fead: add CNPG

build/Dockerfile.business-operator

@@ -11,6 +11,13 @@ RUN CGO_ENABLED=0 go build -o app ./cmd/business-operator
 
 FROM alpine:3.20
 
+RUN addgroup -g 1000 operatorgroup && \
+    adduser -D -u 1000 -G operatorgroup operatoruser
+
+WORKDIR /app
+
 COPY --from=builder /app/app .
 
+USER 1000:1000
+
 CMD ["./app"]

deploy/k8s/business/business-configmap.yaml

@@ -10,3 +10,5 @@ data:
   BUSINESS_HTTP_SERVER_ALLOWED_METHODS: "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS"
   BUSINESS_HTTP_SERVER_ALLOWED_HEADERS: "Origin,Content-Type,Accept,Authorization"
   BUSINESS_HTTP_SERVER_EXPOSE_HEADERS: "Content-Length"
+  REDIS_HOST: "redis"
+  REDIS_PORT: "6379"

deploy/k8s/business/business-deploy.yaml

@@ -37,6 +37,26 @@ spec:
                 name: share-bite-business-config
             - secretRef:
                 name: share-bite-secrets
+          env:
+            - name: POSTGRES_HOST
+              value: share-bite-cnpg-rw
+            - name: POSTGRES_PORT
+              value: "5432"
+            - name: POSTGRES_DB
+              valueFrom:
+                secretKeyRef:
+                  name: share-bite-cnpg-app
+                  key: dbname
+            - name: POSTGRES_USER
+              valueFrom:
+                secretKeyRef:
+                  name: share-bite-cnpg-app
+                  key: username
+            - name: POSTGRES_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: share-bite-cnpg-app
+                  key: password
           readinessProbe:
             httpGet:
               path: /business/ready

deploy/k8s/guest/deployment.yaml

@@ -15,6 +15,7 @@ spec:
     spec:
       securityContext:
         runAsNonRoot: true
+        runAsUser: 1000
         seccompProfile:
           type: RuntimeDefault
       containers:
@@ -36,6 +37,26 @@ spec:
                 name: guest-api-config
             - secretRef:
                 name: share-bite-secrets
+          env:
+            - name: POSTGRES_HOST
+              value: share-bite-cnpg-rw
+            - name: POSTGRES_PORT
+              value: "5432"
+            - name: POSTGRES_DB
+              valueFrom:
+                secretKeyRef:
+                  name: share-bite-cnpg-app
+                  key: dbname
+            - name: POSTGRES_USER
+              valueFrom:
+                secretKeyRef:
+                  name: share-bite-cnpg-app
+                  key: username
+            - name: POSTGRES_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: share-bite-cnpg-app
+                  key: password
           livenessProbe:
             httpGet:
               path: /health

deploy/k8s/infra/cnpg.yaml

@@ -0,0 +1,15 @@
+apiVersion: postgresql.cnpg.io/v1
+kind: Cluster
+metadata:
+  name: share-bite-cnpg
+  namespace: share-bite-local
+spec:
+  imageName: ghcr.io/cloudnative-pg/postgresql:18
+  instances: 2
+  enableSuperuserAccess: true
+  bootstrap:
+    initdb:
+      database: share_bite
+      owner: share
+  storage:
+    size: 2Gi

deploy/k8s/infra/kustomization.yaml

@@ -3,7 +3,9 @@ kind: Kustomization
 resources:
 - namespace.yaml
 - configmap.yaml
-- postgres.yaml
+- cnpg.yaml 
+# for StatefulSet - use postgres.yaml instead of cnpg.yaml
+#- postgres.yaml
 - redis.yaml
 - secret.yaml
 - migrator-job.yaml

