From 5073b2bb47587141497115e312cd41c7211e0a02 Mon Sep 17 00:00:00 2001
From: 2ubyz <poomdech.j@opsta.co.th>
Date: Fri, 27 Mar 2026 16:31:00 +0700
Subject: [PATCH 1/5] Add CNPG Template

---
 charts/cnpg/Chart.yaml                        |  8 +++
 charts/cnpg/templates/cluster.yaml            | 69 +++++++++++++++++++
 charts/cnpg/templates/scheduled-backup.yaml   | 13 ++++
 .../cnpg/templates/secret-admin-postgres.yaml | 10 +++
 charts/cnpg/templates/secret-postgres.yaml    | 10 +++
 charts/cnpg/templates/secret-s3.yaml          | 11 +++
 charts/cnpg/values.yaml                       | 53 ++++++++++++++
 charts/onechart/Chart.yaml                    |  4 ++
 values.yaml                                   | 28 ++++++++
 9 files changed, 206 insertions(+)
 create mode 100644 charts/cnpg/Chart.yaml
 create mode 100644 charts/cnpg/templates/cluster.yaml
 create mode 100644 charts/cnpg/templates/scheduled-backup.yaml
 create mode 100644 charts/cnpg/templates/secret-admin-postgres.yaml
 create mode 100644 charts/cnpg/templates/secret-postgres.yaml
 create mode 100644 charts/cnpg/templates/secret-s3.yaml
 create mode 100644 charts/cnpg/values.yaml

