Declarative PostgreSQL Management in Kubernetes: GitOps for Secure User Provisioning and Database Configuration

This paper presents a secure and fully automated GitOps-based framework for managing PostgreSQL deployments in Kubernetes. The system leverages ArgoCD and GitHub as the backbone of declarative configuration management, handling both PostgreSQL cluster configurations and user access policies. Sensitive credentials are never stored in plaintext; instead, a sealing process encrypts passwords into Kubernetes Sealed Secrets, ensuring secure handling of user data. A custom PostgreSQL User Controller dynamically reconciles sanitized user configurations from ConfigMaps with sealed credentials stored as Kubernetes Secrets, enabling automatic user creation, updates, and deletions. Simultaneously, the Zalando PostgreSQL Operator maintains the desired state of the database cluster, including provisioning, scaling, and failover. This approach enhances automation, security, and auditability, aligning with modern cloudnative best practices.