External database

By default the chart runs the platform database as a CloudNativePG cluster (database.mode bundled). You can use a PostgreSQL you run yourself instead, for example a cloud provider's.

What it must beCopy Anchor Link

• PostgreSQL 16 or newer.
• One database owned by one role. No superuser and no extensions needed.
• A direct or session-mode connection. Core keeps one connection for LISTEN, which a transaction-mode pooler (PgBouncer in transaction mode, RDS Proxy) breaks: core warns at start, and wake-ups fall back to polling.

ConfigureCopy Anchor Link

Store the DSN, a URL, in a Secret:

kubectl -n harthelm-system create secret generic platform-db \
  --from-literal=dsn='postgresql://harthelm:<password>@db.example.com:5432/harthelm'
kubectl -n harthelm-system create secret generic platform-db-ca --from-file=ca.crt=./db-ca.crt

database:
  mode: external
  external:
    existingSecret: platform-db
    key: dsn
    sslmode: verify-full
    ca: {secretName: platform-db-ca, key: ca.crt}
networkPolicy:
  egress:
    database: {to: [{ipBlock: {cidr: 192.0.2.10/32}}], ports: [5432]}

The preflight Job checks that one connection answers before it lets an install or upgrade go on.

What stays the sameCopy Anchor Link

• Backups dump the external database the same way, if backup.enabled is on. Your provider's own backups are a good second copy; keep the master key with them.
• Users' managed PostgreSQL still needs the CloudNativePG operator. Without it, switch the provider off with marketplace.builtin.postgres.enabled false.

Notes for Amazon RDS, Azure Flexible Server and Cloud SQL are in the platform tracks.