From 9edc42a6651dd7b93432d11ab31fa78c6bc1d93b Mon Sep 17 00:00:00 2001
From: Jean-Gabriel Gill-Couture <jg@nationtech.io>
Date: Thu, 11 Dec 2025 14:35:18 -0500
Subject: [PATCH 01/20] feat: PostgreSQLScore happy path using cnpg operator

---
 harmony/src/modules/postgresql/cnpg/crd.rs |  57 ++++++++
 harmony/src/modules/postgresql/cnpg/mod.rs |   2 +
 harmony/src/modules/postgresql/mod.rs      |   3 +
 harmony/src/modules/postgresql/score.rs    | 145 ++++++++++-----------
 4 files changed, 134 insertions(+), 73 deletions(-)
 create mode 100644 harmony/src/modules/postgresql/cnpg/crd.rs
 create mode 100644 harmony/src/modules/postgresql/cnpg/mod.rs

diff --git a/harmony/src/modules/postgresql/cnpg/crd.rs b/harmony/src/modules/postgresql/cnpg/crd.rs
new file mode 100644
index 0000000..fad1003
--- /dev/null
+++ b/harmony/src/modules/postgresql/cnpg/crd.rs
@@ -0,0 +1,57 @@
+use kube::{api::ObjectMeta, CustomResource};
+use serde::{Deserialize, Serialize};
+
+#[derive(CustomResource, Deserialize, Serialize, Clone, Debug)]
+#[kube(
+    group = "postgresql.cnpg.io",
+    version = "v1",
+    kind = "Cluster",
+    plural = "clusters",
+    namespaced = true,
+    schema = "disabled"
+)]
+pub struct ClusterSpec {
+    pub instances: i32,
+    pub image_name: Option<String>,
+    pub storage: Storage,
+    pub bootstrap: Bootstrap,
+}
+
+impl Default for Cluster {
+    fn default() -> Self {
+        Cluster {
+            metadata: ObjectMeta::default(),
+            spec: ClusterSpec::default(),
+        }
+    }
+}
+
+impl Default for ClusterSpec {
+    fn default() -> Self {
+        Self {
+            instances: 1,
+            image_name: None,
+            storage: Storage::default(),
+            bootstrap: Bootstrap::default(),
+        }
+    }
+}
+
+#[derive(Deserialize, Serialize, Clone, Debug, Default)]
+#[serde(rename_all = "camelCase")]
+pub struct Storage {
+    pub size: String,
+}
+
+#[derive(Deserialize, Serialize, Clone, Debug, Default)]
+#[serde(rename_all = "camelCase")]
+pub struct Bootstrap {
+    pub initdb: Initdb,
+}
+
+#[derive(Deserialize, Serialize, Clone, Debug, Default)]
+#[serde(rename_all = "camelCase")]
+pub struct Initdb {
+    pub database: String,
+    pub owner: String,
+}
diff --git a/harmony/src/modules/postgresql/cnpg/mod.rs b/harmony/src/modules/postgresql/cnpg/mod.rs
new file mode 100644
index 0000000..0237c67
--- /dev/null
+++ b/harmony/src/modules/postgresql/cnpg/mod.rs
@@ -0,0 +1,2 @@
+mod crd;
+pub use crd::*;
diff --git a/harmony/src/modules/postgresql/mod.rs b/harmony/src/modules/postgresql/mod.rs
index 539a298..377e4d4 100644
--- a/harmony/src/modules/postgresql/mod.rs
+++ b/harmony/src/modules/postgresql/mod.rs
@@ -1,6 +1,9 @@
 pub mod capability;
 mod score;
+pub use score::*;
 
 pub mod failover;
 mod operator;
 pub use operator::*;
+
+pub mod cnpg;
diff --git a/harmony/src/modules/postgresql/score.rs b/harmony/src/modules/postgresql/score.rs
index 5c6f428..d32c1fc 100644
--- a/harmony/src/modules/postgresql/score.rs
+++ b/harmony/src/modules/postgresql/score.rs
@@ -1,88 +1,87 @@
-use crate::{
-    domain::{data::Version, interpret::InterpretStatus},
-    interpret::{Interpret, InterpretError, InterpretName, Outcome},
-    inventory::Inventory,
-    modules::postgresql::capability::PostgreSQL,
-    score::Score,
-    topology::Topology,
-};
-
-use super::capability::*;
-
-use harmony_types::id::Id;
-
-use async_trait::async_trait;
-use log::info;
 use serde::Serialize;
 
-#[derive(Clone, Debug, Serialize)]
+use crate::interpret::Interpret;
+use crate::modules::k8s::resource::K8sResourceScore;
+use crate::modules::postgresql::cnpg::{Bootstrap, Cluster, ClusterSpec, Initdb, Storage};
+use crate::score::Score;
+use crate::topology::{K8sclient, Topology};
+use k8s_openapi::apimachinery::pkg::apis::meta::v1::ObjectMeta;
+
+/// Deploys an opinionated, highly available PostgreSQL cluster managed by CNPG.
+///
+/// # Goals
+/// - Production-ready Postgres HA (3 instances), persistent storage, app DB.
+///
+/// # Usage
+/// ```
+/// use harmony::modules::postgresql::PostgreSQLScore;
+/// let score = PostgreSQLScore::new("my-app-ns");
+/// ```
+///
+/// # Limitations (Happy Path)
+/// - Requires CNPG operator installed (use CloudNativePgOperatorScore).
+/// - No backups, monitoring, extensions configured.
+///
+/// TODO : refactor this to declare a clean dependency on cnpg operator. Then cnpg operator will
+/// self-deploy either using operatorhub or helm chart depending on k8s flavor. This is cnpg
+/// specific behavior
+#[derive(Debug, Clone, Serialize)]
 pub struct PostgreSQLScore {
-    config: PostgreSQLConfig,
+    pub namespace: String,
+    pub instances: i32,
+    pub storage_size: String,
+    pub image_name: Option<String>,
 }
 
-#[derive(Debug, Clone)]
-pub struct PostgreSQLInterpret {
-    config: PostgreSQLConfig,
-    version: Version,
-    status: InterpretStatus,
-}
-
-impl PostgreSQLInterpret {
-    pub fn new(config: PostgreSQLConfig) -> Self {
-        let version = Version::from("1.0.0").expect("Version should be valid");
+impl Default for PostgreSQLScore {
+    fn default() -> Self {
         Self {
-            config,
-            version,
-            status: InterpretStatus::QUEUED,
+            namespace: "default".to_string(),
+            instances: 1,
+            storage_size: "1Gi".to_string(),
+            image_name: None, // This lets cnpg use its default image
         }
     }
 }
 
-impl<T: Topology + PostgreSQL> Score<T> for PostgreSQLScore {
-    fn name(&self) -> String {
-        "PostgreSQLScore".to_string()
+impl PostgreSQLScore {
+    pub fn new(namespace: &str) -> Self {
+        Self {
+            namespace: namespace.to_string(),
+            ..Default::default()
+        }
     }
+}
 
+impl<T: Topology + K8sclient> Score<T> for PostgreSQLScore {
     fn create_interpret(&self) -> Box<dyn Interpret<T>> {
-        Box::new(PostgreSQLInterpret::new(self.config.clone()))
-    }
-}
-
-#[async_trait]
-impl<T: Topology + PostgreSQL> Interpret<T> for PostgreSQLInterpret {
-    fn get_name(&self) -> InterpretName {
-        InterpretName::Custom("PostgreSQLInterpret")
-    }
-
-    fn get_version(&self) -> crate::domain::data::Version {
-        self.version.clone()
-    }
-
-    fn get_status(&self) -> InterpretStatus {
-        self.status.clone()
-    }
-
-    fn get_children(&self) -> Vec<Id> {
-        todo!()
-    }
-
-    async fn execute(
-        &self,
-        _inventory: &Inventory,
-        topology: &T,
-    ) -> Result<Outcome, InterpretError> {
-        info!(
-            "Executing PostgreSQLInterpret with config {:?}",
-            self.config
-        );
-
-        let cluster_name = topology
-            .deploy(&self.config)
-            .await
-            .map_err(|e| InterpretError::from(e))?;
-
-        Ok(Outcome::success(format!(
-            "Deployed PostgreSQL cluster `{cluster_name}`"
-        )))
+        let metadata = ObjectMeta {
+            name: Some("postgres".to_string()),
+            namespace: Some(self.namespace.clone()),
+            ..ObjectMeta::default()
+        };
+
+        let spec = ClusterSpec {
+            instances: self.instances,
+            image_name: self.image_name.clone(),
+            storage: Storage {
+                size: self.storage_size.clone(),
+            },
+            bootstrap: Bootstrap {
+                initdb: Initdb {
+                    database: "app".to_string(),
+                    owner: "app".to_string(),
+                },
+            },
+            ..ClusterSpec::default()
+        };
+
+        let cluster = Cluster { metadata, spec };
+
+        K8sResourceScore::single(cluster, Some(self.namespace.clone())).create_interpret()
+    }
+
+    fn name(&self) -> String {
+        format!("PostgreSQLScore({})", self.namespace)
     }
 }
-- 
2.39.5


From 2e367d88d4a5bf37e415854de7c41f637ef46f8a Mon Sep 17 00:00:00 2001
From: Jean-Gabriel Gill-Couture <jg@nationtech.io>
Date: Thu, 11 Dec 2025 22:54:57 -0500
Subject: [PATCH 02/20] feat: PostgreSQL score works, added postgresql example,
 tested on OKD 4.19, added note about incompatible default namespace settings

---
 examples/postgresql/Cargo.toml             | 18 ++++++++++++++++++
 examples/postgresql/src/main.rs            | 22 ++++++++++++++++++++++
 harmony/src/modules/postgresql/cnpg/crd.rs |  1 +
 harmony/src/modules/postgresql/score.rs    | 10 ++++++++--
 4 files changed, 49 insertions(+), 2 deletions(-)
 create mode 100644 examples/postgresql/Cargo.toml
 create mode 100644 examples/postgresql/src/main.rs