diff --git a/charts/cnpg/Chart.yaml b/charts/cnpg/Chart.yaml
new file mode 100644
index 0000000..1d5c959
--- /dev/null
+++ b/charts/cnpg/Chart.yaml
@@ -0,0 +1,8 @@
+apiVersion: v1
+description: CNPG (China Postgres)
+name: cnpg
+version: 0.1.0
+appVersion: 0.1.0
+maintainers:
+  - name: Developer
+    email: dev@opsta.in.th
diff --git a/charts/cnpg/templates/cluster.yaml b/charts/cnpg/templates/cluster.yaml
new file mode 100644
index 0000000..4bb827f
--- /dev/null
+++ b/charts/cnpg/templates/cluster.yaml
@@ -0,0 +1,69 @@
+{{- if .Values.enabled }}
+#{{- $cnpg := .Values.cnpg -}}
+{{- $backup := .Values.backup -}}
+{{- $bos := $backup.barmanObjectStore -}}
+{{- $s3 := $bos.s3Credentials -}}
+{{- $defaultS3Secret := printf "%s-cnpg-s3-creds" .Release.Name | trunc 63 | trimSuffix "-" -}}
+
+
+{{- $s3SecretName := $defaultS3Secret -}}
+
+{{- if and $backup.enabled (not $s3SecretName) -}}
+{{- fail "backup.enabled=true but S3 secret name resolved empty (unexpected)" -}}
+{{ end }}
+
+apiVersion: postgresql.cnpg.io/v1
+kind: Cluster
+metadata:
+  name: {{ printf "%s-cnpg" .Release.Name | trunc 63 | trimSuffix "-" | quote }}
+spec:
+  imageName: {{ .Values.cluster.imageName | quote }}
+  instances: {{ .Values.cluster.instances }}
+
+  {{- if .Values.superuser.enabled }}
+  enableSuperuserAccess: true
+  superuserSecret:
+    name: {{ printf "%s-cnpg-superuser-secret" .Release.Name | trunc 63 | trimSuffix "-" | quote }}
+  {{ end }}
+
+  {{- with .Values.cluster.resources }}
+  resources:
+    {{- toYaml . | nindent 4 }}
+  {{ end }}
+
+  storage:
+    size: {{ .Values.cluster.storage.size | quote }}
+    storageClass: {{ .Values.cluster.storage.storageClass | quote }}
+
+  walStorage:
+    size: {{ .Values.cluster.walStorage.size | quote }}
+    storageClass: {{ .Values.cluster.walStorage.storageClass | quote }}
+
+  {{- if $backup.enabled }}
+  backup:
+    retentionPolicy: {{ $backup.retentionPolicy | quote }}
+    barmanObjectStore:
+      serverName: {{ printf "%s-cnpg-backup" .Release.Name | trunc 63 | trimSuffix "-" | quote }}
+      destinationPath: {{ $bos.destinationPath | quote }}
+      endpointURL: {{ $bos.endpointURL | quote }}
+      s3Credentials:
+        accessKeyId:
+          name: {{ $s3SecretName | quote }}
+          key: {{ default "S3_ACCESS_KEY" $s3.accessKeyKey | quote }}
+        secretAccessKey:
+          name: {{ $s3SecretName | quote }}
+          key: {{ default "S3_SECRET_KEY" $s3.secretKeyKey | quote }}
+      data:
+        compression: {{ $bos.compression.data | quote }}
+      wal:
+        compression: {{ $bos.compression.wal | quote }}
+  {{ end }}
+
+  {{- if .Values.bootstrap.enabled }}
+  bootstrap:
+    initdb:
+      {{- toYaml .Values.bootstrap.initdb | nindent 6 }}
+      secret:
+        name: {{ printf "%s-cnpg-app-creds" .Release.Name | trunc 63 | trimSuffix "-" | quote }}
+  {{ end }}
+{{ end }}
diff --git a/charts/cnpg/templates/scheduled-backup.yaml b/charts/cnpg/templates/scheduled-backup.yaml
new file mode 100644
index 0000000..a54d020
--- /dev/null
+++ b/charts/cnpg/templates/scheduled-backup.yaml
@@ -0,0 +1,13 @@
+{{- if and .Values.enabled .Values.scheduledBackup.enabled }}
+apiVersion: postgresql.cnpg.io/v1
+kind: ScheduledBackup
+metadata:
+  name: {{ printf "%s-scheduled-backup" .Release.Name | trunc 63 | trimSuffix "-" | quote }}
+spec:
+  schedule: {{ .Values.scheduledBackup.schedule | quote }}
+  backupOwnerReference: {{ .Values.scheduledBackup.backupOwnerReference | quote }}
+  cluster:
+    name: {{ printf "%s-cnpg" .Release.Name | trunc 63 | trimSuffix "-" | quote }}
+  immediate: {{ .Values.scheduledBackup.immediate }}
+{{- end }}
+
diff --git a/charts/cnpg/templates/secret-admin-postgres.yaml b/charts/cnpg/templates/secret-admin-postgres.yaml
new file mode 100644
index 0000000..b92a334
--- /dev/null
+++ b/charts/cnpg/templates/secret-admin-postgres.yaml
@@ -0,0 +1,10 @@
+{{- if and .Values.enabled .Values.superuser.enabled }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ printf "%s-cnpg-superuser-secret" .Release.Name | trunc 63 | trimSuffix "-" | quote }}
+type: {{ default "kubernetes.io/basic-auth" }}
+stringData:
+  username: postgres
+  password: {{ randAlphaNum 8 | quote }}
+{{- end }}
diff --git a/charts/cnpg/templates/secret-postgres.yaml b/charts/cnpg/templates/secret-postgres.yaml
new file mode 100644
index 0000000..ccab927
--- /dev/null
+++ b/charts/cnpg/templates/secret-postgres.yaml
@@ -0,0 +1,10 @@
+{{- if and .Values.enabled .Values.postgresAuth.create }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ printf "%s-cnpg-app-creds" .Release.Name | trunc 63 | trimSuffix "-" | quote }}
+type: {{ .Values.postgresAuth.type | default "kubernetes.io/basic-auth" }}
+stringData:
+  username: {{ .Values.postgresAuth.username | quote }}
+  password: {{ .Values.postgresAuth.password | quote }}
+{{- end }}
diff --git a/charts/cnpg/templates/secret-s3.yaml b/charts/cnpg/templates/secret-s3.yaml
new file mode 100644
index 0000000..6ec71ab
--- /dev/null
+++ b/charts/cnpg/templates/secret-s3.yaml
@@ -0,0 +1,11 @@
+{{- $s3 := .Values.backup.barmanObjectStore.s3Credentials -}}
+{{- if and .Values.enabled .Values.backup.enabled ($s3.create) }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ printf "%s-cnpg-s3-creds" .Release.Name | trunc 63 | trimSuffix "-" | quote }}
+type: Opaque
+stringData:
+  {{ default "S3_ACCESS_KEY" $s3.accessKeyKey }}: {{ required "accessKeyValue required when create=true" $s3.accessKeyValue | quote }}
+  {{ default "S3_SECRET_KEY" $s3.secretKeyKey }}: {{ required "secretKeyValue required when create=true" $s3.secretKeyValue | quote }}
+{{- end }}
diff --git a/charts/cnpg/values.yaml b/charts/cnpg/values.yaml
new file mode 100644
index 0000000..b000cd1
--- /dev/null
+++ b/charts/cnpg/values.yaml
@@ -0,0 +1,53 @@
+enabled: true
+
+superuser:
+  enabled: true
+
+cluster:
+  imageName: ghcr.io/cloudnative-pg/postgresql:16.8-13-bullseye
+  instances: 3
+  storage:
+    size: 5Gi
+    storageClass: standard
+  walStorage:
+    size: 2Gi
+    storageClass: standard
+  resources:
+    requests:
+      cpu: "500m"
+      memory: "1Gi"
+    limits:
+      cpu: "2"
+      memory: "4Gi"
+
+postgresAuth:
+  create: true
+  username: cnpg
+  password: P@ssw0rd123
+
+backup:
+  enabled: true
+  retentionPolicy: "7d"
+  barmanObjectStore:
+    destinationPath: s3://postgres-backups/
+    endpointURL: https://opsta.in.th/buckets/
+    s3Credentials:
+      create: true
+      accessKeyValue: accesskey
+      secretKeyValue: secretkey
+    compression:
+      data: gzip
+      wal: gzip
+
+scheduledBackup:
+  enabled: true
+  schedule: "0 0 * * *"
+  backupOwnerReference: self
+  immediate: true
+
+bootstrap:
+  enabled: true
+  initdb: 
+    database: cnpg
+    owner: cnpg
+
diff --git a/charts/onechart/Chart.yaml b/charts/onechart/Chart.yaml
index 4731cea..a441002 100644
--- a/charts/onechart/Chart.yaml
+++ b/charts/onechart/Chart.yaml
@@ -21,3 +21,7 @@ dependencies:
   - name: common
     version: 0.9.0
     repository: file://../common
+
+  - name: cnpg
+    version: 0.1.0
+    repository: file://../cnpg
diff --git a/values.yaml b/values.yaml
index 1451640..43980da 100644
--- a/values.yaml
+++ b/values.yaml
@@ -30,3 +30,31 @@ probe:
 
 podSpec:
   hostNetwork: true
+
+cnpg:
+  enabled: false
+
+  cluster:
+    instances: 3
+    storage:
+      size: 5Gi
+      storageClass: external-nfs
+    walStorage:
+      size: 2Gi
+      storageClass: external-nfs
+
+  postgresAuth:
+    username: 
+    password: 
+
+  backup:
+    retentionPolicy: "7d"
+    barmanObjectStore:
+      endpointURL: https://seaweedfs-admin.mea-poc.opsta.in.th/buckets/
+      s3Credentials:
+        accessKeyValue: 
+        secretKeyValue: 
+  bootstrap:
+    initdb: 
+      database: cnpg
+      owner: cnpg
\ No newline at end of file

