olb042
6f29be2987
Validate login GitOps repo / validate (push) Successful in 9s
- Keycloak Operator v26 deployed to keycloak-system namespace - Keycloak HA instance (2 replicas, jdbc-ping cluster discovery) - Dedicated CNPG cluster (local-postgres storage, 2 instances) - KeycloakRealmImport: home-lab realm with groups and traefik-oidc client - Traefik IngressRoute: login.olb42.com (CF Access bypass) - Admin credentials placeholder (seal before first deploy) - ArgoCD ApplicationSets: login-operator + login
49 lines
1.7 KiB
YAML
49 lines
1.7 KiB
YAML
apiVersion: postgresql.cnpg.io/v1
|
|
kind: Cluster
|
|
metadata:
|
|
name: login-postgres
|
|
namespace: login
|
|
spec:
|
|
# ── HA: 1 primary + 1 standby replica ────────────────────────────────────
|
|
instances: 2
|
|
|
|
# ── Storage: local-postgres class (fast local NVMe, no Longhorn overhead) ─
|
|
storage:
|
|
storageClass: local-postgres
|
|
size: 8Gi
|
|
|
|
# ── Spread replicas across nodes ──────────────────────────────────────────
|
|
affinity:
|
|
enablePodAntiAffinity: true
|
|
topologyKey: kubernetes.io/hostname
|
|
|
|
# ── Bootstrap: create the keycloak database and owner role ───────────────
|
|
bootstrap:
|
|
initdb:
|
|
database: keycloak
|
|
owner: keycloak
|
|
|
|
# ── WAL archival via barman-cloud → MinIO ─────────────────────────────────
|
|
plugins:
|
|
- name: barman-cloud.cloudnative-pg.io
|
|
isWALArchiver: true
|
|
parameters:
|
|
barmanObjectName: minio-store
|
|
|
|
# ── PostgreSQL tuning for Keycloak workload ───────────────────────────────
|
|
postgresql:
|
|
parameters:
|
|
max_connections: "200"
|
|
shared_buffers: "256MB"
|
|
work_mem: "8MB"
|
|
maintenance_work_mem: "64MB"
|
|
|
|
# ── Resources ─────────────────────────────────────────────────────────────
|
|
resources:
|
|
requests:
|
|
memory: 256Mi
|
|
cpu: 100m
|
|
limits:
|
|
memory: 512Mi
|
|
cpu: 500m
|