diff --git a/examples/postgresql/Cargo.toml b/examples/postgresql/Cargo.toml
new file mode 100644
index 0000000..df160a7
--- /dev/null
+++ b/examples/postgresql/Cargo.toml
@@ -0,0 +1,18 @@
+[package]
+name = "example-postgresql"
+edition = "2024"
+version.workspace = true
+readme.workspace = true
+license.workspace = true
+publish = false
+
+[dependencies]
+harmony = { path = "../../harmony" }
+harmony_cli = { path = "../../harmony_cli" }
+harmony_types = { path = "../../harmony_types" }
+cidr = { workspace = true }
+tokio = { workspace = true }
+harmony_macros = { path = "../../harmony_macros" }
+log = { workspace = true }
+env_logger = { workspace = true }
+url = { workspace = true }
diff --git a/examples/postgresql/src/main.rs b/examples/postgresql/src/main.rs
new file mode 100644
index 0000000..13da98a
--- /dev/null
+++ b/examples/postgresql/src/main.rs
@@ -0,0 +1,22 @@
+use harmony::{
+    inventory::Inventory, modules::postgresql::PostgreSQLScore, topology::K8sAnywhereTopology,
+};
+
+#[tokio::main]
+async fn main() {
+    let postgresql = PostgreSQLScore {
+        name: "harmony-postgres-example".to_string(), // Override default name
+        namespace: "harmony-postgres-example".to_string(),
+        ..Default::default() // Use harmony defaults, they are based on CNPG's default values :
+                             // "default" namespace, 1 instance, 1Gi storage
+    };
+
+    harmony_cli::run(
+        Inventory::autoload(),
+        K8sAnywhereTopology::from_env(),
+        vec![Box::new(postgresql)],
+        None,
+    )
+    .await
+    .unwrap();
+}
diff --git a/harmony/src/modules/postgresql/cnpg/crd.rs b/harmony/src/modules/postgresql/cnpg/crd.rs
index fad1003..5f06156 100644
--- a/harmony/src/modules/postgresql/cnpg/crd.rs
+++ b/harmony/src/modules/postgresql/cnpg/crd.rs
@@ -10,6 +10,7 @@ use serde::{Deserialize, Serialize};
     namespaced = true,
     schema = "disabled"
 )]
+#[serde(rename_all = "camelCase")]
 pub struct ClusterSpec {
     pub instances: i32,
     pub image_name: Option<String>,
diff --git a/harmony/src/modules/postgresql/score.rs b/harmony/src/modules/postgresql/score.rs
index d32c1fc..2a5e82f 100644
--- a/harmony/src/modules/postgresql/score.rs
+++ b/harmony/src/modules/postgresql/score.rs
@@ -27,6 +27,9 @@ use k8s_openapi::apimachinery::pkg::apis::meta::v1::ObjectMeta;
 /// specific behavior
 #[derive(Debug, Clone, Serialize)]
 pub struct PostgreSQLScore {
+    pub name: String,
+    /// **Note :** on OpenShfit based clusters, the namespace `default` has security
+    /// settings incompatible with the default CNPG behavior.
     pub namespace: String,
     pub instances: i32,
     pub storage_size: String,
@@ -36,7 +39,10 @@ pub struct PostgreSQLScore {
 impl Default for PostgreSQLScore {
     fn default() -> Self {
         Self {
-            namespace: "default".to_string(),
+            name: "harmony-pg".to_string(),
+            // We are using the namespace harmony by default since some clusters (openshift family)
+            // have incompatible configuration of the default namespace with cnpg
+            namespace: "harmony".to_string(),
             instances: 1,
             storage_size: "1Gi".to_string(),
             image_name: None, // This lets cnpg use its default image
@@ -56,7 +62,7 @@ impl PostgreSQLScore {
 impl<T: Topology + K8sclient> Score<T> for PostgreSQLScore {
     fn create_interpret(&self) -> Box<dyn Interpret<T>> {
         let metadata = ObjectMeta {
-            name: Some("postgres".to_string()),
+            name: Some(self.name.clone()),
             namespace: Some(self.namespace.clone()),
             ..ObjectMeta::default()
         };
-- 
2.39.5


From b61e4f9a96812eecd346b59c376fb5dc7c5c1e14 Mon Sep 17 00:00:00 2001
From: Jean-Gabriel Gill-Couture <jg@nationtech.io>
Date: Sat, 13 Dec 2025 09:47:59 -0500
Subject: [PATCH 03/20] wip: Expose postgres publicly. Created tlsroute
 capability and postgres implementations

---
 harmony/src/domain/topology/router.rs         | 81 +++++++++++++++++
 harmony/src/modules/postgresql/mod.rs         |  2 +
 .../src/modules/postgresql/score_public.rs    | 89 +++++++++++++++++++
 3 files changed, 172 insertions(+)
 create mode 100644 harmony/src/modules/postgresql/score_public.rs

diff --git a/harmony/src/domain/topology/router.rs b/harmony/src/domain/topology/router.rs
index 7c56e6a..3c8721d 100644
--- a/harmony/src/domain/topology/router.rs
+++ b/harmony/src/domain/topology/router.rs
@@ -1,11 +1,19 @@
+use async_trait::async_trait;
 use cidr::Ipv4Cidr;
 use derive_new::new;
 
 use super::{IpAddress, LogicalHost};
 
+/// Basic network router abstraction (L3 IP routing/gateway).
+/// Distinguished from TlsRouter (L4 TLS passthrough).
 pub trait Router: Send + Sync {
+    /// Gateway IP address for this subnet/router.
     fn get_gateway(&self) -> IpAddress;
+
+    /// CIDR block managed by this router.
     fn get_cidr(&self) -> Ipv4Cidr;
+
+    /// Logical host associated with this router.
     fn get_host(&self) -> LogicalHost;
 }
 
@@ -38,3 +46,76 @@ impl Router for UnmanagedRouter {
         todo!()
     }
 }
+
+
+#[derive(Clone, Debug)]
+
+/// Desired state config for a TLS passthrough route.
+/// Forwards external TLS (port 443) → backend service:target_port (no termination at router).
+/// Inspired by CNPG multisite: exposes `-rw`/`-ro` services publicly via OKD Route/HAProxy/K8s
+/// Gateway etc.
+/// 
+/// # Example
+/// ```
+/// use harmony::domain::topology::router::TlsRoute;
+/// let postgres_rw = TlsRoute {
+///     hostname: "postgres-cluster-example.public.domain.io".to_string(),
+///     backend: "postgres-cluster-example-rw".to_string(),  // k8s Service or HAProxy upstream
+///     target_port: 5432,
+/// };
+/// ```
+pub struct TlsRoute {
+    /// Public hostname clients connect to (TLS SNI, port 443 implicit).
+    /// Router matches this for passthrough forwarding.
+    pub hostname: String,
+
+    /// Backend/host identifier (k8s Service, HAProxy upstream, IP/FQDN, etc.).
+    pub backend: String,
+
+    /// Backend TCP port (Postgres: 5432).
+    pub target_port: u16,
+}
+
+#[async_trait]
+
+/// Installs and queries TLS passthrough routes (L4 TCP/SNI forwarding, no TLS termination).
+/// Agnostic to impl: OKD Route, AWS NLB+HAProxy, k3s Envoy Gateway, Apache ProxyPass.
+/// Used by PostgreSQL capability to expose CNPG clusters multisite (site1 → site2 replication).
+/// 
+/// # Usage
+/// ```rust,no_run
+/// // After CNPG deploy, expose RW endpoint
+/// let topology = okd_topology();
+/// let route = TlsRoute { /* ... */ };
+/// topology.install_route(route).await?;  // OKD Route, HAProxy reload, etc.
+/// 
+/// // Client: psql \\"host={route.hostname} port=443 sslmode=verify-ca sslnegotiation=direct\\"
+/// let public_ep = Endpoint { host: topology.hostname(), port: 443 };
+/// ```
+pub trait TlsRouter: Send + Sync {
+/// Provisions the route (idempotent where possible).
+    /// Example: OKD Route{ host, to: backend:target_port, tls: {passthrough} };
+    ///          HAProxy frontend→backend \"postgres-upstream\".
+    async fn install_route(&self, config: TlsRoute) -> Result<(), String>;
+
+    /// Installed route's public hostname.
+    fn hostname(&self) -> String;
+
+    /// Installed route's backend identifier.
+    fn backend(&self) -> String;
+
+    /// Installed route's backend port.
+    fn target_port(&self) -> u16;
+}
+
+impl std::fmt::Debug for dyn TlsRouter {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.write_fmt(format_args!(
+            "TlsRouter[hostname={}, backend={}:{}]",
+            self.hostname(),
+            self.backend(),
+            self.target_port()
+        ))
+    }
+}
+
diff --git a/harmony/src/modules/postgresql/mod.rs b/harmony/src/modules/postgresql/mod.rs
index 377e4d4..11c21aa 100644
--- a/harmony/src/modules/postgresql/mod.rs
+++ b/harmony/src/modules/postgresql/mod.rs
@@ -1,6 +1,8 @@
 pub mod capability;
 mod score;
 pub use score::*;
+mod score_public;
+pub use score_public::*;
 
 pub mod failover;
 mod operator;
diff --git a/harmony/src/modules/postgresql/score_public.rs b/harmony/src/modules/postgresql/score_public.rs
new file mode 100644
index 0000000..1bbe8fa
--- /dev/null
+++ b/harmony/src/modules/postgresql/score_public.rs
@@ -0,0 +1,89 @@
+use async_trait::async_trait;
+use serde::Serialize;
+
+use crate::domain::topology::router::{TlsRoute, TlsRouter};
+use crate::interpret::Interpret;
+use crate::modules::k8s::resource::K8sResourceScore;
+use crate::modules::postgresql::cnpg::{Bootstrap, Cluster, ClusterSpec, Initdb, Storage};
+use crate::modules::postgresql::PostgreSQLScore;
+use crate::score::Score;
+use crate::topology::{K8sclient, Topology};
+use k8s_openapi::apimachinery::pkg::apis::meta::v1::ObjectMeta;
+
+/// Deploys a public PostgreSQL cluster: CNPG + TLS passthrough route for RW endpoint.
+/// For failover/multisite: exposes single-instance or small HA Postgres publicly.
+/// 
+/// Sequence: PostgreSQLScore → TlsRouter::install_route (RW backend).
+/// 
+/// # Usage
+/// ```
+/// use harmony::modules::postgresql::PublicPostgreSQLScore;
+/// let score = PublicPostgreSQLScore::new("harmony", "pg-rw.example.com");
+/// ```
+#[derive(Debug, Clone, Serialize)]
+pub struct PublicPostgreSQLScore {
+    /// Inner non-public Postgres cluster config.
+    pub inner: PostgreSQLScore,
+    /// Public hostname for RW TLS passthrough (port 443 → cluster-rw:5432).
+    pub hostname: String,
+}
+
+impl Default for PublicPostgreSQLScore {
+    fn default() -> Self {
+        Self {
+            inner: PostgreSQLScore::default(),
+            hostname: "postgres.default.public".to_string(),
+        }
+    }
+}
+
+impl PublicPostgreSQLScore {
+    pub fn new(namespace: &str, hostname: &str) -> Self {
+        Self {
+            inner: PostgreSQLScore::new(namespace),
+            hostname: hostname.to_string(),
+        }
+    }
+}
+
+/// Custom interpret: deploy Postgres then install public TLS route.
+#[derive(Debug, Clone)]
+struct PublicPostgreSQLInterpret {
+    postgres_score: PostgreSQLScore,
+    tls_route: TlsRoute,
+}
+
+#[async_trait]
+impl<T: Topology + K8sclient + TlsRouter + Send + Sync> Interpret<T> for PublicPostgreSQLInterpret {
+    async fn interpret(&self, topo: &T) -> Result<(), Box<dyn std::error::Error>> {
+        // Deploy CNPG cluster first (creates -rw service)
+        self.postgres_score.create_interpret().interpret(topo).await?;
+
+        // Expose RW publicly via TLS passthrough
+        topo.install_route(self.tls_route.clone()).await.map_err(|e| Box::new(std::io::Error::new(std::io::ErrorKind::Other, e)) as Box<dyn std::error::Error>)?;
+
+        Ok(())
+    }
+}
+
+impl<T: Topology + K8sclient + TlsRouter + Send + Sync> Score<T> for PublicPostgreSQLScore {
+    fn create_interpret(&self) -> Box<dyn Interpret<T>> {
+        let rw_backend = format!("{}-rw", self.inner.name);
+        let tls_route = TlsRoute {
+            hostname: self.hostname.clone(),
+            backend: rw_backend,
+            target_port: 5432,
+        };
+
+        Box::new(PublicPostgreSQLInterpret {
+            postgres_score: self.inner.clone(),
+            tls_route,
+        })
+    }
+
+    fn name(&self) -> String {
+        format!("PublicPostgreSQLScore({}:{})", self.inner.namespace, self.hostname)
+    }
+} 
+
+// TODO: Add RO route (separate hostname/backend="cluster-ro"), backups, failover logic.
-- 
2.39.5


From 2254641f3d269154af377ed8795a0f587f9b1277 Mon Sep 17 00:00:00 2001
From: Jean-Gabriel Gill-Couture <jg@nationtech.io>
Date: Sat, 13 Dec 2025 17:56:53 -0500
Subject: [PATCH 04/20] fix: Tests, doctests, formatting