From c45cfcfa3cdb87507a1438a07f00de900568143c Mon Sep 17 00:00:00 2001
From: 2ubyz <poomdech.j@opsta.co.th>
Date: Fri, 27 Mar 2026 17:20:48 +0700
Subject: [PATCH 2/5] Add CNPG Dependency

---
 charts/onechart/Chart.lock              |   7 +++++--
 charts/onechart/charts/cnpg-0.1.0.tgz   | Bin 0 -> 1715 bytes
 charts/onechart/charts/common-0.9.0.tgz | Bin 3215 -> 3214 bytes
 3 files changed, 5 insertions(+), 2 deletions(-)
 create mode 100644 charts/onechart/charts/cnpg-0.1.0.tgz

diff --git a/charts/onechart/Chart.lock b/charts/onechart/Chart.lock
index 35869c1..ba294ab 100644
--- a/charts/onechart/Chart.lock
+++ b/charts/onechart/Chart.lock
@@ -2,5 +2,8 @@ dependencies:
 - name: common
   repository: file://../common
   version: 0.9.0
-digest: sha256:c691781bff5490003ec6b84de1a1f71ab89d193325e5f5fe1c83b8c1398e2273
-generated: "2026-02-09T14:47:43.892718793+07:00"
+- name: cnpg
+  repository: file://../cnpg
+  version: 0.1.0
+digest: sha256:31c485857050d6ca5163882dcea296372d4b86d751ba56579102dde793cbeddd
+generated: "2026-03-27T17:18:51.484489+07:00"
diff --git a/charts/onechart/charts/cnpg-0.1.0.tgz b/charts/onechart/charts/cnpg-0.1.0.tgz
new file mode 100644
index 0000000000000000000000000000000000000000..fe432a48c8efa4c2fa7c4609a246006869e426e2
GIT binary patch
literal 1715
zcmV;k22A-MiwG0|00000|0w_~VMtOiV@ORlOnEsqVl!4SWK%V1T2nbTPgYhoO;>Dc
zVQyr3R8em|NM&qo0PI;`Z{xTT&$B+oz`X*S0+J=mb`Am#xYQRciY>B1+%9lW2U;52
zY$Qq{Df_ZczI#Fa7cIxx#OrKPPaa~5Gvsi{`SC~6XUU>JSrRU-2NH#6-$QKMw#UO^
z_TRQ`{l7gJjL)2rGj@if;n*3S+0MXm?K7~yi#M92LK1#vzqv1caQ`Dh68Z(XpfU4c
z<rpMMs-kT<mTd$md`=UYeVSa~e1s2^C1nI|Vj&kC#kmm?$|Ru-x$q1VFd{VcAi&kH
zaUvwKD6{0!0AM6S4}QZHhH--2$jfR48mo4v?;Vx@AIb86MZy%tcLRVu`R|Mej-LPS
zcznwLV+b-b3o-CO@)Qk2qzUp=AomOat<DcqA@dp<kp*67>AP6^+@f*c592goMA8+S
z$)cYW=x`r;&e;0dbX;?mhM~X*RQ60r!h94SxCVfbF((UDEdvPp6+IYzq<JZ?nuJ6M
z50q6vcwhjmNjTj$8|*XVDB_f>o-;j;_bCcllmPrB^`JMh?Wk9Li7<-!g9kn5Bh9~s
zG@`o2U`u_d)QvI>m#JJT3!fvASVR;+MY@5400|Ld9rM70n_q=k+dOavu3^lGf0riP
zbD{<yktuM#i9_nEjxPe`%Z%`du+Ovqpf6RNiYNsrBvrE%vl}9p9thX#SCeJt{fK_1
zi!4ZD%H+Rq|LMU}%0zhmego0_v(&#sS!fG)!ZA?3kgyI;d$>x7@1qc(@ZpOB9j_?g
z;X_d`(B~-Y`n+7$`*D<T6xm);7z9KT4;Ei(QhZpGuqYeCUt*Ak82o)_0814QdN$bb
zH}#hXP+5FlGvv28M~=+Tyb0&o`j0T6_0Wu297`cN>Fk0sDubB^M(OU1h<eHaV%14e
zKK9m^;lIQv35i6}FLL~_TfrXuA1bhK<Nt6px;WwgF=VqbfzHADl2d?U>B7^K@fTI~
zlUg6({Zc7pW%KFD$ZGQ>Y1S8CYK>T^>O#}nf~8thxVd61tQMBk8UfBp8p^3V%`ic!
zC!8`lhu&X>sXQ}<Yx*1m(F5xiLnHz%wN1gJ%0=eG*v)>@XqwLF^iSxSy{vts^dWCL
zvr*pYU1qvP%m@prag}lVz+%~M=DhNMPG|_dw!tq7B4CzEn7RejWi&b4r@|EmfKehJ
z;6uvr&jfvm!FjJ}Q314?D5J^Y>wPzyDz!7O9OI6%z=KJi+(v|wWT;tj^36t%<hKOy
z5$@AiqVh!~=xYRFv#A$Pfi6{T)3n73x{S)&Y|H@K%B`47a}AeRJS{6Pv)!f!|MGi2
zU-_1@D<o#6ZRRue$`~ovtGUa^v8HmlHQ<V><VG5EQD!p!okSs6@Cb}Dl`t^u=%IsN
zb;P&OvXnyGU7b!nXWUS1HnNkjb+lD0zRs7X{cd-P<)bHX)=5pbItbQgQyFP>x~Drh
znBq8mh5UNgI?G#s_3G;6d70O-u(XP8%NFY^tr{P<EjpQBgXsMus6RHcs|~hWttz?0
zJl+KgLvQN-aXFb>O{af+y86ARny{*FKH=5`)O_-?)H<Xq)2qqt)xT<2D(c$lN{P4y
zGj0&sD$I?KmQvqtL~+}fx3MPS9^h#JXhmVQTxc@eipv&0G(l*qnOwDjP2<LzY2fX%
zm`jr6+jsOGW3GR_H|zRwMC1R}fvEtYgB%3*-T&AFTjT%Z!Pq(R|6@pl%j#!<idnS}
z(M@=GDf67Ro7l@h^=0@*Hd>$Y8+1V*R#|SNNB1?rGtG1vw3}?)qaB=ox2`6h@v_o_
z;&4)K3-7%iPjXz*@ju&_O%g<unPo=5brab4{x`CR8vb9nwtK?=W5`SJzw2bJy&D!V
zpRJx3-7g&KFfAVvY!malbcURvM4`5z84=VsNh+7UY)6osvc+$ObM^Imxzt-%@S6>A
z!h*{%S(58Cf}fimH$d~f=kP7ko&Sf*{9N|szsh-?{|!#>|3{G*<bU%G%gSGL4uSx0
zJ=#^N-|48Tg~vC-!mh?kjW+daAxEcOsqy0gNq7DW_mD3@d(VI4f&Tt8z8IeJ{}|GE
zdTBr5Y(LfPc$V3N9{K~xPr@xg<oqx^;uSAGTOjf|A@?b2Fz_uGk55lIUBLU4atxr?
ze&((#)=Ol?vv~IQqqUW5>-SeLzI5Djqy3t`&karchXJXRoa7`YImyB0zX1RM|No*D
J0L}m|004<BS$Y5f

