ArgoCD Application — leveredge CNPG (Postgres)¶

Documents environments/aws/edge/ap-south-1/dev/02-argocd-applications/edge-leverage/argocd-application-cnpg-cluster.yaml — the ArgoCD Application that deploys the leveredge Postgres database (CloudNativePG / CNPG) via GitOps.

TL;DR

This file is a pointer, not the database config. It tells ArgoCD: "take the manifests in applications/edge-leverage/cnpg/manifests/ and keep them applied in the leveredge namespace, forever."

What it is¶

An ArgoCD Application — the unit ArgoCD uses to map a folder of manifests in Git to a running set of Kubernetes resources. It defines what to deploy (source), where (destination), and how to keep it in sync (syncPolicy).

kind: Application
metadata:
  name: ai71-aps1-dev.edge-leverage-cnpg-cluster
  namespace: argocd
  annotations:
    # avoids false OutOfSync from defaulted fields (DEV-817)
    argocd.argoproj.io/compare-options: ServerSideDiff=true
spec:
  project: ai71-aps1-dev.edge-leverage
  source:
    repoURL: https://gitlab.com/ai71.ai/devops/edge-devops.git
    targetRevision: main                                # the Git branch ArgoCD tracks (DEV-816)
    path: applications/edge-leverage/cnpg/manifests     # the manifests this app deploys
  destination:
    server: https://kubernetes.default.svc
    namespace: leveredge
  syncPolicy:
    automated: { prune: true, selfHeal: true }          # auto-reconcile drift; prune removed resources
    syncOptions: [ CreateNamespace=true, ServerSideApply=true, ... ]

Why it's needed¶

Without this Application, someone would have to kubectl apply the CNPG manifests by hand and keep them in sync forever. Instead, this file gives us:

Declarative / GitOps — the whole database (the Postgres Cluster, its credentials, its Teleport registration) is defined in Git. The cluster's live state is driven from the repo, not by ad-hoc commands.
Single source of truth + audit trail — every change is a reviewed, signed commit. You can see exactly who changed the DB and when.
Self-healing — if someone edits the live Cluster or deletes a resource, ArgoCD (selfHeal: true) reconciles it back to what Git says.
Reproducibility — a fresh cluster bootstraps the entire platform (including this database) from one root Application, with no manual steps.
Separation of concerns — the Application (this file, in the infra repo's app-of-apps) is decoupled from the manifests (in applications/), so app changes and orchestration changes are reviewed independently.

Where it fits — the app-of-apps hierarchy¶

This Application isn't applied directly; it's synced by a parent, which is synced by the root. That "app-of-apps" chain is what lets the whole platform come up from a single bootstrap:

ai71-aps1-dev-edge                      (bootstrap root Application — created by Terraform)
└── syncs _root/  →  ai71-aps1-dev.edge-leverage        (edge-leverage app-of-apps)
      └── syncs edge-leverage/  →  THIS file (…-cnpg-cluster)   (the CNPG Application)
            └── deploys applications/edge-leverage/cnpg/manifests/   →  the Postgres Cluster

Its siblings in the same folder (argocd-application-frontend.yaml, argocd-application-searxng.yaml, …) do the same job for the other edge-leverage components.

What it actually deploys¶

The applications/edge-leverage/cnpg/manifests/ folder it points at contains:

Manifest	Purpose
`cluster.yaml`	The CNPG `Cluster` — Postgres (1 instance, `gp3` storage, `pg_hba`, managed `leverage` role, superuser access)
`external-secret.yaml`	`ServiceAccount` + `SecretStore` + `ExternalSecret`s that pull the DB and teleport-admin credentials from AWS Secrets Manager into the `leveredge` namespace
`teleport-admin-grant-job.yaml`	A PostSync `Job` that durably grants `teleport-admin` the `CREATEROLE` privilege (so Teleport can manage DB roles)

Key configuration notes¶

targetRevision: main

This must point at a branch that exists. It previously pointed at v2_deployment; when that branch was deleted after merging to main, this app (and its siblings) went Unknown/stuck because ArgoCD couldn't fetch the manifests. Fixed by repointing to main. (Ref: DEV-816.)

ServerSideDiff=true

The CNPG Cluster and the ExternalSecrets have many server/operator-defaulted fields that aren't in Git. ArgoCD's default client-side diff sees those as a difference and reports OutOfSync on every cycle even though each sync succeeds. ServerSideDiff=true computes the diff via a dry-run server-side apply, ignoring those defaulted fields — so the app reports Synced. (Ref: DEV-817.)

Fixes: DEV-816 (targetRevision repoint), DEV-817 (ServerSideDiff)
Manifests: applications/edge-leverage/cnpg/manifests/