# cnpg-cluster — DIP 플랫폼 기본 배포값 (멀티 테넌트 운영 기준)

instances: 3

postgresql:
  # custom-values.yaml 과 동일하게 SUSE BCI 15.7 자체 빌드를 쓴다.
  # 근거·비용 → doc/decisions/0001-cnpg-postgresql-image.md
  # trivy 는 SLES 15.7 을 정상 커버한다(2026-07-29 재측정 — doc/analysis/sles-oval-measurement.md).
  # 실효 C/H 0/0, 게이트 PASS.
  imageName: "docker.io/wbsong111/cnpg-postgresql:18.4-bci15.7-hardened-20260729"

  parameters:
    max_connections: "200"
    shared_buffers: 512MB
    work_mem: 16MB
    maintenance_work_mem: 256MB
    effective_cache_size: 3GB
    log_timezone: Asia/Seoul
    timezone: Asia/Seoul
    # 감사 로깅 — pgaudit 대상 지정
    pgaudit.log: "ddl, role, write"
    pgaudit.log_catalog: "off"
    pgaudit.log_parameter: "on"

  sharedPreloadLibraries:
    - pgaudit
    - pg_stat_statements

  # 운영 환경은 최소 1개 동기 복제본을 요구한다.
  synchronous:
    method: any
    number: 1

primaryUpdateStrategy: unsupervised
primaryUpdateMethod: switchover

storage:
  size: 100Gi
  storageClass: longhorn

walStorage:
  enabled: true
  size: 50Gi
  storageClass: longhorn

resources:
  requests:
    cpu: "1"
    memory: 4Gi
  limits:
    cpu: "4"
    memory: 8Gi

bootstrap:
  initdb:
    database: appdb
    owner: appuser
    # 플랫폼은 Infisical 로 자격증명을 주입한다.
    secretName: "$INFISICAL_SECRET"
    encoding: UTF8
    postInitApplicationSQL: []

databases:
  - name: appdb
    owner: appuser
    ensure: present
    reclaimPolicy: retain
    extensions:
      - name: pg_stat_statements
      - name: pgaudit

enableSuperuserAccess: false

affinity:
  enablePodAntiAffinity: true
  # 운영 클러스터는 노드 수 >= instances 이므로 required 로 노드 분산을 강제한다.
  podAntiAffinityType: required
  topologyKey: kubernetes.io/hostname
  nodeSelector: {}
  tolerations: []

monitoring:
  enablePodMonitor: true

backup:
  enabled: true
  retentionPolicy: 30d
  barmanObjectStore:
    destinationPath: "s3://dip-pg-backup/cnpg"
    endpointURL: ""
    s3Credentials:
      accessKeyId:
        name: pg-backup-s3
        key: ACCESS_KEY_ID
      secretAccessKey:
        name: pg-backup-s3
        key: ACCESS_SECRET_KEY

scheduledBackup:
  enabled: true
  schedule: "0 0 2 * * *"

pooler:
  enabled: true
  instances: 2
  type: rw
  poolMode: transaction
  parameters:
    max_client_conn: "1000"
    default_pool_size: "25"