From fbb65bb94a6433ebdacbfbf3229571cc1b793a70 Mon Sep 17 00:00:00 2001
From: Cooper Maruyama <me@cooperm.com>
Date: Tue, 13 Oct 2026 04:20:24 +0000
Subject: [PATCH] feat(ops): enable read-only Teleport access to production
 Postgres

---
 .../production/kustomization.yaml             |  6 +++++
 .../production/teleport-access.patch.yaml     | 24 +++++++++++++++++++
 2 files changed, 30 insertions(+)
 create mode 100644 ops/environments/production/teleport-access.patch.yaml

diff --git a/ops/environments/production/kustomization.yaml b/ops/environments/production/kustomization.yaml
index 94547d4..0b9b762 100644
--- a/ops/environments/production/kustomization.yaml
+++ b/ops/environments/production/kustomization.yaml
@@ -7,6 +7,12 @@ resources:
 generators:
   - postgres-secret-generator.yaml
 patches:
+  - target:
+      group: postgresql.cnpg.io
+      version: v1
+      kind: Cluster
+      name: template-postgres
+    path: teleport-access.patch.yaml
   - path: ghcr-pull-secret.patch.yaml
   - path: replicas.patch.yaml
   - path: runtime-config.patch.yaml
diff --git a/ops/environments/production/teleport-access.patch.yaml b/ops/environments/production/teleport-access.patch.yaml
new file mode 100644
index 0000000..9e7f4ac
--- /dev/null
+++ b/ops/environments/production/teleport-access.patch.yaml
@@ -0,0 +1,24 @@
+# CA Secret is managed by darkmatter/gitops template-postgres-platform.
+- op: add
+  path: /spec/certificates/clientCASecret
+  value: template-postgres-teleport-client-ca
+- op: add
+  path: /spec/managed/roles
+  value:
+    - name: teleport
+      comment: Teleport certificate login, read-only
+      inRoles:
+        - pg_read_all_data
+      ensure: present
+      login: true
+      superuser: false
+      createdb: false
+      createrole: false
+      replication: false
+      bypassrls: false
+      inherit: true
+      connectionLimit: 5
+      disablePassword: true
+- op: add
+  path: /spec/postgresql/pg_hba/0
+  value: hostssl all teleport 10.42.0.0/16 cert