jeffryandClaude Opus 5
cc66e227a3
This repository is now the public half of a split: six documents saying what to decide, and one gap. How the cluster is built moved to jeffry/homelab-impl, which is private because its README is an inventory of chart versions and image tags. History starts here deliberately, and not as tidiness. The previous history contained that inventory, and this repository is public — a deletion commit would have removed it from the tree and left it in the log. A fresh root can only carry what is in it. Two pointers rewritten rather than deleted: private-access.md and .loom/README.md both directed a reader to TAILSCALE.md and README.md at the root, which are now private. They now say a fuller reference exists, that it is private, and how to ask — because a public page naming a private thing as its answer is the failure this project has now hit four times. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
68 lines
2.2 KiB
Markdown
68 lines
2.2 KiB
Markdown
# Give something a Postgres
|
|
|
|
**Run by an operator, not by you.** *Passwords are generated, replication is
|
|
handled at the database level, and a cluster of one is a fully supported
|
|
configuration rather than a degraded one.*
|
|
|
|
---
|
|
|
|
## It must live in the application's namespace
|
|
|
|
**The operator generates a secret named for the cluster**, and the application
|
|
has to be able to read it. **Different namespace, unreadable secret.**
|
|
|
|
*No database password appears in any values file, and none should.*
|
|
|
|
## Three services appear, and only one of them is usually right
|
|
|
|
| | |
|
|
|---|---|
|
|
| `<name>-rw` | **read/write — always the current primary.** *This is the one.* |
|
|
| `<name>-ro` | read-only replicas — **meaningless with one instance** |
|
|
| `<name>-r` | read, any instance |
|
|
|
|
## Deleting the cluster does not delete the disks
|
|
|
|
> **The operator does not reap volumes.** *Recreating with the same name adopts
|
|
> the old ones — so a reset that skips the volumes either fails or silently
|
|
> resurrects the data you meant to discard.*
|
|
|
|
```sh
|
|
kubectl delete cluster <name> -n <ns>
|
|
kubectl delete pvc -n <ns> -l cnpg.io/cluster=<name> # not optional
|
|
```
|
|
|
|
## The image tag is not the obvious one
|
|
|
|
**The naming convention changed.** *The plain `<version>-bookworm` tag does not
|
|
exist; it is `<version>-standard-bookworm`.* **A wrong tag fails at pull time,
|
|
which is at least loud.**
|
|
|
|
## Throwaway databases get no backup, deliberately
|
|
|
|
**For a class or a demo, a single instance with no archive configuration is
|
|
correct.** *WAL-archiving something you reset every session is wasted spend, and
|
|
the absence is a choice rather than an omission.*
|
|
|
|
**Anything that is not throwaway needs both halves** — see
|
|
[recovering data](recovering-data.md), *because backing up the database alone is
|
|
the failure that looks like success.*
|
|
|
|
## And the volumes cannot grow
|
|
|
|
**Size with headroom.** *See [storage](storage.md); this is where that constraint
|
|
bites hardest, because a database is the thing most likely to outgrow its
|
|
guess.*
|
|
|
|
---
|
|
|
|
## Checking this is still true
|
|
|
|
**Verified 2026-09-03.**
|
|
|
|
```sh
|
|
kubectl get cluster -A
|
|
kubectl cnpg status <name> -n <ns> # brew install cloudnative-pg/tap/cnpg
|
|
kubectl get secret <name>-app -n <ns>
|
|
```
|