# Database "jacob": password, role, database and read access for the app.
# To add another database copy this file and replace the name.

# Generated once; the role and the application both read this Secret.
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  name: jacob-db
  namespace: psql
spec:
  refreshPolicy: CreatedOnce
  target:
    name: jacob-db
    template:
      type: kubernetes.io/basic-auth
      metadata:
        labels:
          cnpg.io/reload: "true"
      data:
        username: jacob
        password: "{{ .password }}"
  dataFrom:
    - sourceRef:
        generatorRef:
          apiVersion: generators.external-secrets.io/v1alpha1
          kind: Password
          name: db-password
---
apiVersion: postgresql.cnpg.io/v1
kind: DatabaseRole
metadata:
  name: main-jacob
  namespace: psql
spec:
  cluster:
    name: main
  name: jacob
  login: true
  passwordSecret:
    name: jacob-db
---
apiVersion: postgresql.cnpg.io/v1
kind: Database
metadata:
  name: main-jacob
  namespace: psql
spec:
  cluster:
    name: main
  name: jacob
  owner: jacob
  databaseReclaimPolicy: retain
  extensions:
    - name: vector
      ensure: present