literal 0
HcmV?d00001

diff --git a/charts/onechart/charts/common-0.9.0.tgz b/charts/onechart/charts/common-0.9.0.tgz
index 7d70cb742fff2b24dc798c3b89ac98b0f5d49e56..ed1a7ad8c8fcebfbe305279adcc74a66a323c237 100644
GIT binary patch
delta 3122
zcmV-249)Y88IBo{P5~W}PZ@tF*(3+&9nKq`CpjQ#Nfaf2q;;L<zymb3_&NNTABQs|
zMSMEtZ2xpZgbJ_7G<mdn>U27t{?U>7ztidX|984a2ameFZohlfJL-3Pk2>9hqkjJp
zbiM&EHOizS;!)?T`|=0(K!~LD0}4qw8^G)!h*3s@rpi2@z^|B0A<}<)14dlHZ`lw9
zLxnP6WQqf@yC+arDGnf^LqWt<Fw5KPg#Q<Ig8Lrfj+W6}{uNHsgea8zpCZmibUY>L
z#^7L;{P&K#p8WTEhle})-v(V@w;{$6We6?17s7G_s5EIo`}Q`_rRWI44<yM@hBG20
z+};N5b~~s5NH_RQSv-G$Q`5w2k_J;$BqoXs0sxB{*VmBmwxUbHhnZAw$P`-;zQY8G
z#85x#UTj5~lE~Js6fnuQR6>TBNZk>DVVFfp79+GKm`vLS#X?)A1tHu3qbx?I;7C`u
zJnCwKurb2kXS{j_doz;2;OE-FbqA&h+};|VOu-xYE91&=qZ@xh7BBdzr}VxTeol?@
zuLxx*wk7`u{lmKa_qsdz-v%|y|9k@!^4}o2OGQ><lnJV?PB~L}sRn_SNX7r3Op`*I
zyi$%x9_U8sl#FozEiLl%8YU?em~u%K7e@SQ*@}$eMh}W)iGt9owkK&ihbg$dZP~WZ
zvLrd<35~8Su2g?oNsCOV1E8KMVr6>%QxCE2wjw8(Bo-^$(2o4<yoF}WNV!llpEWuH
z##K?%<mC<9g_$Uo8rUnA?u-jHsP^aN*xCT8;EG2)8NmC~vw3frNX#KF2g4;@>n>OU
z)Qudh-?bfl<-wcyRPZ5&$jC53lP{3Ol%bSoI!8~Lo{WEAP}y@JC2CTc2it&7E;w0h
zs$?`lJ>Fm6zt7pdplaf^D^V%R#<CnnzUBSRT^nTccoRCqVs!4fD;cYYU2SLc!>_i#
zv1xGky+Fw`5orM(GcM4s{yfc*l||)$r&F5mUV(pQD3zluc+gZ<&WrjAgD)-1o4L!l
z?awXYf5U(IpGn21FKL3O8@dUs)c<>Z@BBaR9q!Kmtx(hX->?BHH-YM*Fyl!!MMu`P
z4321mxiaugZV5l7f-*IN)(^7%gKWWGRR=L=(vzm!!(Q|CA@5xSp~L(DZVK5p=|)#!
z%148WKm&Z|O20#O`A0T;Dfsjqjy81xSRw!2e*J&`-#^;j|F=R7^6zW_-vGb`{N(?0
z@5WEcM~RU@^}=c_Po6kRKS?k?H@VVH)(LNn)aGe;Nu|~!3Y?Jjym>>0$vNYLMdk{v
zwMKbc?{H*K|1Y*ncrso^MW4TU_jZ^~eOI(-0B&rsB(Zt<lXI^bk-6%z78~Uht~C*x
zV#a@2gvx$cJspMdreP)aRxL%X+tQS@bO{>kENk1@%B!3Is@?Ui^us#->r>8-X-oLu
z>2-Yluh;MG@P8}Rfd9@0Sfcior3zE9)#_}bukl$I(c6^#m0`2Gw}wJ@XMJv=Jy*Iy
z+ic4n_K%Q756YPP1yq;+2_`8Dsn>o(eXM_!|AQl6{yY8NPX4z+*Vp?`VMeC|kf=Zl
zwU*SMr+QkV2@c@tzP{e*V!^3EeSDS27N`kP5D^ALgiK-#L^@7l$ju){WS;?Hrhv?b
zF`p93^uq-vN$~Lk{{7E?!S6&-1_>&KLOz3-j;WH*AY(BK8F7K|<EI}X3_kv0ij#jN
zfnlcL;{}9)VY30u+%wh!83-KX<vUCh65&abK<nejKmNA`A+*{pxB+2vp!KOWPf7R%
z3b+9!G8RGq(EOy+^K3Mtm!?b=8SZ;c??QF?PkDTvVzj|vkQMUZ>vn4Qzi#h%C;!`^
z29e1(K;`hSSbGcaiK77cX@jZ<!J2<Xs(yoIhS2pqNSf8<PNbU3E@m{slPKaDQ??^F
