From 36b1d637f1c293a0611ead89514d2d65e75c1e1f Mon Sep 17 00:00:00 2001 From: sirius0xdev Date: Thu, 14 May 2026 19:24:33 -0400 Subject: [PATCH] feat: add siriusdevops CNPG cluster + waitlist API K8s manifests (#112) - New CNPG PostgreSQL cluster (siriusdevops-pgdb) in customer1 namespace - Single-instance, 20Gi storage, GCS backups to siriusdevops-backups/ - Waitlist database definition (waitlist-db.yaml) - Scheduled backup manifest - Waitlist API deployment, service, HTTPRoute, and Telegram secret placeholder - Kustomization wiring for both siriusdevops-db and waitlist-api --- .../siriusdevops-db/kustomization.yaml | 8 ++ .../pg-cluster-siriusdevops.yaml | 45 ++++++++ .../siriusdevops-scheduled-backup.yaml | 12 ++ .../waitlist-db-credentials.yaml | 13 +++ .../siriusdevops-db/waitlist-db.yaml | 10 ++ .../customer1/waitlist-api/deployment.yaml | 104 ++++++++++++++++++ .../customer1/waitlist-api/http-route.yaml | 21 ++++ .../customer1/waitlist-api/kustomization.yaml | 6 + .../waitlist-telegram-secret.yaml | 13 +++ 9 files changed, 232 insertions(+) create mode 100644 apps/base/customer1/siriusdevops-db/kustomization.yaml create mode 100644 apps/base/customer1/siriusdevops-db/pg-cluster-siriusdevops.yaml create mode 100644 apps/base/customer1/siriusdevops-db/siriusdevops-scheduled-backup.yaml create mode 100644 apps/base/customer1/siriusdevops-db/waitlist-db-credentials.yaml create mode 100644 apps/base/customer1/siriusdevops-db/waitlist-db.yaml create mode 100644 apps/base/customer1/waitlist-api/deployment.yaml create mode 100644 apps/base/customer1/waitlist-api/http-route.yaml create mode 100644 apps/base/customer1/waitlist-api/kustomization.yaml create mode 100644 apps/base/customer1/waitlist-api/waitlist-telegram-secret.yaml diff --git a/apps/base/customer1/siriusdevops-db/kustomization.yaml b/apps/base/customer1/siriusdevops-db/kustomization.yaml new file mode 100644 index 0000000..4ddba78 --- /dev/null +++ b/apps/base/customer1/siriusdevops-db/kustomization.yaml @@ -0,0 +1,8 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization + +resources: + - pg-cluster-siriusdevops.yaml + - waitlist-db-credentials.yaml + - waitlist-db.yaml + - siriusdevops-scheduled-backup.yaml diff --git a/apps/base/customer1/siriusdevops-db/pg-cluster-siriusdevops.yaml b/apps/base/customer1/siriusdevops-db/pg-cluster-siriusdevops.yaml new file mode 100644 index 0000000..eb44ed7 --- /dev/null +++ b/apps/base/customer1/siriusdevops-db/pg-cluster-siriusdevops.yaml @@ -0,0 +1,45 @@ +apiVersion: postgresql.cnpg.io/v1 +kind: Cluster +metadata: + name: siriusdevops-pgdb + namespace: customer1 + +spec: + instances: 1 + imageName: ghcr.io/cloudnative-pg/postgresql:15.2 + storage: + size: 20Gi + + managed: + roles: + - name: waitlist + ensure: present + login: true + passwordSecret: + name: waitlist-db-credentials + + bootstrap: + initdb: + database: waitlist + owner: waitlist + secret: + name: waitlist-db-credentials + + serviceAccountTemplate: + metadata: + name: cnpg-backup-sa + annotations: + iam.gke.io/gcp-service-account: cnpg-backup-sa@devops-lab-cluster.iam.gserviceaccount.com + + backup: + barmanObjectStore: + destinationPath: "gs://customer1_db_backup/siriusdevops-backups/" + googleCredentials: + gkeEnvironment: true + wal: + compression: gzip + data: + compression: gzip + jobs: 2 + retentionPolicy: "30d" + target: primary diff --git a/apps/base/customer1/siriusdevops-db/siriusdevops-scheduled-backup.yaml b/apps/base/customer1/siriusdevops-db/siriusdevops-scheduled-backup.yaml new file mode 100644 index 0000000..a0d45ec --- /dev/null +++ b/apps/base/customer1/siriusdevops-db/siriusdevops-scheduled-backup.yaml @@ -0,0 +1,12 @@ +apiVersion: postgresql.cnpg.io/v1 +kind: ScheduledBackup +metadata: + name: siriusdevops-daily-backup + namespace: customer1 +spec: + schedule: "0 4 * * *" # Daily at 04:00 UTC + suspend: false + immediate: false + backupOwnerReference: self + cluster: + name: siriusdevops-pgdb diff --git a/apps/base/customer1/siriusdevops-db/waitlist-db-credentials.yaml b/apps/base/customer1/siriusdevops-db/waitlist-db-credentials.yaml new file mode 100644 index 0000000..ab6f997 --- /dev/null +++ b/apps/base/customer1/siriusdevops-db/waitlist-db-credentials.yaml @@ -0,0 +1,13 @@ +apiVersion: v1 +kind: Secret +metadata: + name: waitlist-db-credentials + namespace: customer1 +type: Opaque +stringData: + username: waitlist + password: CHANGEME +sops: + age: + - recipient: age1uuxf066xuuqgvjppxfcmqkwfcufnwp3wcwnl9h20g9k4l8nkw9jsaungf7 + encrypted_regex: ^(data|stringData)$ diff --git a/apps/base/customer1/siriusdevops-db/waitlist-db.yaml b/apps/base/customer1/siriusdevops-db/waitlist-db.yaml new file mode 100644 index 0000000..e507dfb --- /dev/null +++ b/apps/base/customer1/siriusdevops-db/waitlist-db.yaml @@ -0,0 +1,10 @@ +apiVersion: postgresql.cnpg.io/v1 +kind: Database +metadata: + name: waitlist-db + namespace: customer1 +spec: + cluster: + name: siriusdevops-pgdb + name: waitlist + owner: waitlist diff --git a/apps/base/customer1/waitlist-api/deployment.yaml b/apps/base/customer1/waitlist-api/deployment.yaml new file mode 100644 index 0000000..a1c9c9f --- /dev/null +++ b/apps/base/customer1/waitlist-api/deployment.yaml @@ -0,0 +1,104 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: waitlist-api + namespace: customer1 +spec: + replicas: 1 + selector: + matchLabels: + app: waitlist-api + template: + metadata: + labels: + app: waitlist-api + spec: + containers: + - name: api + image: ghcr.io/sirius0xdev/waitlist-api:latest + imagePullPolicy: Always + ports: + - containerPort: 8080 + protocol: TCP + env: + - name: DB_HOST + value: "siriusdevops-pgdb-rw.customer1.svc.cluster.local" + - name: DB_PORT + value: "5432" + - name: DB_NAME + value: "waitlist" + - name: DB_USER + valueFrom: + secretKeyRef: + name: waitlist-db-credentials + key: username + - name: DB_PASSWORD + valueFrom: + secretKeyRef: + name: waitlist-db-credentials + key: password + - name: TELEGRAM_BOT_TOKEN + valueFrom: + secretKeyRef: + name: waitlist-telegram-secret + key: bot_token + - name: TELEGRAM_CHAT_ID + valueFrom: + secretKeyRef: + name: waitlist-telegram-secret + key: chat_id + resources: + requests: + cpu: 50m + memory: 128Mi + limits: + cpu: 200m + memory: 256Mi + + startupProbe: + httpGet: + path: /healthz + port: 8080 + scheme: HTTP + initialDelaySeconds: 10 + periodSeconds: 5 + timeoutSeconds: 5 + failureThreshold: 30 + successThreshold: 1 + + readinessProbe: + httpGet: + path: /healthz + port: 8080 + scheme: HTTP + initialDelaySeconds: 3 + periodSeconds: 5 + timeoutSeconds: 5 + failureThreshold: 3 + successThreshold: 1 + + livenessProbe: + httpGet: + path: /healthz + port: 8080 + scheme: HTTP + initialDelaySeconds: 30 + periodSeconds: 10 + timeoutSeconds: 5 + failureThreshold: 3 + successThreshold: 1 + +--- +apiVersion: v1 +kind: Service +metadata: + name: waitlist-api-svc + namespace: customer1 +spec: + selector: + app: waitlist-api + ports: + - protocol: TCP + port: 80 + targetPort: 8080 + type: ClusterIP diff --git a/apps/base/customer1/waitlist-api/http-route.yaml b/apps/base/customer1/waitlist-api/http-route.yaml new file mode 100644 index 0000000..610d75a --- /dev/null +++ b/apps/base/customer1/waitlist-api/http-route.yaml @@ -0,0 +1,21 @@ +apiVersion: gateway.networking.k8s.io/v1 +kind: HTTPRoute +metadata: + name: waitlist-api-route + namespace: customer1 +spec: + parentRefs: + - name: external-http-gateway + hostnames: + - "sirius-sec.com" + - "www.sirius-sec.com" + - "agentforge.ai" + - "www.agentforge.ai" + rules: + - matches: + - path: + type: PathPrefix + value: /api/waitlist + backendRefs: + - name: waitlist-api-svc + port: 80 diff --git a/apps/base/customer1/waitlist-api/kustomization.yaml b/apps/base/customer1/waitlist-api/kustomization.yaml new file mode 100644 index 0000000..a221887 --- /dev/null +++ b/apps/base/customer1/waitlist-api/kustomization.yaml @@ -0,0 +1,6 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - deployment.yaml + - waitlist-telegram-secret.yaml + - http-route.yaml diff --git a/apps/base/customer1/waitlist-api/waitlist-telegram-secret.yaml b/apps/base/customer1/waitlist-api/waitlist-telegram-secret.yaml new file mode 100644 index 0000000..961e65b --- /dev/null +++ b/apps/base/customer1/waitlist-api/waitlist-telegram-secret.yaml @@ -0,0 +1,13 @@ +apiVersion: v1 +kind: Secret +metadata: + name: waitlist-telegram-secret + namespace: customer1 +type: Opaque +stringData: + bot_token: CHANGEME + chat_id: CHANGEME +sops: + age: + - recipient: age1uuxf066xuuqgvjppxfcmqkwfcufnwp3wcwnl9h20g9k4l8nkw9jsaungf7 + encrypted_regex: ^(data|stringData)$