feat: add Crunchy Data PostgreSQL Operator for chat-api (#9)

* feat(infra): add Crunchy Data PostgreSQL Operator (PGO)

Add PGO operator as ArgoCD Application for managing PostgreSQL
clusters in Kubernetes. Deployed to postgres-operator namespace
with sync-wave 1.

- Helm chart: registry.developers.crunchydata.com/crunchydata/pgo
- Version: 5.7.4
- singleNamespace: false (manages all namespaces)

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <[email protected]>

* feat(chat): add PostgresCluster for chat-api

Create in-cluster PostgreSQL database for chat-api using PGO:
- PostgreSQL 16 with optimized configuration
- 10Gi data volume on Longhorn storage
- 5Gi backup volume for pgBackRest
- User: chatapi, Database: chat

PostgreSQL tuning for 2GB RAM / 2 CPU:
- max_connections: 150
- shared_buffers: 512MB
- effective_cache_size: 1536MB
- work_mem: 3495kB

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <[email protected]>

* feat(chat): configure chat-api to use PGO PostgreSQL

- Add PGO operator to dev cluster kustomization
- Update chat-api to use PGO-managed secret (chat-db-pguser-chatapi)
- Map PGO secret 'uri' key to DATABASE_URL via extraEnv
- Remove old postgree-secrets.yaml dependency

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <[email protected]>

* ci: skip PostgresCluster in kubeconform validation

PostgresCluster is a CRD from Crunchy Data PGO operator,
kubeconform doesn't have schema for it.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <[email protected]>

---------

Co-authored-by: Claude Opus 4.5 <[email protected]>

Author: justgithubaccount

.github/workflows/validate.yaml

@@ -38,7 +38,7 @@ jobs:
       - name: Kubeconform validation
         run: |
           kubeconform -summary -strict \
-            -skip Application,ApplicationSet,Certificate,ClusterIssuer,SealedSecret \
+            -skip Application,ApplicationSet,Certificate,ClusterIssuer,SealedSecret,PostgresCluster \
             rendered.yaml
 
       - name: OPA policy check

clusters/dev/kustomization.yaml

@@ -16,6 +16,8 @@ resources:
   - ../../platform/infrastructure/networking/external-dns/base
   # Storage
   - ../../platform/infrastructure/storage/longhorn/base
+  # Database
+  - ../../platform/infrastructure/database/pgo/base
   # AI Platform
   - ../../platform/infrastructure/ai-platform/open-webui/base
   # Observability

platform/infrastructure/database/pgo/base/application.yaml

@@ -0,0 +1,29 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: pgo-operator
+  namespace: argocd
+  annotations:
+    argocd.argoproj.io/sync-wave: "1"
+spec:
+  project: default
+  source:
+    repoURL: registry.developers.crunchydata.com/crunchydata
+    chart: pgo
+    targetRevision: "5.7.4"
+    helm:
+      values: |
+        singleNamespace: false
+  destination:
+    name: CLUSTER
+    namespace: postgres-operator
+  syncPolicy:
+    automated:
+      allowEmpty: true
+      selfHeal: true
+      prune: true
+    syncOptions:
+      - Validate=true
+      - CreateNamespace=true
+      - PruneLast=true
+      - ServerSideApply=true

platform/infrastructure/database/pgo/base/kustomization.yaml

@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - application.yaml

tenants/product-team/apps/chat/overlays/dev/kustomization.yaml

@@ -3,7 +3,7 @@ kind: Kustomization
 
 resources:
   - ../../base
-  - postgree-secrets.yaml
+  - postgres-cluster.yaml
   - openrouter-secrets.yaml
   - github-secrets.yaml
 
@@ -35,3 +35,10 @@ patches:
           ingress:
             enabled: true
             host: chat-dev.syncjob.ru
+          postgresSecretRefName: ""
+          extraEnv:
+            - name: DATABASE_URL
+              valueFrom:
+                secretKeyRef:
+                  name: chat-db-pguser-chatapi
+                  key: uri

tenants/product-team/apps/chat/overlays/dev/postgres-cluster.yaml

@@ -0,0 +1,64 @@
+apiVersion: postgres-operator.crunchydata.com/v1beta1
+kind: PostgresCluster
+metadata:
+  name: chat-db
+  namespace: chat-api
+spec:
+  postgresVersion: 16
+
+  instances:
+    - name: instance1
+      replicas: 1
+      dataVolumeClaimSpec:
+        storageClassName: longhorn
+        accessModes:
+          - ReadWriteOnce
+        resources:
+          requests:
+            storage: 10Gi
+      resources:
+        limits:
+          cpu: "2"
+          memory: 2Gi
+        requests:
+          cpu: "500m"
+          memory: 1Gi
+
+  backups:
+    pgbackrest:
+      repos:
+        - name: repo1
+          volume:
+            volumeClaimSpec:
+              storageClassName: longhorn
+              accessModes:
+                - ReadWriteOnce
+              resources:
+                requests:
+                  storage: 5Gi
+
+  patroni:
+    dynamicConfiguration:
+      postgresql:
+        parameters:
+          max_connections: "150"
+          shared_buffers: "512MB"
+          effective_cache_size: "1536MB"
+          maintenance_work_mem: "128MB"
+          checkpoint_completion_target: "0.9"
+          wal_buffers: "16MB"
+          default_statistics_target: "100"
+          random_page_cost: "1.1"
+          effective_io_concurrency: "200"
+          work_mem: "3495kB"
+          min_wal_size: "1GB"
+          max_wal_size: "4GB"
+          max_worker_processes: "2"
+          max_parallel_workers_per_gather: "1"
+          max_parallel_workers: "2"
+          max_parallel_maintenance_workers: "1"
+
+  users:
+    - name: chatapi
+      databases:
+        - chat