z<xTxA;8$>%q>QT5++6ODIG?LZ8GjmTmo3-nWq#)_E=9)1b5#`by;okMb31Fj8olA_
zOrS)jTCTa;zh(JX|Gm1^yR`8+PB82FDI8&%+EzKMd&6v|@rV`We0SLGEfjxUVcCT>
zHNMs>;h65{3SQkF3E=W;j1?0i&jcFSmJ=c{Zntt<p_``{t;l&Y@4XFE-Sb)DTXEee
zi!RUJ2pS&sRQjIK-0M;of~puS_MrB?9z9XBEC*3-^X?T%?^B~H`&-2G4u^09Bf+PJ
zpQ4kp72U)X#TehtP+SPA(CdGq=61?2()z}1hv~GoXgjXh$F*>eMHSs0wyd@fD>TN4
zh?;A3J$HF~UVZVJ-_d>E_t3<}Guzc-A9`NE;!S0jdL`D7f4|Bq7+BDQ<0M}sME9`)
zT&qxHGj0n_=P2Vbo@0WM;%4u-&;E(mbg)&;Qe2c1m<lBENhG+GZ+L%<vdAH$kp?#t
z)R6yfaGus1Fr!X+e8LnxaVlD8Dis(%&je-T^Js!`mQXf+W!$dw<QJD1WhSh&Sa1`I
z<qkKeDN)hn#bqi`O3ImZ^K`|}cr}0)Nz?Fian}eb-=|C}!Xj){$^-Be1<`%LE9Pa*
z%y0)@Y7Rf^1-s;R6i<J7!pB#?8TP8IO}JDV6<ST94$i#0%hM?IMS(jwlq-8q@kGyt
zo>!gkJl=7~J;2M(j%w6!|C?>{?)PX7|KDNF{&RHL+u47%LQVI-S+u6V--*)E+I8t|
zN(h}os6kI_%Z^7q#A&Loo>RAQ?uY`<Y4#-VV$ZQSHE5*ET|<8hqYut>id4wd2QwnW
z^m?Xgho8IJrAx$5XVD2`T$NZ1K+1%=vhP(`qLM%$Q;c*AB#KbV*ZKq>1f`x;CcD?f
zcSzztw2J;#AEH%mrQ(8&^(4tTuWm|tZLXKA9Cwv~Ek6#cXmj2a{ky_m_ZRA0+M3Pr
z_bpQoiR$=oy_$b7H|PaiiT_<6|NF=No&9es)PVoB4Y1@e@XN|?g4si=m1nB&gZr~C
zNzw`F7T(6v2fqdIt^u^2fVn#{bQz73Oez%Z3mW49T1sTtDsUNDB(740@$(|?tT1Ga
zjE7Pmnesh<otqu)X#jhpoaq7Fv>oHX-YA?qTN>;Dw#WkhQ<GT<9e=eQyLqjZ>+oOa
zg}pyog#Vk209l3q-Qz<a|GUQrJN(}UEyRBx`|BnmKl*87i2WVD9=ILkZ+z#lA<As!
z>xW+k)OVftI$rPK`k_%1{u_@cu^!J&oB*rhe-00ief;ltcJ`mGP$T|VHo&5n!0Vpz
zg{GGCO3`M}U)=21fPc(=Pw#h6b@}%_U|$aaE9C#+u-B{I|BsG#^1lsgkpD&(=#rN}
zJi~D19T3kt;JgRo#1Gfs>Ui0dX#+NFvbnn&rm8U^Yn!VV1$)$7_?7$Vk^qpxP?`<T
zoaFiA+@e{{Ycyn<xD3~nyQa})6HMQUXP8@XN&J>2R|C*$?tk)^QAQ7r<A(kCKsc`p
zOBtNwyx*el872QtGo!LjWwd+#3pEX+E*`7qr~2TR55GPEwJBKr8nyd#cjKtjqVs=4
zN57#J=l@}+9{+pX*?s?QE41+ZFOUB3@Z>Mf{RKg{m3Pt?VRep4g-d##o<9%Z+QH#O
zqAgu>TbExxv408m_X-!*X>8e!(}@8UScCzV=v!^MTBp*i`zro&J~#Eky~jWi1~AXe
zpY#69kCo&(USw^)P(`-7N}bckzFJnPUoFrSgX?^^BW(%<7<heGLmP^wBmG!k4zJYp
zb)`eU+MOIE-e8t!k<cg_cT^siZojn|uZ6sQp<=idZh!8q^eq?BwfkM5vVC2zE0v=A
zK7e*~uQb>H!U-l*`<<lC_p!?U+dK5_KL^L1-S>aCLXY8$D20MaP#or8*1DJ=gJDLK
zn6fdXB>GIoD8t|}yq{1BGE423;A}YmIN?JZvrXCf83;^>qBAt-x|2>=96SbwW8*~A
z`UH;XC4a^?Jo$f~grF~Wz?rG3S<)vnB$QzogwM}EohvRdcnqgz%fg4#bBL*sK{%#r
z-~6@g2jTE<v2Xt736t@@{*yn-8QU)#8j|R9mYR28W$-kV7isV`9Fot$(@;(IZ!YLK
zc>0gvF?=9`@=U_3=PzUsrh@;8kqSZ@BiXmb1t0%22xl_lG4AiMbw@ke(f3UM2><~9
M|DUTS8314a08lJOA^-pY