---
 harmony/src/domain/topology/mod.rs            |  2 +-
 harmony/src/domain/topology/router.rs         | 24 +++++-----
 harmony/src/modules/postgresql/cnpg/crd.rs    |  2 +-
 .../src/modules/postgresql/score_public.rs    | 47 +++++++++++++++----
 4 files changed, 50 insertions(+), 25 deletions(-)

diff --git a/harmony/src/domain/topology/mod.rs b/harmony/src/domain/topology/mod.rs
index 64e12d0..0e49efd 100644
--- a/harmony/src/domain/topology/mod.rs
+++ b/harmony/src/domain/topology/mod.rs
@@ -15,7 +15,7 @@ pub use k8s_anywhere::*;
 pub use localhost::*;
 pub mod k8s;
 mod load_balancer;
-mod router;
+pub mod router;
 mod tftp;
 use async_trait::async_trait;
 pub use ha_cluster::*;
diff --git a/harmony/src/domain/topology/router.rs b/harmony/src/domain/topology/router.rs
index 3c8721d..c1a48fc 100644
--- a/harmony/src/domain/topology/router.rs
+++ b/harmony/src/domain/topology/router.rs
@@ -47,17 +47,16 @@ impl Router for UnmanagedRouter {
     }
 }
 
-
 #[derive(Clone, Debug)]
 
 /// Desired state config for a TLS passthrough route.
 /// Forwards external TLS (port 443) → backend service:target_port (no termination at router).
 /// Inspired by CNPG multisite: exposes `-rw`/`-ro` services publicly via OKD Route/HAProxy/K8s
 /// Gateway etc.
-/// 
+///
 /// # Example
 /// ```
-/// use harmony::domain::topology::router::TlsRoute;
+/// use harmony::topology::router::TlsRoute;
 /// let postgres_rw = TlsRoute {
 ///     hostname: "postgres-cluster-example.public.domain.io".to_string(),
 ///     backend: "postgres-cluster-example-rw".to_string(),  // k8s Service or HAProxy upstream
@@ -81,19 +80,19 @@ pub struct TlsRoute {
 /// Installs and queries TLS passthrough routes (L4 TCP/SNI forwarding, no TLS termination).
 /// Agnostic to impl: OKD Route, AWS NLB+HAProxy, k3s Envoy Gateway, Apache ProxyPass.
 /// Used by PostgreSQL capability to expose CNPG clusters multisite (site1 → site2 replication).
-/// 
+///
 /// # Usage
-/// ```rust,no_run
+/// ```ignore
+/// use harmony::topology::router::TlsRoute;
 /// // After CNPG deploy, expose RW endpoint
-/// let topology = okd_topology();
-/// let route = TlsRoute { /* ... */ };
-/// topology.install_route(route).await?;  // OKD Route, HAProxy reload, etc.
-/// 
-/// // Client: psql \\"host={route.hostname} port=443 sslmode=verify-ca sslnegotiation=direct\\"
-/// let public_ep = Endpoint { host: topology.hostname(), port: 443 };
+/// async fn route() {
+///     let topology = okd_topology();
+///     let route = TlsRoute { /* ... */ };
+///     topology.install_route(route).await;  // OKD Route, HAProxy reload, etc.
+/// }
 /// ```
 pub trait TlsRouter: Send + Sync {
-/// Provisions the route (idempotent where possible).
+    /// Provisions the route (idempotent where possible).
     /// Example: OKD Route{ host, to: backend:target_port, tls: {passthrough} };
     ///          HAProxy frontend→backend \"postgres-upstream\".
     async fn install_route(&self, config: TlsRoute) -> Result<(), String>;
@@ -118,4 +117,3 @@ impl std::fmt::Debug for dyn TlsRouter {
         ))
     }
 }
-
diff --git a/harmony/src/modules/postgresql/cnpg/crd.rs b/harmony/src/modules/postgresql/cnpg/crd.rs
index 5f06156..122923e 100644
--- a/harmony/src/modules/postgresql/cnpg/crd.rs
+++ b/harmony/src/modules/postgresql/cnpg/crd.rs
@@ -1,4 +1,4 @@
-use kube::{api::ObjectMeta, CustomResource};
+use kube::{CustomResource, api::ObjectMeta};
 use serde::{Deserialize, Serialize};
 
 #[derive(CustomResource, Deserialize, Serialize, Clone, Debug)]
diff --git a/harmony/src/modules/postgresql/score_public.rs b/harmony/src/modules/postgresql/score_public.rs
index 1bbe8fa..73c2193 100644
--- a/harmony/src/modules/postgresql/score_public.rs
+++ b/harmony/src/modules/postgresql/score_public.rs
@@ -1,20 +1,23 @@
 use async_trait::async_trait;
+use harmony_types::id::Id;
 use serde::Serialize;
 
+use crate::data::Version;
 use crate::domain::topology::router::{TlsRoute, TlsRouter};
-use crate::interpret::Interpret;
+use crate::interpret::{Interpret, InterpretError, InterpretName, InterpretStatus, Outcome};
+use crate::inventory::Inventory;
 use crate::modules::k8s::resource::K8sResourceScore;
-use crate::modules::postgresql::cnpg::{Bootstrap, Cluster, ClusterSpec, Initdb, Storage};
 use crate::modules::postgresql::PostgreSQLScore;
+use crate::modules::postgresql::cnpg::{Bootstrap, Cluster, ClusterSpec, Initdb, Storage};
 use crate::score::Score;
 use crate::topology::{K8sclient, Topology};
 use k8s_openapi::apimachinery::pkg::apis::meta::v1::ObjectMeta;
 
 /// Deploys a public PostgreSQL cluster: CNPG + TLS passthrough route for RW endpoint.
 /// For failover/multisite: exposes single-instance or small HA Postgres publicly.
-/// 
+///
 /// Sequence: PostgreSQLScore → TlsRouter::install_route (RW backend).
-/// 
+///
 /// # Usage
 /// ```
 /// use harmony::modules::postgresql::PublicPostgreSQLScore;
@@ -55,14 +58,35 @@ struct PublicPostgreSQLInterpret {
 
 #[async_trait]
 impl<T: Topology + K8sclient + TlsRouter + Send + Sync> Interpret<T> for PublicPostgreSQLInterpret {
-    async fn interpret(&self, topo: &T) -> Result<(), Box<dyn std::error::Error>> {
+    fn get_name(&self) -> InterpretName {
+        InterpretName::Custom("PublicPostgreSQLInterpret")
+    }
+    fn get_version(&self) -> Version {
+        todo!()
+    }
+    fn get_status(&self) -> InterpretStatus {
+        todo!()
+    }
+    fn get_children(&self) -> Vec<Id> {
+        todo!()
+    }
+    async fn execute(&self, inventory: &Inventory, topo: &T) -> Result<Outcome, InterpretError> {
         // Deploy CNPG cluster first (creates -rw service)
-        self.postgres_score.create_interpret().interpret(topo).await?;
+        self.postgres_score
+            .create_interpret()
+            .execute(inventory, topo)
+            .await?;
 
         // Expose RW publicly via TLS passthrough
-        topo.install_route(self.tls_route.clone()).await.map_err(|e| Box::new(std::io::Error::new(std::io::ErrorKind::Other, e)) as Box<dyn std::error::Error>)?;
+        topo.install_route(self.tls_route.clone())
+            .await
+            .map_err(|e| InterpretError::new(e))?;
 
-        Ok(())
+        Ok(Outcome::success(format!(
+            "Public CNPG cluster '{}' deployed with TLS passthrough route '{}'",
+            self.postgres_score.name.clone(),
+            self.tls_route.hostname
+        )))
     }
 }
 
@@ -82,8 +106,11 @@ impl<T: Topology + K8sclient + TlsRouter + Send + Sync> Score<T> for PublicPostg
     }
 
     fn name(&self) -> String {
-        format!("PublicPostgreSQLScore({}:{})", self.inner.namespace, self.hostname)
+        format!(
+            "PublicPostgreSQLScore({}:{})",
+            self.inner.namespace, self.hostname
+        )
     }
-} 
+}
 
 // TODO: Add RO route (separate hostname/backend="cluster-ro"), backups, failover logic.
-- 
2.39.5


From 142300802d90bccffd667745697b6ace6ac61802 Mon Sep 17 00:00:00 2001
From: Jean-Gabriel Gill-Couture <jg@nationtech.io>
Date: Sat, 13 Dec 2025 22:32:27 -0500
Subject: [PATCH 05/20] wip: TlsRoute score first version

---
 harmony/src/domain/topology/router.rs     |  3 +-
 harmony/src/modules/mod.rs                |  1 +
 harmony/src/modules/network/mod.rs        |  2 +
 harmony/src/modules/network/tls_router.rs | 99 +++++++++++++++++++++++
 harmony/src/modules/okd/mod.rs            |  1 +
 5 files changed, 104 insertions(+), 2 deletions(-)
 create mode 100644 harmony/src/modules/network/mod.rs
 create mode 100644 harmony/src/modules/network/tls_router.rs

diff --git a/harmony/src/domain/topology/router.rs b/harmony/src/domain/topology/router.rs
index c1a48fc..66ae8f9 100644
--- a/harmony/src/domain/topology/router.rs
+++ b/harmony/src/domain/topology/router.rs
@@ -75,8 +75,6 @@ pub struct TlsRoute {
     pub target_port: u16,
 }
 
-#[async_trait]
-
 /// Installs and queries TLS passthrough routes (L4 TCP/SNI forwarding, no TLS termination).
 /// Agnostic to impl: OKD Route, AWS NLB+HAProxy, k3s Envoy Gateway, Apache ProxyPass.
 /// Used by PostgreSQL capability to expose CNPG clusters multisite (site1 → site2 replication).
@@ -91,6 +89,7 @@ pub struct TlsRoute {
 ///     topology.install_route(route).await;  // OKD Route, HAProxy reload, etc.
 /// }
 /// ```
+#[async_trait]
 pub trait TlsRouter: Send + Sync {
     /// Provisions the route (idempotent where possible).
     /// Example: OKD Route{ host, to: backend:target_port, tls: {passthrough} };
diff --git a/harmony/src/modules/mod.rs b/harmony/src/modules/mod.rs
index 910b535..4c6e7b6 100644
--- a/harmony/src/modules/mod.rs
+++ b/harmony/src/modules/mod.rs
@@ -11,6 +11,7 @@ pub mod k8s;
 pub mod lamp;
 pub mod load_balancer;
 pub mod monitoring;
+pub mod network;
 pub mod okd;
 pub mod opnsense;
 pub mod postgresql;
diff --git a/harmony/src/modules/network/mod.rs b/harmony/src/modules/network/mod.rs
new file mode 100644
index 0000000..c70dd89
--- /dev/null
+++ b/harmony/src/modules/network/mod.rs
@@ -0,0 +1,2 @@
+mod tls_router;
+pub use tls_router::*;
diff --git a/harmony/src/modules/network/tls_router.rs b/harmony/src/modules/network/tls_router.rs
new file mode 100644
index 0000000..c5e520d
--- /dev/null
+++ b/harmony/src/modules/network/tls_router.rs
@@ -0,0 +1,99 @@
+use async_trait::async_trait;
+use harmony_types::id::Id;
+use serde::Serialize;
+
+use crate::data::Version;
+use crate::domain::topology::router::{TlsRoute, TlsRouter};
+use crate::interpret::{Interpret, InterpretError, InterpretName, InterpretStatus, Outcome};
+use crate::inventory::Inventory;
+use crate::score::Score;
+use crate::topology::{K8sclient, Topology};
+
+/// Score for provisioning a TLS passthrough route.
+/// Exposes backend services via TLS passthrough (L4 TCP/SNI forwarding).
+/// Agnostic to underlying router impl (OKD Route, HAProxy, Envoy, etc.).
+///
+/// # Usage
+/// ```
+/// use harmony::modules::network::TlsRouterScore;
+/// let score = TlsRouterScore::new("postgres-cluster-rw", "pg-rw.example.com", 5432);
+/// ```
+#[derive(Debug, Clone, Serialize)]
+pub struct TlsRouterScore {
+    /// Backend identifier (k8s Service, HAProxy upstream, IP/FQDN, etc.).
+    pub backend: String,
+    /// Public hostname clients connect to (TLS SNI, port 443 implicit).
+    pub hostname: String,
+    /// Backend TCP port.
+    pub target_port: u16,
+}
+
+impl Default for TlsRouterScore {
+    fn default() -> Self {
+        Self {
+            backend: "default-backend".to_string(),
+            hostname: "tls.default.public".to_string(),
+            target_port: 5432,
+        }
+    }
+}
+
+impl TlsRouterScore {
+    pub fn new(backend: &str, hostname: &str, target_port: u16) -> Self {
+        Self {
+            backend: backend.to_string(),
+            hostname: hostname.to_string(),
+            target_port,
+        }
+    }
+}
+
+/// Custom interpret: provisions the TLS passthrough route on the topology.
+#[derive(Debug, Clone)]
+struct TlsRouterInterpret {
+    tls_route: TlsRoute,
+}
+
+#[async_trait]
+impl<T: Topology + K8sclient + TlsRouter + Send + Sync> Interpret<T> for TlsRouterInterpret {
+    fn get_name(&self) -> InterpretName {
+        InterpretName::Custom("TlsRouterInterpret")
+    }
+    fn get_version(&self) -> Version {
+        todo!()
+    }
+    fn get_status(&self) -> InterpretStatus {
+        todo!()
+    }
+    fn get_children(&self) -> Vec<Id> {
+        todo!()
+    }
+    async fn execute(&self, _inventory: &Inventory, topo: &T) -> Result<Outcome, InterpretError> {
+        topo.install_route(self.tls_route.clone())
+            .await
+            .map_err(|e| InterpretError::new(e.to_string()))?;
+
+        Ok(Outcome::success(format!(
+            "TLS route installed: {} → {}:{}",
+            self.tls_route.hostname, self.tls_route.backend, self.tls_route.target_port
+        )))
+    }
+}
+
+impl<T: Topology + K8sclient + TlsRouter + Send + Sync> Score<T> for TlsRouterScore {
+    fn create_interpret(&self) -> Box<dyn Interpret<T>> {
+        let tls_route = TlsRoute {
+            hostname: self.hostname.clone(),
+            backend: self.backend.clone(),
+            target_port: self.target_port,
+        };
+        Box::new(TlsRouterInterpret { tls_route })
+    }
+
+    fn name(&self) -> String {
+        format!(
+            "TlsRouterScore({}:{ } → {})",
+            self.backend, self.target_port, self.hostname
+        )
+    }
+}
diff --git a/harmony/src/modules/okd/mod.rs b/harmony/src/modules/okd/mod.rs
index 8bb85ef..da6f9e8 100644
--- a/harmony/src/modules/okd/mod.rs
+++ b/harmony/src/modules/okd/mod.rs
@@ -12,6 +12,7 @@ pub mod dns;
 pub mod installation;
 pub mod ipxe;
 pub mod load_balancer;
+pub mod route;
 pub mod templates;
 pub mod upgrade;
 pub use bootstrap_01_prepare::*;
-- 
2.39.5


