refactor: remove backup functionality and related configurations from PostgreSQL chart

A single shared instance (`charts/postgresql`) with one database and role per component. Not a replacement for a managed database or an operator such as CloudNativePG.

Pick volume sizes and storage classes (`postgresql.persistence`, `postgresql.backup.persistence`)

before the first install: they come from StatefulSet claim templates, which Kubernetes does not change

in place.

Pick the volume size and storage class (`postgresql.persistence`) before the first install: they

come from a StatefulSet claim template, which Kubernetes does not change in place.

Give a component a database: add an entry to `postgresql.databases`, read its password from

`postgres-credentials` → `<user>-password`, and let its pods through the NetworkPolicy by labelling

them `postgres-client: "true"` or adding a selector to `postgresql.networkPolicy.allowFrom`.

Backups are off by default. Turn them on with `postgresql.backup.enabled: true` (schedule,

retention and volume size sit next to it), then take a backup now, and restore one database from it:

```bash

kubectl -n oop create job --from=cronjob/postgres-backup postgres-backup-manual

kubectl -n oop logs -f job/postgres-backup-manual

# restore: mount the backup volume in a throwaway pod, then pg_restore into the database

kubectl -n oop run pg-restore --rm -it --restart=Never --image=postgres:18.6-alpine \

  --labels=postgres-client=true \

  --overrides='{"spec":{"affinity":{"podAffinity":{"requiredDuringSchedulingIgnoredDuringExecution":[{"labelSelector":{"matchLabels":{"app":"postgres"}},"topologyKey":"kubernetes.io/hostname"}]}},"volumes":[{"name":"b","persistentVolumeClaim":{"claimName":"backups-postgres-0"}}],"containers":[{"name":"pg-restore","image":"postgres:18.6-alpine","stdin":true,"tty":true,"command":["sh"],"volumeMounts":[{"name":"b","mountPath":"/backups"}]}]}}'

# inside the pod (password: Secret postgres-credentials → postgres-password):

#   ls /backups                                   # pick a directory that contains COMPLETE

#   pg_restore -h postgres -U postgres -d <database> --clean --if-exists /backups/<run>/<database>.dump

```

Stop the component that owns a database before restoring it, and start it again afterwards.

---

## Deploy on kind (one command)

{{- if and .Values.backup.enabled .Values.persistence.enabled .Values.databases }}

apiVersion: batch/v1

kind: CronJob

metadata:

  name: {{ .Values.name }}-backup

  namespace: {{ .Release.Namespace }}

  labels:

    {{- include "postgresql.labels" . | nindent 4 }}

spec:

  schedule: {{ .Values.backup.schedule | quote }}

  concurrencyPolicy: Forbid

  successfulJobsHistoryLimit: 3

  failedJobsHistoryLimit: 3

  jobTemplate:

    spec:

      backoffLimit: 2

      activeDeadlineSeconds: 3600

      template:

        metadata:

          labels:

            app.kubernetes.io/name: {{ .Values.name }}-backup

            app.kubernetes.io/instance: {{ .Release.Name }}

            {{- include "postgresql.clientLabel" . | nindent 12 }}

        spec:

          {{- include "postgresql.podSpecBase" . | nindent 10 }}

          affinity:

            podAffinity:

              requiredDuringSchedulingIgnoredDuringExecution:

                - labelSelector:

                    matchLabels:

                      {{- include "postgresql.selectorLabels" . | nindent 22 }}

                  topologyKey: kubernetes.io/hostname

          restartPolicy: Never

          containers:

            - name: backup

              image: {{ include "postgresql.image" . | quote }}

              imagePullPolicy: {{ .Values.image.pullPolicy }}

              {{- with .Values.containerSecurityContext }}

              securityContext:

                {{- toYaml . | nindent 16 }}

              {{- end }}

              env:

                - name: PGHOST

                  value: {{ .Values.name }}

                - name: PGPORT

                  value: {{ .Values.service.port | quote }}

                - name: PGUSER

                  value: postgres

                - name: PGPASSWORD

                  valueFrom:

                    secretKeyRef:

                      name: {{ include "postgresql.secretName" . }}

                      key: postgres-password

              command: ["/bin/sh", "-ec"]

              args:

                - |

                  dir="/backups/$(date -u +%Y%m%dT%H%M%SZ)"

                  mkdir -p "$dir"

                  pg_dumpall --globals-only > "$dir/globals.sql"

                  {{- range .Values.databases }}

                  pg_dump --format=custom --dbname={{ .name }} --file="$dir/{{ .name }}.dump"

                  {{- end }}

                  touch "$dir/COMPLETE"

                  echo "backup written to $dir:"; ls -l "$dir"

                  # retention: drop runs older than {{ .Values.backup.retentionDays }} days

                  find /backups -mindepth 1 -maxdepth 1 -type d -mtime +{{ .Values.backup.retentionDays | int }} -exec rm -rf {} +

              volumeMounts:

                - name: backups

                  mountPath: /backups

                - name: tmp

                  mountPath: /tmp

          volumes:

            - name: backups

              persistentVolumeClaim:

                claimName: backups-{{ .Values.name }}-0

            - name: tmp

              emptyDir: {}

{{- end }}

        resources:

          requests:

            storage: {{ .Values.persistence.size }}

    # Backup target, provisioned and bound together with postgres-0 so an install never

    # waits on a volume nothing uses yet (WaitForFirstConsumer storage). Always present,

    # whatever backup.enabled says: claim templates cannot change after the first install.

    - metadata:

        name: backups

        labels:

          {{- include "postgresql.labels" . | nindent 10 }}

      spec:

        {{- with .Values.backup.persistence.storageClass }}

        storageClassName: {{ . }}

        {{- end }}

        accessModes:

          - ReadWriteOnce

        resources:

          requests:

            storage: {{ .Values.backup.persistence.size }}

  {{- end }}

  periodSeconds: 5

  failureThreshold: 120

# Logical backups: roles (pg_dumpall --globals-only) plus a pg_dump per database, to a PVC

# in the same namespace that survives `helm uninstall`. They live in the cluster, so copy

# them elsewhere for real disaster recovery. Off by default; when enabled, rendered once

# `databases` has an entry. Run one now with:

#   kubectl -n <ns> create job --from=cronjob/<name>-backup <name>-backup-manual

backup:

  enabled: false

  schedule: "0 2 * * *"

  # Backups older than this many days are deleted after each successful run.

  retentionDays: 7

  persistence:

    storageClass: ""

    size: 2Gi

# Only pods in the namespace labelled "<name>-client: 'true'" (postgres-client by default),

# this chart's own Jobs, and the selectors below may connect on the Postgres port.

# Needs a CNI that enforces NetworkPolicy; on one that doesn't, the policy has no effect.

    enabled: true

    storageClass: ""

    size: 1Gi

  # Nightly logical backups (roles + one pg_dump per database) to the backups-postgres-0

  # volume, kept retentionDays days. Off by default. The volume is created either way, so

  # switching backups on later needs no StatefulSet re-creation.

  backup:

    enabled: false

    schedule: "0 2 * * *"

    retentionDays: 7

    persistence:

      storageClass: ""

      size: 2Gi

# ====================================================================

# SRM