delta 3123
zcmV-349xS68IKu|P62I^PZ@uw*(3+&9nKq`CpjQ#Nfaf2q;;M4zymb3_&NNTABQs|
zMSM2n?C@+#gbJ_7EP1ef>U27t{>h2?ztidX|9844M-RHa?n(c+cQP1sA9T7$Cxhb$
z(D@3y)F_jRhzFf7?#mzCcS0nk?@&m}*%0POL5wmIG*#yL6n@2I29bZ>8!+Yqe#=HE
z7%G$jBQqR=-93T2N^uAY9SI_?f_dIvC;Y##6WsR*_q2)@@~?1~CPbk;{19<Arjr>-
zw+096<i9uQdh*}vopko{zYDs)ZbOV?$`D$1FNEa=P-)VF_U&z;OVKfe??{rN4Ch2h
zxV;V9?RHQBkZ$mivUq<8XQqjlBn@V$NK6zN1^^Z_uCF2AZAF)Yk20xVkr}oie1i!R
ziJ^Yfz1WH}C6TRNDPWRqsf3I$k-8%Q!!V1IEJkQeF`2auiiNgJ3qrU7Mp=wZ!HKSJ
zdDPVeVH1Rdk9hS24(23*;m@^!>kdp2xV<$znSwX)SH_j$MmK+iEMD?cPw9Ox{DK<g
zUlGbs>`MNR`p0$o@AdcczYA)X|HTF<<iA03SBk8}C=*m&opGk{lNttAA{GCCGD`|+
z@=7@(d88YmGcv&;w6w@CYM7)@V9F&`Tp01IWh*j)8$BqJB?>~T+McHA0;b^hwq@Hs
z&ywVvCp5aUxKe*<B`q?c4uE>5h?VKZPd&u8+lriGl31*0Lp$=b^A?&hBjrNLeAeg~
z7*|D2lb1Ja7iOwdYGAKex^phnu-c!KV`~GXf-4^JWC(B1&KJF5A~A=!91K@<t-D|a
zP&ab0dDnLEl?QL)Q^7|VA|s;&O};=9Q-)HW>l{60dNO~0L1oW@l&EQC9&7_Tx!`1@
zsgltY^>}}M`!;9ylB%iKu0*9Mo5*q)`Ih%LcWsc(<4x!si_y8`u4JqqcD0@D55L;}
z)~3PT_W~u)M5G0D!ni=Y`inG2R+g3joz7^!dj<ZLp;V5t;6YPaIWOuf48F9iZssoI
zwm)}-{|$fVe<l^5J*NqtZRsYkR{!tyz4L$2JKmrFJE5lYzhMJZZUWUqVa}6mhK{Uj
z8649Db7kPG+!B6D1!Zastsi9j2ibyyst#h#q(@D+hlA$pL*BavLWlVw+!V5H(v7ad
zl#d1#fd=@-m41in@{er(T=3Z&9B=Cautxs7{rZ3Xzu(*6|93(S^6zW_-vGb`{N(?0
z@5YbHM~RU@^~`E4j~+QnKS?mYFuBrA)(NkS)aGgUiAt?U6gVO4d5eY&lMBX&%ghy8
zYmM@@-r(4t{-14^@MOG-iavjf?(Hy}`mSiv0NmJMNn-QzC+A)>CJWVLBR0w@+-M@U
z#f*Qm2$lV?emV-{O~XnYtXqm&x1}j*<q|a3S=F|)mDe}_MZ4>3>4$av*QcBv(~j`J
z)9d*9U$5Wa<Nr>m0soy1utM!COBJSItJT>=U*oebqSq<;E5l}WZv%zy&idR^d#-ea
zw%L|D>YpHszAIzyXHZ@Kr<kNDq+a_i^|60e{*O+4`R@#l_VT|Ay1qVq40Adgf<y&c
zsI{d2Jk!$>O>qd15B2p%7Yoh=>f@_Cwm?mZf`~8}A!HI`AkuLXLvH>sBKrggGX-Qe
ziusICrXMabNrLy6@b7>A3w|exGDuJ<6!HngbV8MU0vU@@$cPJsA3yvEVetMBQ=ES!
z35+rY?=K+?44VyL=AN+@$Uxu(KfS>;ArYP?3AEn7|KopK5JIcnf*TMv2U;Imi<E?4
zqJSGvB4ZKskIhdyyU504`pJ~3BEx;J>0PKU|0$0zQjE4346;W4d)-d${@3lF?B#zK
z)F3kX2B;kV6>D$dJ#iEOKW$j`AXtC1NY!t!$`HDl2T8NK+KE(C*~Oejcp61KW6E~q
zro5`(1^fyQlax_)mYd7{5$AJNDdSH=?Xu-Mz0B|2#ihu^c&>^<zW2&YbZ%#@7voo4
zoePx6RLeD2`?oCr>VHtTdY3jn#|dUVKZPSqQ`;(Mb#Iu>G#;^{obL|1y@h|GD=fRP
zrpA|gB^=ZJLcy!sBLQ4~jj>`%<heit+j2?-#_d*aD|GYpq7^xh7QMG&rh7gwd@HUS
zW!dG~8$rXPo=V>nntNU9LQoZh<sQ_&*P|zDmgOL-ZQg?->1}FMWq*r!-r*2#U@Z8|
z@KbbBwxXMup_t(7If_d`6?%VN)Z9+_MOxpO?J%9zmTkv1`?wbFv8<xI!&cSyVTHyR
z5m9rEZssm;FRCwJ^E<lF`yQIOcxJm=?nBQDSiGt1Qm@1Y^6yt!2LnrbaGd1Jgy=pt
zfNK?MY{qS&=^SM|#tTd^Qrzqv_t`)3nhv(AS&EBt0#kt`K8*yI@)duNQ5HF5Jl5c5
zf*SJQ4bIbg17_4Ik58GRr%pxdOr-+jr<tH^auH22&JxNdFO1uDk^JlvMwtmKEf(Cw
zV!6Z3X+~5uefB98C?(}gx_P?dN4y$Bi==7zvAAo5lpj(i6=4y!D&+xqih}4q;05!t
z=4QA<FExjs&4OL>I*Na%JmHh8-wb<I)}~x4jS8)%PzPt;-Q{T%`l7%c9LkkFr+A`g
zL(i+ucOLJ!<G#bo&Yo)2aQ~Zc^X~Ux1OMM~&Hi(8+~3=Oc0x_}zj?Hwzu$?{(b{$C
zZAu88L8w7bYs-#DJ;Yh6uAWl2aPEi#&uR83@8ZC*I5lXbt6hIXOQR3Yb&6ET)H^dG
z!}MmRX@{S?+NDdxPv_AoV_cP33_!|+y0Y(8SfP?YAXAKV3nYqA%9r{C9|onKRVKUF
z#5YLdKeUSeS|6fSZl&UaO!Oql1+Q*Od2Ozjs~mTgfGs}`t7vo46#cuxUiTO3TiTk<
z@%JrL-xJmG-+F&FpKs9%xEBArKK}OygT4K4C)9xdwGFW1F!0ODuY%bls+DJ|?}LZ)
zE=kfU=@#C`(g(i-@U8*0oq&ZqF?1P?l1wTT?MoWt5L!xP*eY-tStPDfh4IrO?yN9m
zjg5y=ADQwkf0>&d?P&l9<DBUs+_W9zz`;0NI9nR*0Ja0j;bW6n2_1ip9lLq0wd?R-
z=Y_pLT897Ii~w1O|J}i{kN@4lV2}U1pr!clV}IR5<VQbk4Y9w$*8_Kh{EhD%Hbj}N
zef{wBfcmcUUdQV_Tz_xWg#X6lNvy|n8z;cJ_@CqBfsg<F?%w{h6Kcf&$_7~W5_sJ+
zzSPumQ7PIC`pcXB5|Dqn@9F*KsV@J%2kgrMV2%7A9rt>*`+u*ym;YT*gZwwTKv%p3
z;u(f3?|^vL0p~psCw{p8R>$+EOdGIalg-`LFjb8S+1OmYEZC#w!mr#<R|J3*hSF?w
z?j$cB7Z%NGUZWw?#AUdq+zpK`+hF=mJj23*OXAloxf+62b60=Aj57Z2IBwXF-wEe+
zVJU-iocCMwJ)`8`X=Ys3sf_l(f1##f)Wu`f{8S(O>fzTXpf&~TU!!(^?r$7*T6X?#
z>F77K=KMeI)Z>2#-Tn99c0x<f|MKYn22cLt++PxOTX`pa8CK_*RJf!U>G|^zt{ogs
zB-+w7w{`jD6Ptfff3I+9oyL~!IGq?!fkhZ#iN4jAt92^Py07A|=5t#w+<OcZVE~KF
z{5kKx{8&kz<3-ly3sq#RtJFDt?5ky!`qctWF}TimJJO~=fT7oSHMF5<I?|8z<?u>f
zUspQxtKG>#;tghn772}_aYyBG<@Vc{@mk2+XDWs};pTtNO5bV`-MHT+D%+R!x>hN=
z?*nL0_eu->FPvgBv)@VDejn@XzrADM{&O_w?7#oB6M6{eL@5+Zg5t3FvexAk8H_TT
z#FR}SCDBJRK^X=Q;q8=4kXdTK1ZTtfCkY?fm~F}?Pe5Qo6rH0v*PV32;@}}LoERsX
z)+caGKVg4t!;}B#Q3(2C2b`Ijnk9WQLqZvbLHP9I!-e7kgNJZtwk*6myMUMq8H5w6
z4$WW7eh`lS7Ki3<o-myp>Oc9ToU_BSp%IBbW~q7iRR)hkd6@=}!x8xyJPy@N|K@^D
zg2(>|9>O~!D9<Fkc=}8RVJi5a7^xtnF_J@DT<{-1gK#b*9^>I2Tlci5J$=jcp8x;=
N|Ns3v{;2?9008zTLcRb1