From d06bd4dac67f5f82be0eace0afeeaa46dc45976f Mon Sep 17 00:00:00 2001
From: Jean-Gabriel Gill-Couture <jg@nationtech.io>
Date: Sun, 14 Dec 2025 17:04:40 -0500
Subject: [PATCH 06/20] feat: OKD route CRD and OKD specific route score

---
 harmony/src/modules/network/tls_router.rs |  73 +++---
 harmony/src/modules/okd/crd/mod.rs        |   1 +
 harmony/src/modules/okd/crd/route.rs      | 285 ++++++++++++++++++++++
 harmony/src/modules/okd/route.rs          | 136 +++++++++++
 4 files changed, 457 insertions(+), 38 deletions(-)
 create mode 100644 harmony/src/modules/okd/crd/route.rs
 create mode 100644 harmony/src/modules/okd/route.rs

diff --git a/harmony/src/modules/network/tls_router.rs b/harmony/src/modules/network/tls_router.rs
index c5e520d..5f43df3 100644
--- a/harmony/src/modules/network/tls_router.rs
+++ b/harmony/src/modules/network/tls_router.rs
@@ -13,13 +13,30 @@ use crate::topology::{K8sclient, Topology};
 /// Exposes backend services via TLS passthrough (L4 TCP/SNI forwarding).
 /// Agnostic to underlying router impl (OKD Route, HAProxy, Envoy, etc.).
 ///
+/// TlsPassthroughScore relies on the TlsRouter Capability for its entire functionnality,
+/// the implementation depends entirely on how the Topology implements it.
+///
 /// # Usage
 /// ```
-/// use harmony::modules::network::TlsRouterScore;
-/// let score = TlsRouterScore::new("postgres-cluster-rw", "pg-rw.example.com", 5432);
+/// use harmony::modules::network::TlsPassthroughScore;
+/// let score = TlsPassthroughScore {
+///     backend: "postgres-cluster-rw".to_string(),
+///     hostname: "postgres-rw.example.com".to_string(),
+///     target_port: 5432,
+/// };
 /// ```
+///
+/// # Hint
+///
+/// **This TlsPassthroughScore should be used whenever possible.** It is effectively
+/// an abstraction over the concept of tls passthrough, and it will allow much more flexible
+/// usage over multiple types of Topology than using a lower level module such as
+/// OKDTlsPassthroughScore.
+///
+/// On the other hand, some implementation specific options might not be available or practical
+/// to use through this high level TlsPassthroughScore.
 #[derive(Debug, Clone, Serialize)]
-pub struct TlsRouterScore {
+pub struct TlsPassthroughScore {
     /// Backend identifier (k8s Service, HAProxy upstream, IP/FQDN, etc.).
     pub backend: String,
     /// Public hostname clients connect to (TLS SNI, port 443 implicit).
@@ -28,34 +45,32 @@ pub struct TlsRouterScore {
     pub target_port: u16,
 }
 
-impl Default for TlsRouterScore {
-    fn default() -> Self {
-        Self {
-            backend: "default-backend".to_string(),
-            hostname: "tls.default.public".to_string(),
-            target_port: 5432,
-        }
+impl<T: Topology + K8sclient + TlsRouter + Send + Sync> Score<T> for TlsPassthroughScore {
+    fn create_interpret(&self) -> Box<dyn Interpret<T>> {
+        let tls_route = TlsRoute {
+            hostname: self.hostname.clone(),
+            backend: self.backend.clone(),
+            target_port: self.target_port,
+        };
+        Box::new(TlsPassthroughInterpret { tls_route })
     }
-}
 
-impl TlsRouterScore {
-    pub fn new(backend: &str, hostname: &str, target_port: u16) -> Self {
-        Self {
-            backend: backend.to_string(),
-            hostname: hostname.to_string(),
-            target_port,
-        }
+    fn name(&self) -> String {
+        format!(
+            "TlsRouterScore({}:{} → {})",
+            self.backend, self.target_port, self.hostname
+        )
     }
 }
 
 /// Custom interpret: provisions the TLS passthrough route on the topology.
 #[derive(Debug, Clone)]
-struct TlsRouterInterpret {
+struct TlsPassthroughInterpret {
     tls_route: TlsRoute,
 }
 
