Remove app-level CNPG resources from platform #17

Merged

forgejo_admin merged 1 commit from 16-remove-app-level-cnpg-resources-from-pla into main

2026-03-02 21:49:23 +00:00

forgejo_admin commented

2026-03-02 21:47:58 +00:00

Contributor

Summary

Remove app-level CNPG resources (cluster, scheduled backup, app credentials) from pal-e-platform
Platform should only own the CNPG operator and shared infrastructure
App-level Postgres concerns will be managed by pal-e-services

Changes

terraform/main.tf -- Removed 4 resource blocks: kubernetes_manifest.cnpg_cluster, kubernetes_manifest.cnpg_scheduled_backup, kubernetes_secret_v1.cnpg_superuser, kubernetes_secret_v1.paledocs_db_credentials
terraform/variables.tf -- Removed 3 variables: paledocs_db_username, paledocs_db_password, cnpg_superuser_password
terraform/outputs.tf -- Removed 2 outputs: cnpg_cluster_name, postgres_internal_dsn. Kept cnpg_namespace (shared infra)
terraform/k3s.tfvars.example -- Removed 2 example values: paledocs_db_password, cnpg_superuser_password

Preserved (shared platform infra):

helm_release.cnpg (operator), namespaces, MinIO bucket + CNPG IAM, kubernetes_secret_v1.cnpg_s3_creds, output "cnpg_namespace"

Test Plan

tofu fmt -check passes
tofu validate passes (Success! The configuration is valid.)
No dangling references to removed resources
After merge: tofu state rm the 4 removed resources, then tofu plan confirms clean state

Note: Do NOT run tofu plan or tofu state rm until after merge on the main workdir.

Review Checklist

No secrets committed
No unnecessary file changes
Commit messages are descriptive
tofu fmt and tofu validate pass

plan-2026-02-26-tf-modularize-postgres -- Phase 2b: cleanup platform
Forgejo issue: #16

## Summary - Remove app-level CNPG resources (cluster, scheduled backup, app credentials) from pal-e-platform - Platform should only own the CNPG operator and shared infrastructure - App-level Postgres concerns will be managed by pal-e-services ## Changes - `terraform/main.tf` -- Removed 4 resource blocks: `kubernetes_manifest.cnpg_cluster`, `kubernetes_manifest.cnpg_scheduled_backup`, `kubernetes_secret_v1.cnpg_superuser`, `kubernetes_secret_v1.paledocs_db_credentials` - `terraform/variables.tf` -- Removed 3 variables: `paledocs_db_username`, `paledocs_db_password`, `cnpg_superuser_password` - `terraform/outputs.tf` -- Removed 2 outputs: `cnpg_cluster_name`, `postgres_internal_dsn`. Kept `cnpg_namespace` (shared infra) - `terraform/k3s.tfvars.example` -- Removed 2 example values: `paledocs_db_password`, `cnpg_superuser_password` Preserved (shared platform infra): - `helm_release.cnpg` (operator), namespaces, MinIO bucket + CNPG IAM, `kubernetes_secret_v1.cnpg_s3_creds`, `output "cnpg_namespace"` ## Test Plan - [x] `tofu fmt -check` passes - [x] `tofu validate` passes (Success! The configuration is valid.) - [x] No dangling references to removed resources - [ ] After merge: `tofu state rm` the 4 removed resources, then `tofu plan` confirms clean state Note: Do NOT run `tofu plan` or `tofu state rm` until after merge on the main workdir. ## Review Checklist - [x] No secrets committed - [x] No unnecessary file changes - [x] Commit messages are descriptive - [x] `tofu fmt` and `tofu validate` pass ## Related Notes - `plan-2026-02-26-tf-modularize-postgres` -- Phase 2b: cleanup platform - Forgejo issue: #16

forgejo_admin added 1 commit

2026-03-02 21:47:58 +00:00

Remove app-level CNPG resources from platform c50f013da5

Platform should only own the CNPG operator and shared infra. App-level
resources (cluster, scheduled backup, app credentials) belong in
pal-e-services, not pal-e-platform.

Removed from main.tf:
- kubernetes_manifest.cnpg_cluster
- kubernetes_manifest.cnpg_scheduled_backup
- kubernetes_secret_v1.cnpg_superuser
- kubernetes_secret_v1.paledocs_db_credentials

Removed from variables.tf:
- paledocs_db_username, paledocs_db_password, cnpg_superuser_password

Removed from outputs.tf:
- cnpg_cluster_name, postgres_internal_dsn (kept cnpg_namespace)

Removed from k3s.tfvars.example:
- paledocs_db_password, cnpg_superuser_password

Kept (shared platform infra):
- helm_release.cnpg (operator)
- kubernetes_namespace_v1.cnpg_system, kubernetes_namespace_v1.postgres
- minio_s3_bucket.postgres_wal + CNPG IAM resources
- kubernetes_secret_v1.cnpg_s3_creds

Closes #16

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>