From 8952d096b9cd58791ca78a540d10df131e8c3786 Mon Sep 17 00:00:00 2001
From: 2ubyz <poomdech.j@opsta.co.th>
Date: Fri, 3 Apr 2026 14:38:31 +0700
Subject: [PATCH 3/5] remove hardcode credential

---
 charts/cnpg/values.yaml | 8 ++++----
 values.yaml             | 2 +-
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/charts/cnpg/values.yaml b/charts/cnpg/values.yaml
index b000cd1..f78901b 100644
--- a/charts/cnpg/values.yaml
+++ b/charts/cnpg/values.yaml
@@ -22,8 +22,8 @@ cluster:
 
 postgresAuth:
   create: true
-  username: cnpg
-  password: P@ssw0rd123
+  username: 
+  password: 
 
 backup:
   enabled: true
@@ -33,8 +33,8 @@ backup:
     endpointURL: https://opsta.in.th/buckets/
     s3Credentials:
       create: true
-      accessKeyValue: accesskey
-      secretKeyValue: secretkey
+      accessKeyValue: 
+      secretKeyValue: 
     compression:
       data: gzip
       wal: gzip
diff --git a/values.yaml b/values.yaml
index 43980da..13b8a1c 100644
--- a/values.yaml
+++ b/values.yaml
@@ -57,4 +57,4 @@ cnpg:
   bootstrap:
     initdb: 
       database: cnpg
-      owner: cnpg
\ No newline at end of file
+      owner: cnpg

