++ add pgbouncer backup pooler to brusnika-prod

clusters/brusnika-prod/infrastructure/kustomization.yaml

@@ -16,6 +16,7 @@ resources:
   - ../../../infrastructure/goalert
   - ../../../infrastructure/kafka-exporter
   - ../../../infrastructure/postgres-exporter
+  - ../../../infrastructure/pgbouncer
   - ./vault-ingress.yaml
   - ./clusterissuer-letsencrypt.yaml
   - ./node-exporter-vmnodescrape.yaml
@@ -126,3 +127,10 @@ patches:
       kind: HelmRelease
       name: failed-pod-cleanup
       namespace: default
+  - path: ./patches/pgbouncer.yaml
+    target:
+      group: helm.toolkit.fluxcd.io
+      version: v2
+      kind: HelmRelease
+      name: pgbouncer
+      namespace: pgbouncer

clusters/brusnika-prod/infrastructure/patches/pgbouncer.yaml

@@ -0,0 +1,136 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: pgbouncer
+  namespace: pgbouncer
+spec:
+  interval: 10m
+  chart:
+    spec:
+      version: "1.0.11"
+  values:
+    image:
+      repository: cr.yandex/crp3ccidau046kdj8g9q/pgbouncer
+      tag: "1.24.1"
+      pullPolicy: IfNotPresent
+
+    imagePullSecrets:
+      - name: regcred
+
+    service:
+      enabled: true
+      type: NodePort
+
+    serviceAccount:
+      create: true
+      name: pgbouncer-vault
+
+    vault:
+      enabled: true
+      role: pgbouncer
+      authPath: kubernetes
+      secretPath: secrets/data/apps/pgbouncer/backup-ro
+      extraUsers:
+        - usernameKey: attachments_username
+          passwordKey: attachments_password
+
+    users: {}
+
+    poolMode: session
+
+    # checklist(singular)/checklists/message-hub left out:
+    # - checklist: no stable in-namespace Service for its postgres pod (bare pod only)
+    # - checklists: active prod incident, app itself gets password auth failures right now,
+    #   unrelated to this change - see role_setup_results.txt
+    # - message-hub: backend is CrashLoopBackOff, not a real standalone database
+    databases:
+      attachments:
+        host: "89.232.165.105"
+        port: 5432
+        user: attachments
+        dbname: attachments_db
+      comparisons:
+        host: postgres-service.comparisons.svc.cluster.local
+        port: 5432
+        user: backup_ro
+        dbname: comparisons
+      bim:
+        host: postgres-service.bim.svc.cluster.local
+        port: 5432
+        user: backup_ro
+        dbname: bimapidb
+      django:
+        host: postgres-service.django.svc.cluster.local
+        port: 5432
+        user: backup_ro
+        dbname: sarex_db
+      documentations:
+        host: postgres-service.documentations.svc.cluster.local
+        port: 5432
+        user: backup_ro
+        dbname: documentations
+      drawings:
+        host: postgres-service.drawings.svc.cluster.local
+        port: 5432
+        user: backup_ro
+        dbname: drawings
+      eav:
+        host: postgres-service.eav.svc.cluster.local
+        port: 5432
+        user: backup_ro
+        dbname: eav_db
+      flows:
+        host: postgres-service.flows.svc.cluster.local
+        port: 5432
+        user: backup_ro
+        dbname: flows_db
+      inspections:
+        host: postgres-service.inspections.svc.cluster.local
+        port: 5432
+        user: backup_ro
+        dbname: inspections_db
+      issues:
+        host: postgres-service.issues.svc.cluster.local
+        port: 5432
+        user: backup_ro
+        dbname: issues
+      notes:
+        host: postgres-service.notes.svc.cluster.local
+        port: 5432
+        user: backup_ro
+        dbname: notes_db
+      pm:
+        host: postgres-service.pm.svc.cluster.local
+        port: 5432
+        user: backup_ro
+        dbname: pm_db
+      resources:
+        host: postgres-service.resources.svc.cluster.local
+        port: 5432
+        user: backup_ro
+        dbname: resources
+      subscriptions:
+        host: postgres-service.subscriptions.svc.cluster.local
+        port: 5432
+        user: backup_ro
+        dbname: subscriptions
+      system-log:
+        host: postgres-service.system-log.svc.cluster.local
+        port: 5432
+        user: backup_ro
+        dbname: system_log
+      transmittal:
+        host: postgres-service.transmittal.svc.cluster.local
+        port: 5432
+        user: backup_ro
+        dbname: transmittal_db
+      workflow:
+        host: postgres-service.workflow.svc.cluster.local
+        port: 5432
+        user: backup_ro
+        dbname: workflows_db
+      workspaces:
+        host: postgres-service.workspaces.svc.cluster.local
+        port: 5432
+        user: backup_ro
+        dbname: workspaces_db

infrastructure/pgbouncer/base/helmrelease.yaml

@@ -0,0 +1,23 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: pgbouncer
+  namespace: pgbouncer
+spec:
+  interval: 10m
+  chart:
+    spec:
+      chart: pgbouncer
+      version: "1.0.11"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    remediation:
+      retries: 3
+  values: {}

infrastructure/pgbouncer/base/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: pgbouncer
+resources:
+  - namespace.yaml
+  - helmrelease.yaml

infrastructure/pgbouncer/base/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: pgbouncer

infrastructure/pgbouncer/kustomization.yaml

@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - base