values.yaml

name: "cnpg"

# -- number of postgres replicas
# minimum 1 required
instances: 3

# -- image to use for all tenant pods
imageName: ghcr.io/cloudnative-pg/postgresql:16.0

# -- CNPG disables the postgres superuser by default
# must be explicitly enabled
enableSuperuserAccess: false

# -- name of existing secret to use as superuser redentials
# will be randomly generated if not specified.
superuserSecret: ""

# Examples of rolling update strategy:
# unsupervised: automated update of the primary once all
#                 replicas have been upgraded (default)
# supervised: requires manual supervision to perform
#               the switchover of the primary
primaryUpdateStrategy: unsupervised

# -- boostrap method. see: https://cloudnative-pg.io/documentation/1.23/bootstrap/
bootstrap: {}
  # -- for initializing a fresh cluster
  # initdb:
  #  # -- initial database to create
  #  database: app
  #  # -- owner of the initial database that is created above
  #  owner: app
  #  secret:
  #   name: app-secret
  #  list of SQL commands to run as part of the init scripts, example:
  #  postInitSQL:
  #   - CREATE ROLE friend
  #
  # for restoring a cluster
  # recovery:
  #   # -- Specify an external cluster to bootstrap from
  #   source: clusterBackup

# -- See https://cloudnative-pg.io/documentation/current/cloudnative-pg.v1/#postgresql-cnpg-io-v1-RoleConfiguration for explanation of all options
managed:
  roles: []
  #  - name: friend
  #    ensure: present
  #    comment: "friendly user"
  #    login: true
  #    superuser: false
  #    createdb: false
  #    createrole: false
  #    inRoles: []

externalClusters: []
#  # -- name of external/existing cluster
#  - name: clusterBackup
#    barmanObjectStore:
#      destinationPath: "s3://backups"
#      endpointURL: "http://HOST:PORT"
#      s3Credentials:
#        accessKeyId:
#          # -- existing Kubernetes Secret to use for S3 access key ID
#          name: "aws-creds"
#          # -- key in Kubernetes Secret to use for S3 access key ID
#          key: "ACCESS_KEY_ID"
#        secretAccessKey:
#          # -- existing Kubernetes Secret to use for S3 secret key
#          name: "aws-creds"
#          # -- key in Kubernetes Secret to use for S3 secret key
#          key: "ACCESS_SECRET_KEY"
#      wal:
#        maxParallel: 8

# -- if we should backup up this cluster, please see values.yaml for example
backup: {}
#  retentionPolicy: "30d"
#  barmanObjectStore:
#    destinationPath: "s3://backups"
#    endpointURL: "http://HOST:PORT"
#    s3Credentials:
#      accessKeyId:
#        # -- existing Kubernetes Secret to use for S3 access key ID
#        name: "aws-creds"
#        # -- key in Kubernetes Secret to use for S3 access key ID
#        key: "ACCESS_KEY_ID"
#      secretAccessKey:
#        # -- existing Kubernetes Secret to use for S3 secret key
#        name: "aws-creds"
#        # -- key in Kubernetes Secret to use for S3 secret key
#        key: "ACCESS_SECRET_KEY"

# -- schduled backups section, please see values.yaml for example
scheduledBackup: {}
# name: example-backup
# spec:
#   # -- crontab style schedule to run the backups
#   schedule: "0 0 0 * * *"
#   backupOwnerReference: self
#   cluster:
#     name: pg-backup

certificates:
  server:
    # -- enable using server certificates
    enabled: false
    # -- generate server certs using cert-manager. if true the following
    # are ignored: certificates.serverTLSSecret, certificates.serverCASecret
    generate: false
    # -- name of existing Kubernetes Secret for the postgresql server TLS cert,
    # ignored if certificates.generate is true
    serverTLSSecret: ""
    # -- name of existing Kubernetes Secret for the postgresql server Certificate
    # Authority cert, ignored if certificates.generate is true
    serverCASecret: ""
  client:
    # -- enable using client certificates
    enabled: false
    # -- generate client certs using cert-manager. if true the following are
    # ignored: certificates.clientCASecret, certificates.replicationTLSSecret
    generate: false
    # -- name of existing Kubernetes Secret for the postgresql client Certificate
    # Authority cert, ignored if certificates.generate is true
    clientCASecret: ""
    # -- name of existing Kubernetes Secret for the postgresql replication TLS
    # cert ignored if certificates.generate is true
    replicationTLSSecret: ""
  user:
    # -- create a certificate for a user to connect to postgres using CertManager
    # requires server and client certificate generation enabled
    enabled: false
    # -- List of names of users to create a cert for, eg: the DbOwner specified earlier.
    # This data populated into the commonName field of the certificate.
    username:
      - "app"

monitoring:
  # -- enable monitoring via Prometheus
  enablePodMonitor: false

postgresql:
  # -- records for the pg_hba.conf file. ref: https://www.postgresql.org/docs/current/auth-pg-hba-conf.html
  pg_hba:
    - hostnossl all all 0.0.0.0/0 reject
    - hostssl all all 0.0.0.0/0 cert clientcert=verify-full

storage:
  # -- how much storage to allocate to the postgresql cluster
  size: 1Gi

# from https://cloudnative-pg.io/documentation/1.22/resource_management/
resources: {}
  # -- minimum resources guaranteed for pods
  # requests:
  #   cpu: "50m"
  #   memory: "64Mi"
  # -- resource limit for pods
  # limits:
  #   cpu: "1000m"
  #   memory: "512Mi"

testApp:
  ## -- create a test deployment to verify db connectivity.
  # Populates user and DB from the Initdb owner and database values
  # Requires server, client, and user certificate generation to be enabled.
  enabled: false