feat: add PostgreSQL support with shared instance and backup functionality

| OEG (Open Exposure Gateway) | `oop` | Northbound API entry point for tenants |

| Federation Manager | `oop` | Inter-operator federation workflows |

| Keycloak | `oop` | OAuth2/OIDC authentication for FM |

| PostgreSQL | `oop` | Shared instance; one database and role per component |

| AI2 MCP | `oop` | MCP server exposing CAMARA-compliant tools |

| AI2 AI Agent | `oop` | Natural language interface backed by Groq |

| Portal | `oop` | Next.js web frontend for the OOP platform |

If the file is absent, `helm-deploy.sh` will warn and continue — AI2 deploys with an empty key.

PostgreSQL needs no entries: its passwords are generated on first install and kept in the

`postgres-credentials` Secret across upgrades. To pin a value instead, add it to the same file:

```yaml

postgresql:

  auth:

    postgresPassword: "<postgres-superuser-password>"

```

Read a generated value back with, for example:

```bash

kubectl -n oop get secret postgres-credentials -o jsonpath='{.data.postgres-password}' | base64 -d

```

---

## PostgreSQL

A single shared instance (`charts/postgresql`) with one database and role per component. Not a replacement for a managed database or an operator such as CloudNativePG.

Pick volume sizes and storage classes (`postgresql.persistence`, `postgresql.backup.persistence`)

before the first install: they come from StatefulSet claim templates, which Kubernetes does not change

in place.

Give a component a database: add an entry to `postgresql.databases`, read its password from

`postgres-credentials` → `<user>-password`, and let its pods through the NetworkPolicy by labelling

them `postgres-client: "true"` or adding a selector to `postgresql.networkPolicy.allowFrom`.

Backups are off by default. Turn them on with `postgresql.backup.enabled: true` (schedule,

retention and volume size sit next to it), then take a backup now, and restore one database from it:

```bash

kubectl -n oop create job --from=cronjob/postgres-backup postgres-backup-manual

kubectl -n oop logs -f job/postgres-backup-manual

# restore: mount the backup volume in a throwaway pod, then pg_restore into the database

kubectl -n oop run pg-restore --rm -it --restart=Never --image=postgres:17.11-alpine \

  --labels=postgres-client=true \

  --overrides='{"spec":{"affinity":{"podAffinity":{"requiredDuringSchedulingIgnoredDuringExecution":[{"labelSelector":{"matchLabels":{"app":"postgres"}},"topologyKey":"kubernetes.io/hostname"}]}},"volumes":[{"name":"b","persistentVolumeClaim":{"claimName":"backups-postgres-0"}}],"containers":[{"name":"pg-restore","image":"postgres:17.11-alpine","stdin":true,"tty":true,"command":["sh"],"volumeMounts":[{"name":"b","mountPath":"/backups"}]}]}}'

# inside the pod (password: Secret postgres-credentials → postgres-password):

#   ls /backups                                   # pick a directory that contains COMPLETE

#   pg_restore -h postgres -U postgres -d <database> --clean --if-exists /backups/<run>/<database>.dump

```

Stop the component that owns a database before restoring it, and start it again afterwards.

---

## Deploy on kind (one command)

    image:

      pullPolicy: IfNotPresent

postgresql:

  persistence:

    storageClass: standard

  # Dev-only cluster: let any pod reach Postgres without the postgres-client label.

  networkPolicy:

    enabled: false

ai2:

  images:

    mcp:

dependencies:

- name: postgresql

  repository: ""

  version: 1.0.0

- name: srm

  repository: ""

  version: 1.0.0

- name: nats

  repository: https://nats-io.github.io/k8s/helm/charts/

  version: 1.2.10

digest: sha256:365d4c7760163eba4461dbe9796140f0db9ca59bd998cbbc3982f6c563a87577

generated: "2026-06-02T12:59:48.852000682Z"

digest: sha256:7d1507b7f8711961519364feeb12197081c138809775dcabbdd03da4933f032e

generated: "2026-09-12T18:56:52.464189855+03:00"

apiVersion: v2

name: oop-platform

description: Open Operator Platform - Complete platform deployment (SRM, OEG, Federation Manager, AI2 and Portal)

description: Open Operator Platform - Complete platform deployment (SRM, OEG, Federation Manager, AI2, Portal and PostgreSQL)

type: application

version: 1.0.0

maintainers:

  - name: Open Operator Platform Team

repo: https://labs.etsi.org/rep/oop/deploy/helm

sources:

  - https://labs.etsi.org/rep/oop/deploy/helm

  - https://labs.etsi.org/rep/oop

icon: https://labs.etsi.org/rep/uploads/-/system/project/avatar/4685/logo.png

# Subchart dependencies

dependencies:

  - name: postgresql

    version: "1.0.0"

    condition: postgresql.enabled

  - name: srm

    version: "1.0.0"

    condition: srm.enabled

apiVersion: v2

name: postgresql

description: Shared PostgreSQL instance for OOP platform components (one database and role per component, ADR-0025)

type: application

version: 1.0.0

appVersion: "17.11"

keywords:

  - oop

  - postgresql

  - database

maintainers:

  - name: Open Operator Platform Team