---
id: w4/m1/t001
title: CNPG clusters `kratos-db` + `hydra-db` (base manifests + local sizing)
worker: worker4
status: done
estimate: 30m
depends_on: []
---

## Objective

Provision two dedicated CNPG Postgres clusters, `kratos-db` and `hydra-db`, as GitOps base components — one application database per CNPG cluster (the CNPG-recommended shape, and Ory requires each component to own its database). Mirror the existing `bex-postgres` pattern.

## Context

- CNPG operator already runs (`deploy/gitops/base/cnpg-operator.yaml`); `deploy/gitops/base/bex-postgres.yaml` is the pattern to copy.
- Ory hard requirement: Kratos and Hydra must not share a database (separate DSNs); sharing a server is allowed but we deploy separate clusters for independent failover/upgrade/backup.
- Local overlay (`deploy/gitops/overlays/local/`) patches to single instance + small storage so the CAPD cluster isn't overloaded.

## Steps

1. Add `deploy/gitops/base/kratos-db.yaml` and `deploy/gitops/base/hydra-db.yaml` following `bex-postgres.yaml` (CNPG `Cluster`, one database + owner role each: `kratos`/`kratos`, `hydra`/`hydra`).
2. Register both in `deploy/gitops/base/kustomization.yaml`.
3. Patch sizing in `deploy/gitops/overlays/local/kustomization.yaml` (1 instance, minimal storage).
4. Validate: `kustomize build deploy/gitops/overlays/local` renders; server-side dry-run against the mock cluster passes.

## Files

- `deploy/gitops/base/kratos-db.yaml` (new)
- `deploy/gitops/base/hydra-db.yaml` (new)
- `deploy/gitops/base/kustomization.yaml`
- `deploy/gitops/overlays/local/kustomization.yaml`

## Acceptance criteria

- [ ] Both CNPG `Cluster` resources apply and reach `Cluster in healthy state` on the local mock cluster.
- [ ] `kratos` and `hydra` databases exist with their owner roles; CNPG generated the credential Secrets.
- [ ] `kustomize build` of base and local overlay succeeds.

## Out of scope

- Deploying Kratos/Hydra themselves (t003/t004); production sizing/backup schedules (w1/m7 territory).
