cnpg

Provision and run CloudNativePG (CNPG) Postgres on Kubernetes as GitOps. Every concrete identifier below is a placeholder - substitute your own: <project>, <gcp-sa>, <backups-bucket>, <cluster>, <ns>, <svc>, <db>, <owner>, <env>, <s3-endpoint>, <objstore-secret>, <app-ns>.

Two platforms, one operator. The Cluster spec, bootstrap, pgvector, PITR, clone, and most gotchas are identical everywhere; only backup auth and NetworkPolicy differ. Managed cloud (GKE + GCS): Workload Identity, no keys - steps below default to this. Self-hosted (K3s / bare-metal + S3-compatible store: MinIO, Ceph, R2, B2): an access-key Secret, plus explicit NetworkPolicies on a default-deny cluster. Read references/self-hosted-and-networkpolicy.md whenever there's no cloud Workload Identity or the cluster enforces default-deny.

Mental model - two halves that MUST share one string