 #[async_trait]
-impl<T: Topology + K8sclient + TlsRouter + Send + Sync> Interpret<T> for TlsRouterInterpret {
+impl<T: Topology + K8sclient + TlsRouter + Send + Sync> Interpret<T> for TlsPassthroughInterpret {
     fn get_name(&self) -> InterpretName {
         InterpretName::Custom("TlsRouterInterpret")
     }
@@ -79,21 +94,3 @@ impl<T: Topology + K8sclient + TlsRouter + Send + Sync> Interpret<T> for TlsRout
         )))
     }
 }
-
-impl<T: Topology + K8sclient + TlsRouter + Send + Sync> Score<T> for TlsRouterScore {
-    fn create_interpret(&self) -> Box<dyn Interpret<T>> {
-        let tls_route = TlsRoute {
-            hostname: self.hostname.clone(),
-            backend: self.backend.clone(),
-            target_port: self.target_port,
-        };
-        Box::new(TlsRouterInterpret { tls_route })
-    }
-
-    fn name(&self) -> String {
-        format!(
-            "TlsRouterScore({}:{ } → {})",
-            self.backend, self.target_port, self.hostname
-        )
-    }
-}
diff --git a/harmony/src/modules/okd/crd/mod.rs b/harmony/src/modules/okd/crd/mod.rs
index 568db3f..71c4d0a 100644
--- a/harmony/src/modules/okd/crd/mod.rs
+++ b/harmony/src/modules/okd/crd/mod.rs
@@ -1 +1,2 @@
 pub mod nmstate;
+pub mod route;
diff --git a/harmony/src/modules/okd/crd/route.rs b/harmony/src/modules/okd/crd/route.rs
new file mode 100644
index 0000000..ad146de
--- /dev/null
+++ b/harmony/src/modules/okd/crd/route.rs
@@ -0,0 +1,285 @@
+use k8s_openapi::apimachinery::pkg::apis::meta::v1::{ListMeta, ObjectMeta, Time};
+use k8s_openapi::apimachinery::pkg::util::intstr::IntOrString;
+use k8s_openapi::{NamespaceResourceScope, Resource};
+use serde::{Deserialize, Serialize};
+
+#[derive(Deserialize, Serialize, Clone, Debug)]
+#[serde(rename_all = "camelCase")]
+pub struct LocalObjectReference {
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub name: Option<String>,
+}
+
+#[derive(Deserialize, Serialize, Clone, Debug)]
+#[serde(rename_all = "camelCase")]
+pub struct Route {
+    // #[serde(skip_serializing_if = "Option::is_none")]
+    // pub api_version: Option<String>,
+    //
+    // #[serde(skip_serializing_if = "Option::is_none")]
+    // pub kind: Option<String>,
+    pub metadata: ObjectMeta,
+
+    pub spec: RouteSpec,
+
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub status: Option<RouteStatus>,
+}
+
+impl Resource for Route {
+    const API_VERSION: &'static str = "route.openshift.io/v1";
+    const GROUP: &'static str = "route.openshift.io";
+    const VERSION: &'static str = "v1";
+    const KIND: &'static str = "Route";
+    const URL_PATH_SEGMENT: &'static str = "routes";
+    type Scope = NamespaceResourceScope;
+}
+
+impl k8s_openapi::Metadata for Route {
+    type Ty = ObjectMeta;
+
+    fn metadata(&self) -> &Self::Ty {
+        &self.metadata
+    }
+
+    fn metadata_mut(&mut self) -> &mut Self::Ty {
+        &mut self.metadata
+    }
+}
+
+impl Default for Route {
+    fn default() -> Self {
+        Route {
+            metadata: ObjectMeta::default(),
+            spec: RouteSpec::default(),
+            status: None,
+        }
+    }
+}
+
+#[derive(Deserialize, Serialize, Clone, Debug)]
+#[serde(rename_all = "camelCase")]
+pub struct RouteList {
+    pub metadata: ListMeta,
+    pub items: Vec<Route>,
+}
+
+impl Default for RouteList {
+    fn default() -> Self {
+        Self {
+            metadata: ListMeta::default(),
+            items: Vec::new(),
+        }
+    }
+}
+
+impl Resource for RouteList {
+    const API_VERSION: &'static str = "route.openshift.io/v1";
+    const GROUP: &'static str = "route.openshift.io";
+    const VERSION: &'static str = "v1";
+    const KIND: &'static str = "RouteList";
+    const URL_PATH_SEGMENT: &'static str = "routes";
+    type Scope = NamespaceResourceScope;
+}
+
+impl k8s_openapi::Metadata for RouteList {
+    type Ty = ListMeta;
+
+    fn metadata(&self) -> &Self::Ty {
+        &self.metadata
+    }
+
+    fn metadata_mut(&mut self) -> &mut Self::Ty {
+        &mut self.metadata
+    }
+}
+
+#[derive(Deserialize, Serialize, Clone, Debug)]
+#[serde(rename_all = "camelCase")]
+pub struct RouteSpec {
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub alternate_backends: Option<Vec<RouteTargetReference>>,
+
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub host: Option<String>,
+
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub http_headers: Option<RouteHTTPHeaders>,
+
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub path: Option<String>,
+
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub port: Option<RoutePort>,
+
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub subdomain: Option<String>,
+
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub tls: Option<TLSConfig>,
+
+    pub to: RouteTargetReference,
+
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub wildcard_policy: Option<String>,
+}
+impl Default for RouteSpec {
+    fn default() -> RouteSpec {
+        RouteSpec {
+            alternate_backends: None,
+            host: None,
+            http_headers: None,
+            path: None,
+            port: None,
+            subdomain: None,
+            tls: None,
+            to: RouteTargetReference::default(),
+            wildcard_policy: None,
+        }
+    }
+}
+
+#[derive(Deserialize, Serialize, Clone, Debug)]
+#[serde(rename_all = "camelCase")]
+pub struct RouteTargetReference {
+    pub kind: String,
+    pub name: String,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub weight: Option<i32>,
+}
+impl Default for RouteTargetReference {
+    fn default() -> RouteTargetReference {
+        RouteTargetReference {
+            kind: String::default(),
+            name: String::default(),
+            weight: None,
+        }
+    }
+}
+
+#[derive(Deserialize, Serialize, Clone, Debug)]
+#[serde(rename_all = "camelCase")]
+pub struct RoutePort {
+    pub target_port: IntOrString,
+}
+
+#[derive(Deserialize, Serialize, Clone, Debug)]
+#[serde(rename_all = "camelCase")]
+pub struct TLSConfig {
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub ca_certificate: Option<String>,
+
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub certificate: Option<String>,
+
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub destination_ca_certificate: Option<String>,
+
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub external_certificate: Option<LocalObjectReference>,
+
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub insecure_edge_termination_policy: Option<String>,
+
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub key: Option<String>,
+
+    pub termination: String,
+}
+
+impl Default for TLSConfig {
+    fn default() -> Self {
+        Self {
+            ca_certificate: None,
+            certificate: None,
+            destination_ca_certificate: None,
+            external_certificate: None,
+            insecure_edge_termination_policy: None,
+            key: None,
+            termination: "edge".to_string(),
+        }
+    }
+}
+
+#[derive(Deserialize, Serialize, Clone, Debug)]
+#[serde(rename_all = "camelCase")]
+pub struct RouteStatus {
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub ingress: Option<Vec<RouteIngress>>,
+}
+
+#[derive(Deserialize, Serialize, Clone, Debug)]
+#[serde(rename_all = "camelCase")]
+pub struct RouteIngress {
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub host: Option<String>,
+
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub router_canonical_hostname: Option<String>,
+
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub router_name: Option<String>,
+
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub wildcard_policy: Option<String>,
+
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub conditions: Option<Vec<RouteIngressCondition>>,
+}
+
+#[derive(Deserialize, Serialize, Clone, Debug)]
+#[serde(rename_all = "camelCase")]
+pub struct RouteIngressCondition {
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub last_transition_time: Option<Time>,
+
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub message: Option<String>,
+
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub reason: Option<String>,
+
+    pub status: String,
+    #[serde(rename = "type")]
+    pub condition_type: String,
+}
+
+#[derive(Deserialize, Serialize, Clone, Debug)]
+#[serde(rename_all = "camelCase")]
+pub struct RouteHTTPHeader {
+    pub name: String,
+    pub action: RouteHTTPHeaderActionUnion,
+}
+
+#[derive(Deserialize, Serialize, Clone, Debug)]
+#[serde(rename_all = "camelCase")]
+pub struct RouteHTTPHeaderActionUnion {
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub set: Option<RouteSetHTTPHeader>,
+
+    #[serde(rename = "type")]
+    pub action_type: String,
+}
+
+#[derive(Deserialize, Serialize, Clone, Debug)]
+#[serde(rename_all = "camelCase")]
+pub struct RouteSetHTTPHeader {
+    pub value: String,
+}
+
+#[derive(Deserialize, Serialize, Clone, Debug, Default)]
+#[serde(rename_all = "camelCase")]
+pub struct RouteHTTPHeaderActions {
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub request: Option<Vec<RouteHTTPHeader>>,
+
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub response: Option<Vec<RouteHTTPHeader>>,
+}
+
+#[derive(Deserialize, Serialize, Clone, Debug)]
+#[serde(rename_all = "camelCase")]
+pub struct RouteHTTPHeaders {
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub actions: Option<RouteHTTPHeaderActions>,
+}
diff --git a/harmony/src/modules/okd/route.rs b/harmony/src/modules/okd/route.rs
new file mode 100644
index 0000000..7360b04
--- /dev/null
+++ b/harmony/src/modules/okd/route.rs
@@ -0,0 +1,136 @@
+// TODO
+// Write OKDRouteScore : This is the real one which will apply the k8s resource and expose all
+// relevant option to Harmony's various use cases
+//
+// Write OKDTlsPassthroughScore : This one will use an OKDRouteScore under the hood and simply fill
+// in all settings to make this route a TlsPassthrough
+//
+// These scores are meant to be used by an OKD based topology to provide Capabilities like
+// TlsRouter
+//
+// The first use case to serve here is the postgresql multisite setup, so exposing only the
+// settings relevant to this use case is enough at first, following YAGNI.
+//
+// These scores are not intended to be used directly by a user, unless the user knows that he will
+// always be dealing only with okd/openshift compatible topologies and is ready to manage the
+// additional maintenance burden that comes with a lower level functionnality.
+
+use k8s_openapi::apimachinery::pkg::util::intstr::IntOrString;
+use kube::api::ObjectMeta;
+use serde::Serialize;
+
+use crate::modules::k8s::resource::K8sResourceScore;
+use crate::modules::okd::crd::route::{
+    Route, RoutePort, RouteSpec, RouteTargetReference, TLSConfig,
+};
+use crate::score::Score;
+use crate::topology::{K8sclient, Topology};
+
+#[derive(Clone, Debug, Serialize)]
+struct OKDRoutePort {
+    #[serde(rename = "targetPort")]
+    target_port: String,
+}
+
+#[derive(Clone, Debug, Serialize)]
+struct OKDTLSConfig {
+    #[serde(rename = "termination")]
+    termination: String,
+    #[serde(rename = "insecureEdgeTerminationPolicy")]
+    insecure_edge_termination_policy: String,
+}
+
+#[derive(Debug, Clone, Serialize)]
+pub struct OKDRouteScore {
+    pub name: String,
+    pub namespace: String,
+    pub spec: RouteSpec,
+}
+
+impl OKDRouteScore {
+    pub fn new(name: &str, namespace: &str, spec: RouteSpec) -> Self {
+        Self {
+            name: name.to_string(),
+            namespace: namespace.to_string(),
+            spec,
+        }
+    }
+}
+
+impl<T: Topology + K8sclient> Score<T> for OKDRouteScore {
+    fn create_interpret(&self) -> Box<dyn crate::interpret::Interpret<T>> {
+        let route = Route {
+            metadata: ObjectMeta {
+                name: Some(self.name.clone()),
+                namespace: Some(self.namespace.clone()),
+                ..ObjectMeta::default()
+            },
+            spec: self.spec.clone(),
+            status: None,
+        };
+        K8sResourceScore::single(route, Some(self.namespace.clone())).create_interpret()
+    }
+
+    fn name(&self) -> String {
+        format!("OKDRouteScore({})", self.name)
+    }
+}
+
+#[derive(Debug, Clone, Serialize)]
+pub struct OKDTlsPassthroughScore {
+    pub name: String,
+    pub namespace: String,
+    pub backend: String,
+    pub hostname: String,
+    pub target_port: String,
+}
+
+impl OKDTlsPassthroughScore {
+    pub fn new(
+        name: &str,
+        namespace: &str,
+        backend: &str,
+        hostname: &str,
+        target_port: &str,
+    ) -> Self {
+        Self {
+            name: name.to_string(),
+            namespace: namespace.to_string(),
+            backend: backend.to_string(),
+            hostname: hostname.to_string(),
+            target_port: target_port.to_string(),
+        }
+    }
+}
+
+impl<T: Topology + K8sclient> Score<T> for OKDTlsPassthroughScore {
+    fn create_interpret(&self) -> Box<dyn crate::interpret::Interpret<T>> {
+        let passthrough_spec = RouteSpec {
+            host: Some(self.hostname.clone()),
+            wildcard_policy: Some("None".to_string()),
+            to: RouteTargetReference {
+                kind: "Service".to_string(),
+                name: self.backend.clone(),
+                weight: Some(100),
+            },
+            port: Some(RoutePort {
+                target_port: IntOrString::String(self.target_port.clone()),
+            }),
+            tls: Some(TLSConfig {
+                termination: "passthrough".to_string(),
+                insecure_edge_termination_policy: Some("None".to_string()),
+                ..Default::default()
+            }),
+            ..Default::default()
+        };
+        let route_score = OKDRouteScore::new(&self.name, &self.namespace, passthrough_spec);
+        route_score.create_interpret()
+    }
+
+    fn name(&self) -> String {
+        format!(
+            "OKDTlsPassthroughScore({}:{}/{} → {})",
+            self.backend, self.target_port, self.namespace, self.hostname
+        )
+    }
+}
-- 
2.39.5


From e9cab9258506e5cacef361a280a4cdf5b25d3182 Mon Sep 17 00:00:00 2001
From: Jean-Gabriel Gill-Couture <jg@nationtech.io>
Date: Sun, 14 Dec 2025 22:22:09 -0500
Subject: [PATCH 07/20] feat: Impl TlsRoute for K8sAnywhereTopology

---
 harmony/src/domain/interpret/mod.rs         |  6 +++++
 harmony/src/domain/topology/k8s_anywhere.rs | 26 ++++++++++++++++++++-
 harmony/src/domain/topology/router.rs       | 24 ++-----------------
 harmony/src/modules/network/tls_router.rs   | 21 +++++++----------
 4 files changed, 41 insertions(+), 36 deletions(-)

diff --git a/harmony/src/domain/interpret/mod.rs b/harmony/src/domain/interpret/mod.rs
index f9a509d..4a9855a 100644
--- a/harmony/src/domain/interpret/mod.rs
+++ b/harmony/src/domain/interpret/mod.rs
@@ -152,6 +152,12 @@ pub struct InterpretError {
     msg: String,
 }
 
+impl From<InterpretError> for String {
+    fn from(e: InterpretError) -> String {
+        format!("InterpretError : {}", e.msg)
+    }
+}
+
 impl std::fmt::Display for InterpretError {
     fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
         f.write_str(&self.msg)
diff --git a/harmony/src/domain/topology/k8s_anywhere.rs b/harmony/src/domain/topology/k8s_anywhere.rs
index 226860b..caeb576 100644
--- a/harmony/src/domain/topology/k8s_anywhere.rs
+++ b/harmony/src/domain/topology/k8s_anywhere.rs
@@ -34,13 +34,14 @@ use crate::{
                 service_monitor::ServiceMonitor,
             },
         },
+        network::TlsPassthroughScore,
         prometheus::{
             k8s_prometheus_alerting_score::K8sPrometheusCRDAlertingScore,
             prometheus::PrometheusMonitoring, rhob_alerting_score::RHOBAlertingScore,
         },
     },
     score::Score,
-    topology::ingress::Ingress,
+    topology::{TlsRoute, TlsRouter, ingress::Ingress},
 };
 
 use super::{
@@ -102,6 +103,29 @@ impl K8sclient for K8sAnywhereTopology {
     }
 }
 
+#[async_trait]
+impl TlsRouter for K8sAnywhereTopology {
+    async fn install_route(&self, route: TlsRoute) -> Result<(), String> {
+        if let Some(distro) = self.k8s_distribution.get() {
+            match distro {
+                KubernetesDistribution::OpenshiftFamily => {
+                    TlsPassthroughScore { route }
+                        .interpret(&Inventory::empty(), self)
+                        .await?;
+                    Ok(())
+                }
+                KubernetesDistribution::K3sFamily | KubernetesDistribution::Default => Err(
+                    format!("Distribution not supported yet for Tlsrouter {distro:?}"),
+                ),
+            }
+        } else {
+            Err(format!(
+                "Could not find a k8s distribution, TlsRouter in K8sAnywhereTopology requires it"
+            ))
+        }
+    }
+}
+
 #[async_trait]
 impl Grafana for K8sAnywhereTopology {
     async fn ensure_grafana_operator(
diff --git a/harmony/src/domain/topology/router.rs b/harmony/src/domain/topology/router.rs
index 66ae8f9..b453e99 100644
--- a/harmony/src/domain/topology/router.rs
+++ b/harmony/src/domain/topology/router.rs
@@ -1,6 +1,7 @@
 use async_trait::async_trait;
 use cidr::Ipv4Cidr;
 use derive_new::new;
+use serde::Serialize;
 
 use super::{IpAddress, LogicalHost};
 
@@ -47,8 +48,6 @@ impl Router for UnmanagedRouter {
     }
 }
 
-#[derive(Clone, Debug)]
-
 /// Desired state config for a TLS passthrough route.
 /// Forwards external TLS (port 443) → backend service:target_port (no termination at router).
 /// Inspired by CNPG multisite: exposes `-rw`/`-ro` services publicly via OKD Route/HAProxy/K8s
@@ -63,6 +62,7 @@ impl Router for UnmanagedRouter {
 ///     target_port: 5432,
 /// };
 /// ```
+#[derive(Clone, Debug, Serialize)]
 pub struct TlsRoute {
     /// Public hostname clients connect to (TLS SNI, port 443 implicit).
     /// Router matches this for passthrough forwarding.
@@ -95,24 +95,4 @@ pub trait TlsRouter: Send + Sync {
     /// Example: OKD Route{ host, to: backend:target_port, tls: {passthrough} };
     ///          HAProxy frontend→backend \"postgres-upstream\".
     async fn install_route(&self, config: TlsRoute) -> Result<(), String>;
-
-    /// Installed route's public hostname.
-    fn hostname(&self) -> String;
-
-    /// Installed route's backend identifier.
-    fn backend(&self) -> String;
-
-    /// Installed route's backend port.
-    fn target_port(&self) -> u16;
-}
-
-impl std::fmt::Debug for dyn TlsRouter {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        f.write_fmt(format_args!(
-            "TlsRouter[hostname={}, backend={}:{}]",
-            self.hostname(),
-            self.backend(),
-            self.target_port()
-        ))
-    }
 }
diff --git a/harmony/src/modules/network/tls_router.rs b/harmony/src/modules/network/tls_router.rs
index 5f43df3..75f1a00 100644
--- a/harmony/src/modules/network/tls_router.rs
+++ b/harmony/src/modules/network/tls_router.rs
@@ -19,10 +19,13 @@ use crate::topology::{K8sclient, Topology};
 /// # Usage
 /// ```
 /// use harmony::modules::network::TlsPassthroughScore;
+/// use harmony::topology::router::TlsRoute;
 /// let score = TlsPassthroughScore {
+///     route: TlsRoute {
 ///     backend: "postgres-cluster-rw".to_string(),
 ///     hostname: "postgres-rw.example.com".to_string(),
 ///     target_port: 5432,
+///   },
 /// };
 /// ```
 ///
@@ -37,28 +40,20 @@ use crate::topology::{K8sclient, Topology};
 /// to use through this high level TlsPassthroughScore.
 #[derive(Debug, Clone, Serialize)]
 pub struct TlsPassthroughScore {
-    /// Backend identifier (k8s Service, HAProxy upstream, IP/FQDN, etc.).
-    pub backend: String,
-    /// Public hostname clients connect to (TLS SNI, port 443 implicit).
-    pub hostname: String,
-    /// Backend TCP port.
-    pub target_port: u16,
+    pub route: TlsRoute,
 }
 
 impl<T: Topology + K8sclient + TlsRouter + Send + Sync> Score<T> for TlsPassthroughScore {
     fn create_interpret(&self) -> Box<dyn Interpret<T>> {
-        let tls_route = TlsRoute {
-            hostname: self.hostname.clone(),
-            backend: self.backend.clone(),
-            target_port: self.target_port,
-        };
-        Box::new(TlsPassthroughInterpret { tls_route })
+        Box::new(TlsPassthroughInterpret {
+            tls_route: self.route.clone(),
+        })
     }
 
     fn name(&self) -> String {
         format!(
             "TlsRouterScore({}:{} → {})",
-            self.backend, self.target_port, self.hostname
+            self.route.backend, self.route.target_port, self.route.hostname
         )
     }
 }
-- 
2.39.5


From e0da5764fb4da8595b0f9886b62bc411dca472c1 Mon Sep 17 00:00:00 2001
From: Jean-Gabriel Gill-Couture <jg@nationtech.io>
Date: Mon, 15 Dec 2025 12:48:56 -0500
Subject: [PATCH 08/20] feat(types): Added Rfc1123 String type, useful for k8s
 names

---
 harmony_types/src/lib.rs     |   1 +
 harmony_types/src/rfc1123.rs | 232 +++++++++++++++++++++++++++++++++++
 2 files changed, 233 insertions(+)
 create mode 100644 harmony_types/src/rfc1123.rs

diff --git a/harmony_types/src/lib.rs b/harmony_types/src/lib.rs
index 1ebdb97..3d72c80 100644
--- a/harmony_types/src/lib.rs
+++ b/harmony_types/src/lib.rs
@@ -2,3 +2,4 @@ pub mod id;
 pub mod net;
 pub mod storage;
 pub mod switch;
+pub mod rfc1123;
diff --git a/harmony_types/src/rfc1123.rs b/harmony_types/src/rfc1123.rs
new file mode 100644
index 0000000..190d8c4
--- /dev/null
+++ b/harmony_types/src/rfc1123.rs
@@ -0,0 +1,232 @@
+/// A String that can be used as a subdomain.
+///
+/// This means the name must:
+///
+/// - contain no more than 253 characters
+/// - contain only lowercase alphanumeric characters, '-' or '.'
+/// - start with an alphanumeric character
+/// - end with an alphanumeric character
+///
+/// https://datatracker.ietf.org/doc/html/rfc1123
+///
+/// This is relevant in harmony since most k8s resource names are required to be usable as dns
+/// subdomains.
+///
+/// See https://kubernetes.io/docs/concepts/overview/working-with-objects/names/
+#[derive(Debug, Clone)]
+pub struct Rfc1123Name {
+    content: String,
+}
+
+impl TryFrom<&str> for Rfc1123Name {
+    fn try_from(s: &str) -> Result<Self, String> {
+        let mut content = s.to_lowercase();
+
+        // Remove invalid characters
+        content.retain(|c| c.is_ascii_alphanumeric() || c == '-' || c == '.');
+
+        // Enforce max length
+        if content.len() > 253 {
+            content.truncate(253);
+        }
+
+        // Trim leading/trailing dots
+        content = content.trim_matches('.').to_string();
+
+        // Deduplicate consecutive dots
+        loop {
+            let new_content = content.replace("..", ".");
+            if new_content == content {
+                break;
+            }
+            content = new_content;
+        }
+
+        // Trim leading/trailing non-alphanumeric
+        content = content.trim_matches(|c: char| !c.is_ascii_alphanumeric()).to_string();
+
+        if content.is_empty() {
+            return Err(format!("Input '{}' resulted in empty string", s));
+        }
+
+        Ok(Self { content })
+    }
+
+    type Error = String;
+}
+
+
+/// Converts an `Rfc1123Name` into a `String`.
+///
+/// This allows using `Rfc1123Name` in contexts where a `String` is expected.
+impl From<Rfc1123Name> for String {
+    fn from(name: Rfc1123Name) -> Self {
+        name.content
+    }
+}
+
+/// Serializes the `Rfc1123Name` as a string.
+///
+/// This directly serializes the inner `String` content without additional wrapping.
+impl serde::Serialize for Rfc1123Name {
+    fn serialize<S>(&self, serializer: S) -> Result<S::Ok, S::Error>
+    where
+        S: serde::Serializer,
+    {
+        serializer.serialize_str(&self.content)
+    }
+}
+
+/// Deserializes an `Rfc1123Name` from a string.
+///
+/// This directly deserializes into the inner `String` content without additional wrapping.
+impl<'de> serde::Deserialize<'de> for Rfc1123Name {
+    fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>
+    where
+        D: serde::Deserializer<'de>,
+    {
+        let content = String::deserialize(deserializer)?;
+        Ok(Self { content })
+    }
+}
+
+/// Displays the `Rfc1123Name` as a string.
+///
+/// This directly displays the inner `String` content without additional wrapping.
+impl std::fmt::Display for Rfc1123Name {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        write!(f, "{}", self.content)
+    }
+}
+
+
+#[cfg(test)]
+mod tests {
+    use super::Rfc1123Name;
+
+    #[test]
+    fn test_try_from_empty() {
+        let name = Rfc1123Name::try_from("");
+        assert!(name.is_err());
+    }
+
+    #[test]
+    fn test_try_from_valid() {
+        let name = Rfc1123Name::try_from("hello-world").unwrap();
+        assert_eq!(name.content, "hello-world");
+    }
+
+    #[test]
+    fn test_try_from_uppercase() {
+        let name = Rfc1123Name::try_from("Hello-World").unwrap();
+        assert_eq!(name.content, "hello-world");
+    }
+
+    #[test]
+    fn test_try_from_invalid_chars() {
+        let name = Rfc1123Name::try_from("hel@lo#w!or%ld123").unwrap();
+        assert_eq!(name.content, "helloworld123");
+    }
+
+    #[test]
+    fn test_try_from_leading_dot() {
+        let name = Rfc1123Name::try_from(".hello").unwrap();
+        assert_eq!(name.content, "hello");
+    }
+
+    #[test]
+    fn test_try_from_trailing_dot() {
+        let name = Rfc1123Name::try_from("hello.").unwrap();
+        assert_eq!(name.content, "hello");
+    }
+
+    #[test]
+    fn test_try_from_leading_hyphen() {
+        let name = Rfc1123Name::try_from("-hello").unwrap();
+        assert_eq!(name.content, "hello");
+    }
+
+    #[test]
+    fn test_try_from_complicated_string() {
+        let name = Rfc1123Name::try_from("--h--e,}{}12!$#)\np_aulbS\r\t.!@o--._--").unwrap();
+        assert_eq!(name.content, "h--e12paulbs.o");
+    }
+
+    #[test]
+    fn test_try_from_trailing_hyphen() {
+        let name = Rfc1123Name::try_from("hello-").unwrap();
+        assert_eq!(name.content, "hello");
+    }
+
+    #[test]
+    fn test_try_from_single_hyphen() {
+        let name = Rfc1123Name::try_from("-");
+        assert!(name.is_err());
+    }
+
+    #[test]
+    fn test_from_str() {
+        let name: Rfc1123Name = "test-name".try_into().unwrap();
+        assert_eq!(name.content, "test-name");
+    }
+
+    #[test]
+    fn test_into_string() {
+        let name = Rfc1123Name::try_from("test").unwrap();
+        let s: String = name.into();
+        assert_eq!(s, "test");
+    }
+
+    #[test]
+    fn test_compliance() {
+        let inputs = vec![
+            "valid",
+            "in-VALID",
+            ".dots",
+            "-hyphen",
+            "hyphen-",
+            "!!1@",
+            "aaaaaaaaaa",
+            "--abc--",
+            "a.b-c",
+        ];
+
+        for input in inputs {
+            let name = Rfc1123Name::try_from(input).unwrap();
+            let s = &name.content;
+            // Check only allowed characters
+            for c in s.chars() {
+                assert!(c.is_ascii_alphanumeric() || c == '-' || c == '.');
+            }
+            // Check starts and ends with alphanumeric
+            if !s.is_empty() {
+                assert!(s.chars().next().unwrap().is_ascii_alphanumeric());
+                assert!(s.chars().last().unwrap().is_ascii_alphanumeric());
+            }
+        }
+    }
+
+    #[test]
+    fn test_enforces_max_length() {
+        let long_input = "a".repeat(300);
+        let name = Rfc1123Name::try_from(long_input.as_str()).unwrap();
+        assert_eq!(name.content.len(), 253);
+        assert_eq!(name.content, "a".repeat(253));
+    }
+
+    #[test]
+    fn test_truncate_trim_end() {
+        let input = "a".repeat(252) + "-";
+        let name = Rfc1123Name::try_from(input.as_str()).unwrap();
+        assert_eq!(name.content.len(), 252);
+        assert_eq!(name.content, "a".repeat(252));
+    }
+
+    #[test]
+    fn test_dedup_dots() {
+        let input = "a..b...c";
+        let name = Rfc1123Name::try_from(input).unwrap();
+        assert_eq!(name.content, "a.b.c");
+    }
+}
+
-- 
2.39.5


