Databases

A ManagedPostgres is a PostgreSQL instance. It renders a CloudNativePG cluster in the same namespace, with backups on from the start and a credentials Secret an app can read directly.

apiVersion: paas.paasbox.com/v1alpha1
kind: ManagedPostgres
metadata: { name: db, namespace: shop }
spec:
  plan: s
  version: "17"
  storage: 20Gi
  backup:
    retention: 7d
    objectStoreSecretRef: { name: s3-backups }
status:
  conditions: [Reconciled, Ready, Degraded, BackupHealthy, ArchivingHealthy]
  phase: Ready
  endpoint: { host: db-rw.shop.svc, port: 5432, roHost: db-ro.shop.svc }
  secretName: db-credentials

Plans

Plan	CPU	Memory	Instances	Storage floor
xs	250m	256Mi	1	10Gi
s	500m	1Gi	2	10Gi
m	1	2Gi	2	20Gi
l	2	4Gi	2	50Gi

Every plan except xs runs two instances (a primary and a streaming replica) for automatic failover; xs is one instance, for development and previews. Prices per plan are not published yet.

What you can set

• plan — xs, s, m or l. Required.
• version — 16 or 17, default 17. Locked to its major once created: upgrading the major version is not available yet.
• storage — the data volume size. It can only increase, never shrink, and the plan’s floor applies if you set less.
• backup — retention (a window such as 7d or 30d, default 7d) and objectStoreSecretRef, naming a Secret in the same namespace with your object store’s accessKeyID, secretAccessKey, endpoint, bucket, and optionally region and path.
• hibernated — true stops the instance’s pods and keeps its volumes, for a database you are not using right now.
• restoreFrom — set only when you create the object: { managedPostgres: <source>, targetTime: <optional> } restores into this new instance from another one’s backups, up to a point in time if you give one. The source is never touched.

Backups are never optional

Every ManagedPostgres provisions with continuous backups on — retention and the object store are the only choices, not whether backups happen. If backup.objectStoreSecretRef is missing, the database still comes up, but its BackupHealthy condition goes False and the object’s phase turns Degraded: loud, so a missing store is something you see, not something that fails silently the day you need a restore.

The credentials Secret

status.secretName names a Secret with the servicebinding.io keys: type, provider, host, port, username, password, database, uri. There is no separate binding object — this Secret is the connection, and App.spec.uses is a shortcut for reading it.

# on the App
uses: [{ name: db, kind: ManagedPostgres, prefix: DB_ }]

injects DB_HOST, DB_PORT, DB_USER, DB_PASSWORD, DB_NAME and DB_URI into the app’s environment as references into db-credentials — never as copies, so a credential rotation reaches the app the next time its pod starts. The prefix defaults to the dependency’s name, upper-cased, with a trailing underscore, if you do not set one.

Using CloudNativePG directly

The operator behind ManagedPostgres is a normal, shared CNPG install: write a Cluster object yourself if you need a shape ManagedPostgres does not cover. pb status lists it, tagged unmanaged, and paasbox never touches it. See both ways.