml
@@ -0,0 +1,81 @@
+# Database "web_petting": password, role, database and read access for the app.
+# To add another database copy this file and replace the name.
+
+# Generated once; the role and the application both read this Secret.
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: web-petting-db
+  namespace: psql
+spec:
+  refreshPolicy: CreatedOnce
+  target:
+    name: web-petting-db
+    template:
+      type: kubernetes.io/basic-auth
+      metadata:
+        labels:
+          cnpg.io/reload: "true"
+      data:
+        username: web_petting
+        password: "{{ .password }}"
+  dataFrom:
+    - sourceRef:
+        generatorRef:
+          apiVersion: generators.external-secrets.io/v1alpha1
+          kind: Password
+          name: db-password
+---
+apiVersion: postgresql.cnpg.io/v1
+kind: DatabaseRole
+metadata:
+  name: main-web-petting
+  namespace: psql
+spec:
+  cluster:
+    name: main
+  name: web_petting
+  login: true
+  passwordSecret:
+    name: web-petting-db
+---
+apiVersion: postgresql.cnpg.io/v1
+kind: Database
+metadata:
+  name: main-web-petting
+  namespace: psql
+spec:
+  cluster:
+    name: main
+  name: web_petting
+  owner: web_petting
+  databaseReclaimPolicy: retain
+---
+# Lets the web-petting namespace read only its own credentials Secret.
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: web-petting-db-reader
+  namespace: psql
+rules:
+  - apiGroups: [""]
+    resources: [secrets]
+    resourceNames: [web-petting-db]
+    verbs: [get, list, watch]
+  - apiGroups: [authorization.k8s.io]
+    resources: [selfsubjectrulesreviews]
+    verbs: [create]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: web-petting-db-reader
+  namespace: psql
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: web-petting-db-reader
+subjects:
+  - kind: ServiceAccount
+    name: db-credentials-reader
+    namespace: web-petting
diff --git a/k8s-ng/core/postgresql/kustomization.yaml b/k8s-ng/core/postgresql/kustomization.yaml
index 13686ff..d123d76 100644
--- a/k8s-ng/core/postgresql/kustomization.yaml
+++ b/k8s-ng/core/postgresql/kustomization.yaml
@@ -7,3 +7,4 @@ resources:
   - databases/vaultwarden.yaml
   - databases/keycloak.yaml
   - databases/furumi.yaml
+  - databases/web-petting.yaml