From 446e0795956e019e0da19bf1b61c45288c814a5b Mon Sep 17 00:00:00 2001
From: Jean-Gabriel Gill-Couture <jg@nationtech.io>
Date: Mon, 15 Dec 2025 17:04:30 -0500
Subject: [PATCH 09/20] wip: public postgres many fixes and refactoring to have
 a more cohesive routing management

---
 examples/public_postgres/Cargo.toml           | 18 +++++++
 examples/public_postgres/src/main.rs          | 34 ++++++++++++
 harmony/src/domain/topology/k8s_anywhere.rs   | 11 ++--
 harmony/src/domain/topology/router.rs         | 11 ++++
 harmony/src/modules/okd/crd/route.rs          |  2 +-
 harmony/src/modules/okd/route.rs              | 53 ++++---------------
 .../src/modules/postgresql/score_public.rs    | 30 +++--------
 7 files changed, 88 insertions(+), 71 deletions(-)
 create mode 100644 examples/public_postgres/Cargo.toml
 create mode 100644 examples/public_postgres/src/main.rs

diff --git a/examples/public_postgres/Cargo.toml b/examples/public_postgres/Cargo.toml
new file mode 100644
index 0000000..f0e4c83
--- /dev/null
+++ b/examples/public_postgres/Cargo.toml
@@ -0,0 +1,18 @@
+[package]
+name = "example-public-postgres"
+edition = "2024"
+version.workspace = true
+readme.workspace = true
+license.workspace = true
+publish = false
+
+[dependencies]
+harmony = { path = "../../harmony" }
+harmony_cli = { path = "../../harmony_cli" }
+harmony_types = { path = "../../harmony_types" }
+cidr = { workspace = true }
+tokio = { workspace = true }
+harmony_macros = { path = "../../harmony_macros" }
+log = { workspace = true }
+env_logger = { workspace = true }
+url = { workspace = true }
diff --git a/examples/public_postgres/src/main.rs b/examples/public_postgres/src/main.rs
new file mode 100644
index 0000000..b1e9e66
--- /dev/null
+++ b/examples/public_postgres/src/main.rs
@@ -0,0 +1,34 @@
+use harmony::{
+    inventory::Inventory,
+    modules::{network::TlsPassthroughScore, postgresql::PostgreSQLScore},
+    topology::{K8sAnywhereTopology, TlsRoute},
+};
+
+#[tokio::main]
+async fn main() {
+    let namespace = "harmony-postgres-example".to_string();
+    let postgresql = PostgreSQLScore {
+        name: "harmony-postgres-example".to_string(), // Override default name
+        namespace: namespace.clone(),
+        ..Default::default() // Use harmony defaults, they are based on CNPG's default values :
+                             // "default" namespace, 1 instance, 1Gi storage
+    };
+
+    let tls_passthrough = TlsPassthroughScore {
+        route: TlsRoute {
+            hostname: "postgres.example.com".to_string(), // CNPG creates a -rw service for read-write endpoint
+            backend: format!("{}-rw", postgresql.name),   // Public hostname for TLS SNI
+            namespace: namespace.clone(),
+            target_port: 5432, // PostgreSQL default port
+        },
+    };
+
+    harmony_cli::run(
+        Inventory::autoload(),
+        K8sAnywhereTopology::from_env(),
+        vec![Box::new(postgresql), Box::new(tls_passthrough)],
+        None,
+    )
+    .await
+    .unwrap();
+}
diff --git a/harmony/src/domain/topology/k8s_anywhere.rs b/harmony/src/domain/topology/k8s_anywhere.rs
index caeb576..95b2cdb 100644
--- a/harmony/src/domain/topology/k8s_anywhere.rs
+++ b/harmony/src/domain/topology/k8s_anywhere.rs
@@ -2,6 +2,7 @@ use std::{collections::BTreeMap, process::Command, sync::Arc, time::Duration};
 
 use async_trait::async_trait;
 use base64::{Engine, engine::general_purpose};
+use harmony_types::rfc1123::Rfc1123Name;
 use k8s_openapi::api::{
     core::v1::Secret,
     rbac::v1::{ClusterRoleBinding, RoleRef, Subject},
@@ -35,6 +36,7 @@ use crate::{
             },
         },
         network::TlsPassthroughScore,
+        okd::route::OKDTlsPassthroughScore,
         prometheus::{
             k8s_prometheus_alerting_score::K8sPrometheusCRDAlertingScore,
             prometheus::PrometheusMonitoring, rhob_alerting_score::RHOBAlertingScore,
@@ -109,9 +111,12 @@ impl TlsRouter for K8sAnywhereTopology {
         if let Some(distro) = self.k8s_distribution.get() {
             match distro {
                 KubernetesDistribution::OpenshiftFamily => {
-                    TlsPassthroughScore { route }
-                        .interpret(&Inventory::empty(), self)
-                        .await?;
+                    OKDTlsPassthroughScore {
+                        name: Rfc1123Name::try_from(route.to_string_short().as_str())?,
+                        route,
+                    }
+                    .interpret(&Inventory::empty(), self)
+                    .await?;
                     Ok(())
                 }
                 KubernetesDistribution::K3sFamily | KubernetesDistribution::Default => Err(
diff --git a/harmony/src/domain/topology/router.rs b/harmony/src/domain/topology/router.rs
index b453e99..ded17d2 100644
--- a/harmony/src/domain/topology/router.rs
+++ b/harmony/src/domain/topology/router.rs
@@ -73,8 +73,19 @@ pub struct TlsRoute {
 
     /// Backend TCP port (Postgres: 5432).
     pub target_port: u16,
+
+    /// The environment in which it lives.
+    /// TODO clarify how we handle this in higher level abstractions. The namespace name is a
+    /// direct mapping to k8s but that could be misleading for other implementations.
+    pub namespace: String,
 }
 
+  impl  TlsRoute {
+      pub fn to_string_short(&self) -> String {
+          format!("{}-{}:{}", self.hostname, self.backend, self.target_port)
+      }
+  }
+
 /// Installs and queries TLS passthrough routes (L4 TCP/SNI forwarding, no TLS termination).
 /// Agnostic to impl: OKD Route, AWS NLB+HAProxy, k3s Envoy Gateway, Apache ProxyPass.
 /// Used by PostgreSQL capability to expose CNPG clusters multisite (site1 → site2 replication).
diff --git a/harmony/src/modules/okd/crd/route.rs b/harmony/src/modules/okd/crd/route.rs
index ad146de..0532fd4 100644
--- a/harmony/src/modules/okd/crd/route.rs
+++ b/harmony/src/modules/okd/crd/route.rs
@@ -160,7 +160,7 @@ impl Default for RouteTargetReference {
 #[derive(Deserialize, Serialize, Clone, Debug)]
 #[serde(rename_all = "camelCase")]
 pub struct RoutePort {
-    pub target_port: IntOrString,
+    pub target_port: u16,
 }
 
 #[derive(Deserialize, Serialize, Clone, Debug)]
diff --git a/harmony/src/modules/okd/route.rs b/harmony/src/modules/okd/route.rs
index 7360b04..29a00cf 100644
--- a/harmony/src/modules/okd/route.rs
+++ b/harmony/src/modules/okd/route.rs
@@ -15,7 +15,7 @@
 // always be dealing only with okd/openshift compatible topologies and is ready to manage the
 // additional maintenance burden that comes with a lower level functionnality.
 
-use k8s_openapi::apimachinery::pkg::util::intstr::IntOrString;
+use harmony_types::rfc1123::Rfc1123Name;
 use kube::api::ObjectMeta;
 use serde::Serialize;
 
@@ -24,21 +24,7 @@ use crate::modules::okd::crd::route::{
     Route, RoutePort, RouteSpec, RouteTargetReference, TLSConfig,
 };
 use crate::score::Score;
-use crate::topology::{K8sclient, Topology};
-
-#[derive(Clone, Debug, Serialize)]
-struct OKDRoutePort {
-    #[serde(rename = "targetPort")]
-    target_port: String,
-}
-
-#[derive(Clone, Debug, Serialize)]
-struct OKDTLSConfig {
-    #[serde(rename = "termination")]
-    termination: String,
-    #[serde(rename = "insecureEdgeTerminationPolicy")]
-    insecure_edge_termination_policy: String,
-}
+use crate::topology::{K8sclient, TlsRoute, Topology};
 
 #[derive(Debug, Clone, Serialize)]
 pub struct OKDRouteScore {
@@ -78,43 +64,22 @@ impl<T: Topology + K8sclient> Score<T> for OKDRouteScore {
 
 #[derive(Debug, Clone, Serialize)]
 pub struct OKDTlsPassthroughScore {
-    pub name: String,
-    pub namespace: String,
-    pub backend: String,
-    pub hostname: String,
-    pub target_port: String,
-}
-
-impl OKDTlsPassthroughScore {
-    pub fn new(
-        name: &str,
-        namespace: &str,
-        backend: &str,
-        hostname: &str,
-        target_port: &str,
-    ) -> Self {
-        Self {
-            name: name.to_string(),
-            namespace: namespace.to_string(),
-            backend: backend.to_string(),
-            hostname: hostname.to_string(),
-            target_port: target_port.to_string(),
-        }
-    }
+    pub route: TlsRoute,
+    pub name: Rfc1123Name,
 }
 
 impl<T: Topology + K8sclient> Score<T> for OKDTlsPassthroughScore {
     fn create_interpret(&self) -> Box<dyn crate::interpret::Interpret<T>> {
         let passthrough_spec = RouteSpec {
-            host: Some(self.hostname.clone()),
+            host: Some(self.route.hostname.clone()),
             wildcard_policy: Some("None".to_string()),
             to: RouteTargetReference {
                 kind: "Service".to_string(),
-                name: self.backend.clone(),
+                name: self.route.backend.clone(),
                 weight: Some(100),
             },
             port: Some(RoutePort {
-                target_port: IntOrString::String(self.target_port.clone()),
+                target_port: self.route.target_port,
             }),
             tls: Some(TLSConfig {
                 termination: "passthrough".to_string(),
@@ -123,14 +88,14 @@ impl<T: Topology + K8sclient> Score<T> for OKDTlsPassthroughScore {
             }),
             ..Default::default()
         };
-        let route_score = OKDRouteScore::new(&self.name, &self.namespace, passthrough_spec);
+        let route_score = OKDRouteScore::new(&self.name.to_string(), &self.route.namespace, passthrough_spec);
         route_score.create_interpret()
     }
 
     fn name(&self) -> String {
         format!(
             "OKDTlsPassthroughScore({}:{}/{} → {})",
-            self.backend, self.target_port, self.namespace, self.hostname
+            self.route.backend, self.route.target_port, self.route.namespace, self.route.hostname
         )
     }
 }
diff --git a/harmony/src/modules/postgresql/score_public.rs b/harmony/src/modules/postgresql/score_public.rs
index 73c2193..8202176 100644
--- a/harmony/src/modules/postgresql/score_public.rs
+++ b/harmony/src/modules/postgresql/score_public.rs
@@ -6,12 +6,9 @@ use crate::data::Version;
 use crate::domain::topology::router::{TlsRoute, TlsRouter};
 use crate::interpret::{Interpret, InterpretError, InterpretName, InterpretStatus, Outcome};
 use crate::inventory::Inventory;
-use crate::modules::k8s::resource::K8sResourceScore;
 use crate::modules::postgresql::PostgreSQLScore;
-use crate::modules::postgresql::cnpg::{Bootstrap, Cluster, ClusterSpec, Initdb, Storage};
 use crate::score::Score;
 use crate::topology::{K8sclient, Topology};
-use k8s_openapi::apimachinery::pkg::apis::meta::v1::ObjectMeta;
 
