# Give something a Postgres

**Run by an operator, not by you.** *Passwords are generated, replication is
handled at the database level, and a cluster of one is a fully supported
configuration rather than a degraded one.*

---

## It must live in the application's namespace

**The operator generates a secret named for the cluster**, and the application
has to be able to read it. **Different namespace, unreadable secret.**

*No database password appears in any values file, and none should.*

## Three services appear, and only one of them is usually right

| | |
|---|---|
| `<name>-rw` | **read/write — always the current primary.** *This is the one.* |
| `<name>-ro` | read-only replicas — **meaningless with one instance** |
| `<name>-r` | read, any instance |

## Deleting the cluster does not delete the disks

> **The operator does not reap volumes.** *Recreating with the same name adopts
> the old ones — so a reset that skips the volumes either fails or silently
> resurrects the data you meant to discard.*

```sh
kubectl delete cluster <name> -n <ns>
kubectl delete pvc -n <ns> -l cnpg.io/cluster=<name>    # not optional
```

## The image tag is not the obvious one

**The naming convention changed.** *The plain `<version>-bookworm` tag does not
exist; it is `<version>-standard-bookworm`.* **A wrong tag fails at pull time,
which is at least loud.**

## Throwaway databases get no backup, deliberately

**For a class or a demo, a single instance with no archive configuration is
correct.** *WAL-archiving something you reset every session is wasted spend, and
the absence is a choice rather than an omission.*

**Anything that is not throwaway needs both halves** — see
[recovering data](recovering-data.md), *because backing up the database alone is
the failure that looks like success.*

## And the volumes cannot grow

**Size with headroom.** *See [storage](storage.md); this is where that constraint
bites hardest, because a database is the thing most likely to outgrow its
guess.*

---

## Checking this is still true

**Verified 2026-09-03.**

```sh
kubectl get cluster -A
kubectl cnpg status <name> -n <ns>          # brew install cloudnative-pg/tap/cnpg
kubectl get secret <name>-app -n <ns>
```