fix(postgres): bound the CNPG instance pods' emptyDirs

[teemow]

Closes #875

Problem

The connectivity chart's CloudNativePG Cluster (kagent-pg) renders no resources and no ephemeralVolumesSizeLimit. The operator then mounts the scratch-data and shm emptyDirs without a sizeLimit and leaves bootstrap-controller and postgres without ephemeral-storage requests and limits, so Kyverno's require-emptydir-requests-and-limits reports every instance pod. With postgres.backup.method: plugin the operator adds a third emptyDir, plugins, which no Cluster field can bound. postgres and the plugin-barman-cloud sidecar both mount it. Same class as #780 (hook Jobs) and #866 (agent-manager migrate CronJob).

Change

• postgres.ephemeralVolumesSizeLimit → Cluster.spec.ephemeralVolumesSizeLimit, default shm: 256Mi, temporaryData: 1Gi. The operator sets these as the sizeLimit of shm and scratch-data.
• postgres.resources → Cluster.spec.resources (the postgres and bootstrap-controller containers). Defaults: requests cpu: 100m, memory: 512Mi, ephemeral-storage: 256Mi; limits cpu: 1, memory: 2Gi, ephemeral-storage: 2Gi. The memory limit leaves room for the memory-backed shm.
• postgres.backup.objectStore.sidecar.resources (was {}) → ObjectStore.spec.instanceSidecarConfiguration.resources. Defaults: requests cpu: 10m, memory: 64Mi, ephemeral-storage: 16Mi; limits memory: 256Mi, ephemeral-storage: 256Mi. These cover the sidecar's mount of the unbounded plugins emptyDir.
• Both charts carry the same defaults and schema. A null value renders no field.
• Rollout: a change of these fields rolls the instances once. The operator restarts the replicas, then switches the primary over.
• make verify-postgres-ephemeral-storage (chained into verify-postgres) builds the pod the operator renders from the Cluster and the ObjectStore, without and with the plugin backup, and applies the rule to it. It checks that the pod passes with the defaults and fails with all three knobs null, and that the meta chart forwards the connectivity defaults.

Open PR #852 changes templates/postgres/policy-exception.yaml, the ImageVolume exception for restrict-volume-types. That is a different policy, and its change does not overlap this one.

Proof

CNPG builds the pod, so the proof is on the live pod. Policy: require-emptydir-requests-and-limits as the kyverno-policies chart renders it, evaluated with the Kyverno CLI 1.19.1.

• Before (a lab on the 4.122.0 release candidate): kyverno apply policy.yaml --cluster --namespace kagent reports kagent/Pod/kagent-pg-1 (failed at path /resources/limits/). The pod's emptyDirs are scratch-data: {} and shm: {medium: Memory}, and both containers have resources: {}.
• After (the same lab with this branch's charts installed via platform.chartPath): the operator rolled the instance. The live pod:

  emptyDirs: scratch-data {sizeLimit: 1Gi}, shm {medium: Memory, sizeLimit: 256Mi}
  bootstrap-controller  requests {cpu: 100m, memory: 512Mi, ephemeral-storage: 256Mi}  limits {cpu: 1, memory: 2Gi, ephemeral-storage: 2Gi}
  postgres              requests {cpu: 100m, memory: 512Mi, ephemeral-storage: 256Mi}  limits {cpu: 1, memory: 2Gi, ephemeral-storage: 2Gi}
  

  The same --cluster scan no longer reports kagent-pg-1. The namespace's remaining findings are the agent-manager migrate CronJob and its runs, which fix(agent-manager): bound the migrate CronJob's emptyDir storage #873 addresses.
• The platform stays healthy: Cluster kagent-pg "Cluster in healthy state", 16 of 16 releases Ready, agentlab platform-test passes.

What the lab cannot show:

• An installation's Kyverno PolicyReport: the lab's Kyverno runs without a reports controller, so the CLI scan above read the live objects instead.
• The plugin-backup shape (plugins emptyDir and sidecar): the lab runs no backup. That shape is covered by make verify-postgres-ephemeral-storage, which models the pod after the operator's observed layout (plugins emptyDir without sizeLimit, mounted by postgres and plugin-barman-cloud).

Written by an agent.

[circleci-architect]

Published Helm chart agent-platform-connectivity

4.122.1-r7c3033cet20261009153930haefe1bb

Chart	agent-platform-connectivity
Version	4.122.1-r7c3033cet20261009153930haefe1bb
OCI reference	oci://gsoci.azurecr.io/charts/giantswarm/agent-platform-connectivity:4.122.1-r7c3033cet20261009153930haefe1bb
Digest	sha256:c145eea3d88a39b41473a21385c49c7b0737f5a523f5b43de2f906d22f195ad7
Registry	public — gsoci.azurecr.io
Git catalog	giantswarm-test-catalog (index)

Pull this chart

helm pull oci://gsoci.azurecr.io/charts/giantswarm/agent-platform-connectivity --version 4.122.1-r7c3033cet20261009153930haefe1bb

_{Posted by architect-orb · build 20667 · commit aefe1bb · updated in place on every push}

[circleci-architect]

Published Helm chart agent-platform

4.122.1-r7c3033cet20261009153930haefe1bb

Chart	agent-platform
Version	4.122.1-r7c3033cet20261009153930haefe1bb
OCI reference	oci://gsoci.azurecr.io/charts/giantswarm/agent-platform:4.122.1-r7c3033cet20261009153930haefe1bb
Digest	sha256:7692d9af58f0ebf5179aa3cf8e36fdcb11086324733fcfd4e882547470d844af
Registry	public — gsoci.azurecr.io
Git catalog	giantswarm-test-catalog (index)

Pull this chart

helm pull oci://gsoci.azurecr.io/charts/giantswarm/agent-platform --version 4.122.1-r7c3033cet20261009153930haefe1bb

_{Posted by architect-orb · build 20668 · commit aefe1bb · updated in place on every push}