---
id: w4/m4/t001
title: "openfga-db CNPG cluster in charts/auth-dbs + local sizing"
worker: worker4
status: done
estimate: 25m
depends_on: []
---

## Objective

Give OpenFGA its own CNPG Postgres cluster, `openfga-db`, following the exact shape of `kratos-db`/`hydra-db` — one component, one database, independent failover/backup — inside the existing `auth-dbs` Argo Application.

## Context

- `deploy/gitops/charts/auth-dbs/` already holds `kratos-db.yaml` + `hydra-db.yaml` (CNPG `Cluster`, ns `auth`, db/owner named after the component, `SkipDryRunOnMissingResource` annotation) — copy that shape.
- The local overlay (`deploy/gitops/overlays/local/kustomization.yaml`) patches ALL Clusters in the auth-dbs Application via a single `target: {kind: Cluster}` JSON6902 patch (1Gi, `local-path`) — a new Cluster in the same dir inherits it with zero overlay changes; verify, don't assume.
- CNPG generates Secret `openfga-db-app` + Service `openfga-db-rw` — t002's DSN composition depends on those names.

## Steps

1. Add `deploy/gitops/charts/auth-dbs/openfga-db.yaml` (db `openfga`, owner `openfga`, 5Gi hcloud-volumes, mirroring hydra-db.yaml).
2. Register it in `charts/auth-dbs/kustomization.yaml`.
3. `bash scripts/gitops-validate.sh` — renders must pass; confirm the local overlay patch hits the new Cluster (`kubectl kustomize` inspection).
4. Apply to the mock cluster (local sizing + control-plane pin, as docs/ADR012-auth.md's local-bring-up notes describe) and wait for `Cluster in healthy state`.

## Files

- `deploy/gitops/charts/auth-dbs/openfga-db.yaml` (new)
- `deploy/gitops/charts/auth-dbs/kustomization.yaml`

## Acceptance criteria

- [ ] `gitops-validate.sh` passes; local overlay render shows the 1Gi/local-path patch applied to `openfga-db`.
- [ ] On the mock cluster: `openfga-db` healthy, Secret `openfga-db-app` and Service `openfga-db-rw` exist.

## Out of scope

- Deploying OpenFGA itself (t002); backup schedules (w1/m7 with the other auth DBs).
