uralkal: тестовый PostgreSQL с TLS и notes-backend с verify-full (п.31, INFRA-3062)

ns postgres-tls-test: postgresql-contour pg-tls с tls.autoGenerated,
ssl_min_protocol_version TLSv1.2, pg_hba только hostssl (local для
администрирования); notes-tls на образе notes-backend с
PG_SSL_MODE/PGSSLMODE=verify-full и CA из pg-tls-crt.
regcred в ns создаётся вручную.

apps/postgres-tls-test/uralkal/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - namespace.yaml
+  - postgresql.yaml
+  - notes-tls.yaml

apps/postgres-tls-test/uralkal/namespace.yaml

@@ -0,0 +1,5 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: postgres-tls-test

apps/postgres-tls-test/uralkal/notes-tls.yaml

@@ -0,0 +1,119 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: notes-tls
+  namespace: postgres-tls-test
+spec:
+  interval: 10m
+  dependsOn:
+    - name: pg-tls
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.9"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    remediation:
+      retries: 3
+  values:
+    global:
+      env: _default
+    services:
+      backend:
+        enabled: true
+        deployment:
+          enabled: true
+          name:
+            _default: notes-tls
+          replicaCount:
+            _default: 1
+          port:
+            _default: 8000
+          resources:
+            requests:
+              cpu:
+                _default: 25m
+              memory:
+                _default: 128Mi
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/notes-backend:preprod_c00faf6e
+          pullPolicy:
+            _default: IfNotPresent
+        service:
+          enabled: true
+          name:
+            _default: notes-tls
+          type:
+            _default: ClusterIP
+          port:
+            _default: 8000
+          targetPort:
+            _default: 8000
+          portName:
+            _default: http
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: regcred
+        envs:
+          - name: PG_HOST
+            value:
+              _default: pg-tls.postgres-tls-test.svc.cluster.local
+          - name: PG_PORT
+            value:
+              _default: "5432"
+          - name: PG_DB
+            value:
+              _default: notes
+          - name: PG_LOGIN
+            value:
+              _default: notes
+          - name: PG_SSL
+            value:
+              _default: "true"
+          - name: PG_SSL_MODE
+            value:
+              _default: verify-full
+          - name: PGSSLMODE
+            value:
+              _default: verify-full
+          - name: PGSSLROOTCERT
+            value:
+              _default: /etc/pg-ca/ca.crt
+          - name: DJANGO_USE
+            value:
+              _default: "false"
+          - name: TIMEOUT
+            value:
+              _default: "120"
+        secretEnvs:
+          - name: PG_PASSWORD
+            secretName:
+              _default: pg-tls
+            secretKey:
+              _default: password
+        volumes:
+          _default:
+            - name: pg-ca
+              mountPath: /etc/pg-ca
+              readOnly: true
+              secret:
+                secretName: pg-tls-crt
+                items:
+                  - key: ca.crt
+                    path: ca.crt

apps/postgres-tls-test/uralkal/postgresql.yaml

@@ -0,0 +1,56 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: pg-tls
+  namespace: postgres-tls-test
+spec:
+  interval: 10m
+  timeout: 15m
+  chart:
+    spec:
+      chart: postgresql-contour
+      version: "17.0.7"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    remediation:
+      retries: 3
+  values:
+    fullnameOverride: pg-tls
+    global:
+      security:
+        allowInsecureImages: true
+      defaultStorageClass: local-path
+      imagePullSecrets:
+        - regcred
+    image:
+      registry: cr.yandex/crp3ccidau046kdj8g9q
+      repository: contour/postgresql
+      tag: 17.0.7
+    auth:
+      username: notes
+      database: notes
+    metrics:
+      enabled: false
+    tls:
+      enabled: true
+      autoGenerated: true
+    primary:
+      persistence:
+        storageClass: local-path
+        size: 1Gi
+      nodeSelector:
+        dedicated: generic
+      extendedConfiguration: |
+        ssl_min_protocol_version = 'TLSv1.2'
+      pgHbaConfiguration: |
+        local all all scram-sha-256
+        hostssl all all 0.0.0.0/0 scram-sha-256
+        hostssl all all ::/0 scram-sha-256

clusters/uralkal/kustomization.yaml

@@ -54,6 +54,7 @@ resources:
   - ../../apps/pm/uralkal
   - ../../apps/message-hub/uralkal
   - ../../apps/cde/uralkal
+  - ../../apps/postgres-tls-test/uralkal
 
 patches:
   - target: