Paving · 02 of 03 · Anatomy
What a paved road to a cloud database is made of
The request is short on purpose. Everything a team would otherwise have to know, decide and remember about running a database in the cloud is in the five layers on the right, and none of them is optional.
What a paved road to a cloud database is made of
Left, the request: six lines in the app's xr-requests folder, kind ManagedPostgreSQL, name baggage-db, size small, version 17, allowedCidrs 203.0.113.0/24 and protect true, with no VPC, subnet, security group, parameter group or IAM. Right, what the platform adds, five layers: the contract (what you can ask for: a size, a version, storage and networks); defaults with no field (encrypted, TLS only, no network until you list one); identity (a password the provider generates, kept in a Secret, never in git); an answer (DependencyReady, with Ready, Provisioning or Failing and why); and a way out (delete the file and every piece goes, while protect keeps a snapshot). Bottom, what the app gets: the ConfigMap baggage-db-connection with host, port and sslmode, the Secret baggage-db-credentials written by the provider, and RDS for PostgreSQL 17 in its own VPC, encrypted at rest.
THE REQUEST WHAT THE PLATFORM ADDS WHAT THE APP GETS kind: ManagedPostgreSQL name: baggage-db size: small version: "17" allowedCidrs: [203.0.113.0/24] protect: true Six lines in the app's xr-requests/. No VPC, no subnet, no security group, no parameter group, no IAM. The contract what you can ask for: a size, a version, storage, networks Defaults with no field encrypted · TLS only · no network until you list one Identity a password the provider generates, in a Secret · never in git An answer DependencyReady: Ready, Provisioning or Failing, and why A way out delete the file and every piece goes · protect keeps a snapshot baggage-db-connection ConfigMap · host, port, sslmode baggage-db-credentials Secret · written by the provider RDS for PostgreSQL 17 its own VPC · encrypted at rest The road is everything the request doesn't have to say. LEGEND The request and its contract Built in, every time What the app reads The cloud resource
The schema is the first guardrail. A field that does not exist cannot be set wrong, and a value outside the list never reaches a review.
Encryption, TLS and a closed network are not settings. They are how this kind of database is built.
A fixed set of reasons means a person, a script and an agent all read the same status and know what to do next.