From d12b7c35583f2af5e66f181d1d7cae978825bde9 Mon Sep 17 00:00:00 2001
From: 2ubyz <poomdech.j@opsta.co.th>
Date: Fri, 3 Apr 2026 15:02:44 +0700
Subject: [PATCH 4/5] edit cnpg/chart.yaml & add random password for user
 postgres

---
 charts/cnpg/Chart.yaml                     | 2 +-
 charts/cnpg/templates/secret-postgres.yaml | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/charts/cnpg/Chart.yaml b/charts/cnpg/Chart.yaml
index 1d5c959..ea43ae7 100644
--- a/charts/cnpg/Chart.yaml
+++ b/charts/cnpg/Chart.yaml
@@ -1,5 +1,5 @@
 apiVersion: v1
-description: CNPG (China Postgres)
+description: Cloud Native Postgres
 name: cnpg
 version: 0.1.0
 appVersion: 0.1.0
diff --git a/charts/cnpg/templates/secret-postgres.yaml b/charts/cnpg/templates/secret-postgres.yaml
index ccab927..ec8a18e 100644
--- a/charts/cnpg/templates/secret-postgres.yaml
+++ b/charts/cnpg/templates/secret-postgres.yaml
@@ -6,5 +6,5 @@ metadata:
 type: {{ .Values.postgresAuth.type | default "kubernetes.io/basic-auth" }}
 stringData:
   username: {{ .Values.postgresAuth.username | quote }}
-  password: {{ .Values.postgresAuth.password | quote }}
+  password: {{ default (randAlphaNum 8) .Values.postgresAuth.password | quote }}
 {{- end }}

From d57719c53f6fdba2fad15fd5280dbfdf2d65a45d Mon Sep 17 00:00:00 2001
From: 2ubyz <poomdech.j@opsta.co.th>
Date: Fri, 3 Apr 2026 15:52:04 +0700
Subject: [PATCH 5/5] add lookup for secret postgres

---
 charts/cnpg/templates/secret-admin-postgres.yaml | 12 ++++++++++--
 charts/cnpg/templates/secret-postgres.yaml       | 12 ++++++++++--
 charts/cnpg/values.yaml                          |  2 +-
 3 files changed, 21 insertions(+), 5 deletions(-)

diff --git a/charts/cnpg/templates/secret-admin-postgres.yaml b/charts/cnpg/templates/secret-admin-postgres.yaml
index b92a334..768c62d 100644
--- a/charts/cnpg/templates/secret-admin-postgres.yaml
+++ b/charts/cnpg/templates/secret-admin-postgres.yaml
@@ -1,10 +1,18 @@
 {{- if and .Values.enabled .Values.superuser.enabled }}
+{{- $secretName := printf "%s-cnpg-superuser-secret" .Release.Name | trunc 63 | trimSuffix "-" }}
+{{- $existing := lookup "v1" "Secret" .Release.Namespace $secretName }}
 apiVersion: v1
 kind: Secret
 metadata:
-  name: {{ printf "%s-cnpg-superuser-secret" .Release.Name | trunc 63 | trimSuffix "-" | quote }}
+  name: {{ $secretName | quote }}
 type: {{ default "kubernetes.io/basic-auth" }}
 stringData:
   username: postgres
-  password: {{ randAlphaNum 8 | quote }}
+  password: {{- if .Values.superuser.password }}
+    {{ .Values.superuser.password | quote }}
+  {{- else if $existing }}
+    {{ index $existing.data "password" | b64dec | quote }}
+  {{- else }}
+    {{ randAlphaNum 32 | quote }}
+  {{- end }}
 {{- end }}
diff --git a/charts/cnpg/templates/secret-postgres.yaml b/charts/cnpg/templates/secret-postgres.yaml
index ec8a18e..f08ba04 100644
--- a/charts/cnpg/templates/secret-postgres.yaml
+++ b/charts/cnpg/templates/secret-postgres.yaml
@@ -1,10 +1,18 @@
 {{- if and .Values.enabled .Values.postgresAuth.create }}
+{{- $secretName := printf "%s-cnpg-app-creds" .Release.Name | trunc 63 | trimSuffix "-" }}
+{{- $existing := lookup "v1" "Secret" .Release.Namespace $secretName }}
 apiVersion: v1
 kind: Secret
 metadata:
-  name: {{ printf "%s-cnpg-app-creds" .Release.Name | trunc 63 | trimSuffix "-" | quote }}
+  name: {{ $secretName | quote }}
 type: {{ .Values.postgresAuth.type | default "kubernetes.io/basic-auth" }}
 stringData:
   username: {{ .Values.postgresAuth.username | quote }}
-  password: {{ default (randAlphaNum 8) .Values.postgresAuth.password | quote }}
+  password: {{- if .Values.postgresAuth.password }}
+    {{ .Values.postgresAuth.password | quote }}
+  {{- else if $existing }}
+    {{ index $existing.data "password" | b64dec | quote }}
+  {{- else }}
+    {{ randAlphaNum 32 | quote }}
+  {{- end }}
 {{- end }}
diff --git a/charts/cnpg/values.yaml b/charts/cnpg/values.yaml
index f78901b..7a3879a 100644
--- a/charts/cnpg/values.yaml
+++ b/charts/cnpg/values.yaml
@@ -32,7 +32,7 @@ backup:
     destinationPath: s3://postgres-backups/
     endpointURL: https://opsta.in.th/buckets/
     s3Credentials:
-      create: true
+      create: false
       accessKeyValue: 
       secretKeyValue: 
     compression: