Remove app-level CNPG resources from platform (Phase 2b cleanup)

forgejo_admin commented

2026-03-02 21:45:08 +00:00

Contributor

Plan

plan-2026-02-26-tf-modularize-postgres -- Phase 2b (cleanup platform)

Repo

forgejo_admin/pal-e-platform

User Story

As a platform operator
I want app-level CNPG resources removed from the platform repo
So that the platform only owns the operator and shared infra, and app-level concerns live in pal-e-services

Context

The platform repo currently deploys both the CNPG operator (shared infra) and the pal-e-docs-specific Postgres cluster, backup schedule, and credentials (app-level). This violates the platform/service boundary. App-level CNPG resources (cluster, scheduled backup, app credentials) should be managed by pal-e-services, not pal-e-platform. The operator, shared namespace, shared S3 bucket, and shared IAM stay in platform.

File Targets

Files the agent should modify:

terraform/main.tf -- remove 4 resource blocks (cnpg_cluster, cnpg_scheduled_backup, cnpg_superuser, paledocs_db_credentials)
terraform/variables.tf -- remove 3 variables (paledocs_db_username, paledocs_db_password, cnpg_superuser_password)
terraform/outputs.tf -- remove 2 outputs (cnpg_cluster_name, postgres_internal_dsn), keep cnpg_namespace
terraform/k3s.tfvars.example -- remove 2 lines (paledocs_db_password, cnpg_superuser_password)

Files the agent should NOT touch:

terraform/providers.tf -- no changes needed
terraform/versions.tf -- no changes needed
Anything under salt/ -- host-level, unrelated

Acceptance Criteria

kubernetes_manifest.cnpg_cluster resource block is removed from main.tf
kubernetes_manifest.cnpg_scheduled_backup resource block is removed from main.tf
kubernetes_secret_v1.cnpg_superuser resource block is removed from main.tf
kubernetes_secret_v1.paledocs_db_credentials resource block is removed from main.tf
Variables paledocs_db_username, paledocs_db_password, cnpg_superuser_password removed from variables.tf
Outputs cnpg_cluster_name, postgres_internal_dsn removed from outputs.tf
Output cnpg_namespace is preserved in outputs.tf
paledocs_db_password and cnpg_superuser_password removed from k3s.tfvars.example
All shared infra resources (helm_release.cnpg, namespaces, MinIO bucket/IAM, cnpg_s3_creds) are preserved
No dangling references -- removed resources are not referenced by kept resources
tofu fmt passes
tofu validate passes

Test Expectations

tofu fmt -check returns 0
tofu validate returns success
No references to removed resources remain in kept code
Run command: tofu fmt -check && tofu validate (in terraform/ directory)

Constraints

IaC is OpenTofu (tofu not terraform)
Do NOT run tofu plan or tofu state rm -- those happen after merge on main workdir
Remote is forgejo (not origin)
Run tofu fmt and tofu validate before pushing

Checklist

PR opened
Tests pass
No unrelated changes

plan-2026-02-26-tf-modularize-postgres -- Terraform modularization of Postgres

### Plan `plan-2026-02-26-tf-modularize-postgres` -- Phase 2b (cleanup platform) ### Repo `forgejo_admin/pal-e-platform` ### User Story As a platform operator I want app-level CNPG resources removed from the platform repo So that the platform only owns the operator and shared infra, and app-level concerns live in pal-e-services ### Context The platform repo currently deploys both the CNPG operator (shared infra) and the pal-e-docs-specific Postgres cluster, backup schedule, and credentials (app-level). This violates the platform/service boundary. App-level CNPG resources (cluster, scheduled backup, app credentials) should be managed by pal-e-services, not pal-e-platform. The operator, shared namespace, shared S3 bucket, and shared IAM stay in platform. ### File Targets Files the agent should modify: - `terraform/main.tf` -- remove 4 resource blocks (cnpg_cluster, cnpg_scheduled_backup, cnpg_superuser, paledocs_db_credentials) - `terraform/variables.tf` -- remove 3 variables (paledocs_db_username, paledocs_db_password, cnpg_superuser_password) - `terraform/outputs.tf` -- remove 2 outputs (cnpg_cluster_name, postgres_internal_dsn), keep cnpg_namespace - `terraform/k3s.tfvars.example` -- remove 2 lines (paledocs_db_password, cnpg_superuser_password) Files the agent should NOT touch: - `terraform/providers.tf` -- no changes needed - `terraform/versions.tf` -- no changes needed - Anything under `salt/` -- host-level, unrelated ### Acceptance Criteria - [ ] `kubernetes_manifest.cnpg_cluster` resource block is removed from main.tf - [ ] `kubernetes_manifest.cnpg_scheduled_backup` resource block is removed from main.tf - [ ] `kubernetes_secret_v1.cnpg_superuser` resource block is removed from main.tf - [ ] `kubernetes_secret_v1.paledocs_db_credentials` resource block is removed from main.tf - [ ] Variables `paledocs_db_username`, `paledocs_db_password`, `cnpg_superuser_password` removed from variables.tf - [ ] Outputs `cnpg_cluster_name`, `postgres_internal_dsn` removed from outputs.tf - [ ] Output `cnpg_namespace` is preserved in outputs.tf - [ ] `paledocs_db_password` and `cnpg_superuser_password` removed from k3s.tfvars.example - [ ] All shared infra resources (helm_release.cnpg, namespaces, MinIO bucket/IAM, cnpg_s3_creds) are preserved - [ ] No dangling references -- removed resources are not referenced by kept resources - [ ] `tofu fmt` passes - [ ] `tofu validate` passes ### Test Expectations - [ ] `tofu fmt -check` returns 0 - [ ] `tofu validate` returns success - [ ] No references to removed resources remain in kept code - Run command: `tofu fmt -check && tofu validate` (in terraform/ directory) ### Constraints - IaC is OpenTofu (`tofu` not `terraform`) - Do NOT run `tofu plan` or `tofu state rm` -- those happen after merge on main workdir - Remote is `forgejo` (not `origin`) - Run `tofu fmt` and `tofu validate` before pushing ### Checklist - [ ] PR opened - [ ] Tests pass - [ ] No unrelated changes ### Related - `plan-2026-02-26-tf-modularize-postgres` -- Terraform modularization of Postgres