deploy/k8s/infra/migrator-job.yaml

@@ -19,6 +19,7 @@ spec:
             runAsGroup: 1000
             runAsNonRoot: true
             allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
             capabilities:
               drop:
                 - ALL
@@ -41,6 +42,23 @@ spec:
                 name: share-bite-infra-config
             - secretRef:
                 name: share-bite-secrets
+          env:
+            - name: POSTGRES_HOST
+              value: share-bite-cnpg-rw
+            - name: POSTGRES_PORT
+              value: "5432"
+            - name: POSTGRES_DB
+              value: share_bite
+            - name: POSTGRES_USER
+              valueFrom:
+                secretKeyRef:
+                  name: share-bite-cnpg-superuser
+                  key: username
+            - name: POSTGRES_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: share-bite-cnpg-superuser
+                  key: password
       containers:
         - name: migrator
           image: migrator:latest
@@ -50,6 +68,7 @@ spec:
             runAsGroup: 1000
             runAsNonRoot: true
             allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
             capabilities:
               drop:
                 - ALL
@@ -58,3 +77,20 @@ spec:
                 name: share-bite-infra-config
             - secretRef:
                 name: share-bite-secrets
+          env:
+            - name: POSTGRES_HOST
+              value: share-bite-cnpg-rw
+            - name: POSTGRES_PORT
+              value: "5432"
+            - name: POSTGRES_DB
+              value: share_bite
+            - name: POSTGRES_USER
+              valueFrom:
+                secretKeyRef:
+                  name: share-bite-cnpg-superuser
+                  key: username
+            - name: POSTGRES_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: share-bite-cnpg-superuser
+                  key: password

deploy/k8s/operators/business/example.yaml

@@ -2,8 +2,8 @@ apiVersion: business.sharebite.dev/v1alpha1
 kind: BusinessAppProfile
 metadata:
   name: business-api-example
-  namespace: default
+  namespace: share-bite-local
 spec:
-  replicas: 2
+  replicas: 3
   enabled: true
   deploymentName: business-api

deploy/k8s/operators/business/kustomization.yaml

@@ -0,0 +1,7 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: share-bite-local
+resources:
+  - crd.yaml
+  - operator-deployment.yaml
+  - rbac.yaml 

deploy/k8s/operators/business/operator-deployment.yaml

@@ -2,7 +2,6 @@ apiVersion: apps/v1
 kind: Deployment
 metadata: 
   name: business-operator
-  namespace: default
 spec:
   replicas: 1
   selector:

deploy/k8s/operators/guest/kustomization.yaml

@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - crd.yaml

deploy/k8s/operators/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - https://raw.githubusercontent.com/cloudnative-pg/cloudnative-pg/release-1.29/releases/cnpg-1.29.0.yaml
+  - ./business
+  - ./guest

internal/business/handler/business/handler.go

@@ -186,7 +186,9 @@ func (h *handler) ready(c *gin.Context) {
 
 	_, err := h.service.ListLocationTags(ctx)
 	if err != nil {
-		c.JSON(http.StatusServiceUnavailable, gin.H{"error": "service not ready"})
+		c.JSON(http.StatusServiceUnavailable, gin.H{
+			"error":   "service not ready",
+		})
 		return
 	}
 

migrations/20260617205326_grant_business_permissions.sql

@@ -0,0 +1,18 @@
+-- +goose Up
+GRANT USAGE ON SCHEMA business TO share;
+GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA business TO share;
+
+GRANT USAGE, SELECT ON ALL SEQUENCES IN SCHEMA business TO share;
+
+ALTER DEFAULT PRIVILEGES IN SCHEMA business GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO share;
+
+ALTER DEFAULT PRIVILEGES IN SCHEMA business GRANT USAGE, SELECT ON SEQUENCES TO share;
+
+
+-- +goose Down
+ALTER DEFAULT PRIVILEGES IN SCHEMA business REVOKE SELECT, INSERT, UPDATE, DELETE ON TABLES FROM share;
+ALTER DEFAULT PRIVILEGES IN SCHEMA business REVOKE USAGE, SELECT ON SEQUENCES FROM share;
+
+REVOKE SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA business FROM share;
+REVOKE USAGE, SELECT ON ALL SEQUENCES IN SCHEMA business FROM share;
+REVOKE USAGE ON SCHEMA business FROM share;