Add platform infrastructure configuration

services/platform-postgres/base/cluster.yaml

@@ -0,0 +1,46 @@
+apiVersion: postgresql.cnpg.io/v1
+kind: Cluster
+metadata:
+  name: platform-postgres
+  labels:
+    app.kubernetes.io/name: platform-postgres
+    app.kubernetes.io/component: database
+spec:
+  description: Shared platform PostgreSQL instance initialized for Gitea
+  instances: 1
+  imageName: ghcr.io/cloudnative-pg/postgresql:17.9-standard-trixie
+
+  bootstrap:
+    initdb:
+      dataChecksums: true
+      database: gitea
+      owner: gitea
+      secret:
+        name: gitea-db-credentials
+
+  postgresql:
+    pg_hba:
+      - host gitea gitea all scram-sha-256
+      - host all gitea all reject
+      - host keycloak keycloak all scram-sha-256
+      - host all keycloak all reject
+
+  storage:
+    size: 20Gi
+
+  managed:
+    services:
+      disabledDefaultServices:
+        - ro
+        - r
+
+  affinity:
+    enablePodAntiAffinity: false
+
+  resources:
+    requests:
+      cpu: 250m
+      memory: 512Mi
+    limits:
+      cpu: "2"
+      memory: 4Gi

services/platform-postgres/base/gitea-database-role.yaml

@@ -0,0 +1,22 @@
+apiVersion: postgresql.cnpg.io/v1
+kind: DatabaseRole
+metadata:
+  name: platform-postgres-gitea
+  labels:
+    app.kubernetes.io/name: gitea
+    app.kubernetes.io/component: database-role
+spec:
+  cluster:
+    name: platform-postgres
+  name: gitea
+  comment: Gitea application database owner
+  login: true
+  superuser: false
+  createdb: false
+  createrole: false
+  replication: false
+  bypassrls: false
+  connectionLimit: 50
+  passwordSecret:
+    name: gitea-db-credentials
+  databaseRoleReclaimPolicy: retain

services/platform-postgres/base/gitea-database.yaml

@@ -0,0 +1,14 @@
+apiVersion: postgresql.cnpg.io/v1
+kind: Database
+metadata:
+  name: platform-postgres-gitea
+  labels:
+    app.kubernetes.io/name: gitea
+    app.kubernetes.io/component: database
+spec:
+  cluster:
+    name: platform-postgres
+  name: gitea
+  owner: gitea
+  ensure: present
+  databaseReclaimPolicy: retain

services/platform-postgres/base/kustomization.yaml

@@ -0,0 +1,16 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+namespace: platform-data
+
+resources:
+  - cluster.yaml
+  - gitea-database-role.yaml
+  - gitea-database.yaml
+  - platform-postgres-network-policy.yaml
+
+labels:
+  - pairs:
+      app.kubernetes.io/part-of: platform
+      app.kubernetes.io/managed-by: kustomize
+    includeSelectors: false

services/platform-postgres/base/platform-postgres-network-policy.yaml

@@ -0,0 +1,53 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: platform-postgres-ingress
+  labels:
+    app.kubernetes.io/name: platform-postgres
+    app.kubernetes.io/component: database-network-policy
+spec:
+  podSelector:
+    matchLabels:
+      cnpg.io/cluster: platform-postgres
+  policyTypes:
+    - Ingress
+  ingress:
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: cnpg-system
+          podSelector:
+            matchLabels:
+              app.kubernetes.io/name: cloudnative-pg
+      ports:
+        - protocol: TCP
+          port: 8000
+        - protocol: TCP
+          port: 5432
+    - from:
+        - podSelector:
+            matchLabels:
+              cnpg.io/cluster: platform-postgres
+      ports:
+        - protocol: TCP
+          port: 8000
+        - protocol: TCP
+          port: 5432
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: gitea
+      ports:
+        - protocol: TCP
+          port: 5432
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: observability
+          podSelector:
+            matchLabels:
+              app.kubernetes.io/name: prometheus
+              app.kubernetes.io/instance: observability-core-kube-pr-prometheus
+      ports:
+        - protocol: TCP
+          port: 9187