Skip to main content

Database & Access

Provision a database and grant an application least-privilege access to it. The Database manifest sizes the engine and declares logical databases; the application requests access in its accessControl.database block.

Database (AlloyDB / PostgreSQL)​

# .../environment/prod/project/login-svc/database/accounts-db.yaml
apiVersion: lowops.manifests.v1
kind: Database
metadata:
  name: accounts-db
  project: login-svc
  environment: prod
  organizational-unit: retail-banking
  organization: fincorp
spec:
  description: "Accounts and auth data."
  # Logical databases applications connect to (by name).
  databases:
    - name: accounts
      extensions: ["uuid-ossp", "pgcrypto"]   # AlloyDB (PostgreSQL) only
  # Select and size the engine. Exactly one of 'alloydb' or 'spanner'.
  alloydb:
    cpuCount: 4       # vCPUs per instance
    clusterSize: 1    # 1 = single primary; >1 adds read-pool instances

Cloud Spanner variant​

spec:
  description: "Globally consistent ledger."
  databases:
    - name: ledger
  spanner:
    processingUnits: 200   # multiple of 100, >= 100
    edition: STANDARD

Granting an application access​

Add this to the consuming Application (or ExternalApplication) spec:

spec:
  # ... source, container, project, target ...
  accessControl:
    database:
      name: accounts-db          # the Database manifest
      schema: accounts           # a logical database declared in spec.databases
      privileges:                # USAGE | CREATE | ALL
        - USAGE
        - CREATE
      readOnly: false            # true to connect against a read replica
      secretSource:              # REQUIRED: how credentials are delivered
        envVar: DATABASE_URL     # ...as an env var (or use filePath for a file mount)

The engine creates a dedicated database user for the application, grants exactly these privileges on the target schema, stores credentials in Secret Manager, and injects them as DATABASE_URL.

For pre-deploy schema migrations, attach a BEFORE job — see Running Database Migrations.