 /// Deploys a public PostgreSQL cluster: CNPG + TLS passthrough route for RW endpoint.
 /// For failover/multisite: exposes single-instance or small HA Postgres publicly.
@@ -26,24 +23,15 @@ use k8s_openapi::apimachinery::pkg::apis::meta::v1::ObjectMeta;
 #[derive(Debug, Clone, Serialize)]
 pub struct PublicPostgreSQLScore {
     /// Inner non-public Postgres cluster config.
-    pub inner: PostgreSQLScore,
+    pub postgres_score: PostgreSQLScore,
     /// Public hostname for RW TLS passthrough (port 443 → cluster-rw:5432).
     pub hostname: String,
 }
 
-impl Default for PublicPostgreSQLScore {
-    fn default() -> Self {
-        Self {
-            inner: PostgreSQLScore::default(),
-            hostname: "postgres.default.public".to_string(),
-        }
-    }
-}
-
 impl PublicPostgreSQLScore {
     pub fn new(namespace: &str, hostname: &str) -> Self {
         Self {
-            inner: PostgreSQLScore::new(namespace),
+            postgres_score: PostgreSQLScore::new(namespace),
             hostname: hostname.to_string(),
         }
     }
@@ -72,10 +60,7 @@ impl<T: Topology + K8sclient + TlsRouter + Send + Sync> Interpret<T> for PublicP
     }
     async fn execute(&self, inventory: &Inventory, topo: &T) -> Result<Outcome, InterpretError> {
         // Deploy CNPG cluster first (creates -rw service)
-        self.postgres_score
-            .create_interpret()
-            .execute(inventory, topo)
-            .await?;
+        self.postgres_score.interpret(inventory, topo).await?;
 
         // Expose RW publicly via TLS passthrough
         topo.install_route(self.tls_route.clone())
@@ -92,15 +77,16 @@ impl<T: Topology + K8sclient + TlsRouter + Send + Sync> Interpret<T> for PublicP
 
 impl<T: Topology + K8sclient + TlsRouter + Send + Sync> Score<T> for PublicPostgreSQLScore {
     fn create_interpret(&self) -> Box<dyn Interpret<T>> {
-        let rw_backend = format!("{}-rw", self.inner.name);
+        let rw_backend = format!("{}-rw", self.postgres_score.name);
         let tls_route = TlsRoute {
+            namespace: self.postgres_score.namespace.clone(),
             hostname: self.hostname.clone(),
             backend: rw_backend,
             target_port: 5432,
         };
 
         Box::new(PublicPostgreSQLInterpret {
-            postgres_score: self.inner.clone(),
+            postgres_score: self.postgres_score.clone(),
             tls_route,
         })
     }
@@ -108,9 +94,7 @@ impl<T: Topology + K8sclient + TlsRouter + Send + Sync> Score<T> for PublicPostg
     fn name(&self) -> String {
         format!(
             "PublicPostgreSQLScore({}:{})",
-            self.inner.namespace, self.hostname
+            self.postgres_score.namespace, self.hostname
         )
     }
 }
-
-// TODO: Add RO route (separate hostname/backend="cluster-ro"), backups, failover logic.
-- 
2.39.5


From 29821d5e9f10240c184b058094cb56059c545b79 Mon Sep 17 00:00:00 2001
From: Jean-Gabriel Gill-Couture <jg@nationtech.io>
Date: Mon, 15 Dec 2025 19:09:10 -0500
Subject: [PATCH 10/20] feat: TlsPassthroughScore works, improved logging,
 fixed CRD

---
 harmony/src/domain/topology/k8s.rs          | 15 ++++++++-
 harmony/src/domain/topology/k8s_anywhere.rs | 37 +++++++++++----------
 harmony/src/domain/topology/router.rs       |  4 +++
 harmony/src/modules/k8s/resource.rs         | 28 +++++++++++++++-
 harmony/src/modules/okd/crd/route.rs        | 12 ++++---
 harmony/src/modules/okd/route.rs            |  2 +-
 6 files changed, 73 insertions(+), 25 deletions(-)

diff --git a/harmony/src/domain/topology/k8s.rs b/harmony/src/domain/topology/k8s.rs
index fccf0d1..3cab0b8 100644
--- a/harmony/src/domain/topology/k8s.rs
+++ b/harmony/src/domain/topology/k8s.rs
@@ -451,7 +451,20 @@ impl K8sClient {
     {
         let mut result = Vec::new();
         for r in resource.iter() {
-            result.push(self.apply(r, ns).await?);
+            let apply_result = self.apply(r, ns).await;
+            if apply_result.is_err() {
+                // NOTE : We should be careful about this one, it may leak sensitive information in
+                // logs
+                // Maybe just reducing it to debug would be enough as we already know debug logs
+                // are unsafe.
+                // But keeping it at warn makes it much easier to understand what is going on. So be it for now.
+                warn!(
+                    "Failed to apply k8s resource : {}",
+                    serde_json::to_string_pretty(r).map_err(|e| Error::SerdeError(e))?
+                );
+            }
+
+            result.push(apply_result?);
         }
 
         Ok(result)
diff --git a/harmony/src/domain/topology/k8s_anywhere.rs b/harmony/src/domain/topology/k8s_anywhere.rs
index 95b2cdb..5739d57 100644
--- a/harmony/src/domain/topology/k8s_anywhere.rs
+++ b/harmony/src/domain/topology/k8s_anywhere.rs
@@ -108,25 +108,24 @@ impl K8sclient for K8sAnywhereTopology {
 #[async_trait]
 impl TlsRouter for K8sAnywhereTopology {
     async fn install_route(&self, route: TlsRoute) -> Result<(), String> {
-        if let Some(distro) = self.k8s_distribution.get() {
-            match distro {
-                KubernetesDistribution::OpenshiftFamily => {
-                    OKDTlsPassthroughScore {
-                        name: Rfc1123Name::try_from(route.to_string_short().as_str())?,
-                        route,
-                    }
-                    .interpret(&Inventory::empty(), self)
-                    .await?;
-                    Ok(())
+        let distro = self
+            .get_k8s_distribution()
+            .await
+            .map_err(|e| format!("Could not get k8s distribution {e}"))?;
+
+        match distro {
+            KubernetesDistribution::OpenshiftFamily => {
+                OKDTlsPassthroughScore {
+                    name: Rfc1123Name::try_from(route.backend_info_string().as_str())?,
+                    route,
                 }
-                KubernetesDistribution::K3sFamily | KubernetesDistribution::Default => Err(
-                    format!("Distribution not supported yet for Tlsrouter {distro:?}"),
-                ),
+                .interpret(&Inventory::empty(), self)
+                .await?;
+                Ok(())
             }
-        } else {
-            Err(format!(
-                "Could not find a k8s distribution, TlsRouter in K8sAnywhereTopology requires it"
-            ))
+            KubernetesDistribution::K3sFamily | KubernetesDistribution::Default => Err(format!(
+                "Distribution not supported yet for Tlsrouter {distro:?}"
+            )),
         }
     }
 }
@@ -372,6 +371,7 @@ impl K8sAnywhereTopology {
     pub async fn get_k8s_distribution(&self) -> Result<&KubernetesDistribution, PreparationError> {
         self.k8s_distribution
             .get_or_try_init(async || {
+                debug!("Trying to detect k8s distribution");
                 let client = self.k8s_client().await.unwrap();
 
                 let discovery = client.discovery().await.map_err(|e| {
@@ -387,14 +387,17 @@ impl K8sAnywhereTopology {
                     .groups()
                     .any(|g| g.name() == "project.openshift.io")
                 {
+                    info!("Found KubernetesDistribution OpenshiftFamily");
                     return Ok(KubernetesDistribution::OpenshiftFamily);
                 }
 
                 // K3d / K3s
                 if version.git_version.contains("k3s") {
+                    info!("Found KubernetesDistribution K3sFamily");
                     return Ok(KubernetesDistribution::K3sFamily);
                 }
 
+                info!("Could not identify KubernetesDistribution, using Default");
                 return Ok(KubernetesDistribution::Default);
             })
             .await
diff --git a/harmony/src/domain/topology/router.rs b/harmony/src/domain/topology/router.rs
index ded17d2..a904e1d 100644
--- a/harmony/src/domain/topology/router.rs
+++ b/harmony/src/domain/topology/router.rs
@@ -84,6 +84,10 @@ pub struct TlsRoute {
       pub fn to_string_short(&self) -> String {
           format!("{}-{}:{}", self.hostname, self.backend, self.target_port)
       }
+
+      pub fn backend_info_string(&self) -> String {
+          format!("{}:{}", self.backend, self.target_port)
+      }
   }
 
 /// Installs and queries TLS passthrough routes (L4 TCP/SNI forwarding, no TLS termination).
diff --git a/harmony/src/modules/k8s/resource.rs b/harmony/src/modules/k8s/resource.rs
index 57f9731..dde7339 100644
--- a/harmony/src/modules/k8s/resource.rs
+++ b/harmony/src/modules/k8s/resource.rs
@@ -79,7 +79,33 @@ where
         _inventory: &Inventory,
         topology: &T,
     ) -> Result<Outcome, InterpretError> {
-        info!("Applying {} resources", self.score.resource.len());
+        // TODO improve this log
+        let resource_names: Vec<String> = self
+            .score
+            .resource
+            .iter()
+            .map(|r| {
+                format!(
+                    "{}{}",
+                    r.meta()
+                        .name
+                        .as_ref()
+                        .map(|n| format!("{n}"))
+                        .unwrap_or_default(),
+                    r.meta()
+                        .namespace
+                        .as_ref()
+                        .map(|ns| format!("@{}", ns))
+                        .unwrap_or_default()
+                )
+            })
+            .collect();
+
+        info!(
+            "Applying {} resources : {}",
+            resource_names.len(),
+            resource_names.join(", ")
+        );
         topology
             .k8s_client()
             .await
diff --git a/harmony/src/modules/okd/crd/route.rs b/harmony/src/modules/okd/crd/route.rs
index 0532fd4..4c396d0 100644
--- a/harmony/src/modules/okd/crd/route.rs
+++ b/harmony/src/modules/okd/crd/route.rs
@@ -13,11 +13,11 @@ pub struct LocalObjectReference {
 #[derive(Deserialize, Serialize, Clone, Debug)]
 #[serde(rename_all = "camelCase")]
 pub struct Route {
-    // #[serde(skip_serializing_if = "Option::is_none")]
-    // pub api_version: Option<String>,
-    //
-    // #[serde(skip_serializing_if = "Option::is_none")]
-    // pub kind: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub api_version: Option<String>,
+
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub kind: Option<String>,
     pub metadata: ObjectMeta,
 
     pub spec: RouteSpec,
@@ -50,6 +50,8 @@ impl k8s_openapi::Metadata for Route {
 impl Default for Route {
     fn default() -> Self {
         Route {
+            api_version: Some("route.openshift.io/v1".to_string()),
+            kind: Some("Route".to_string()),
             metadata: ObjectMeta::default(),
             spec: RouteSpec::default(),
             status: None,
diff --git a/harmony/src/modules/okd/route.rs b/harmony/src/modules/okd/route.rs
index 29a00cf..9ca2f82 100644
--- a/harmony/src/modules/okd/route.rs
+++ b/harmony/src/modules/okd/route.rs
@@ -52,7 +52,7 @@ impl<T: Topology + K8sclient> Score<T> for OKDRouteScore {
                 ..ObjectMeta::default()
             },
             spec: self.spec.clone(),
-            status: None,
+            ..Default::default()
         };
         K8sResourceScore::single(route, Some(self.namespace.clone())).create_interpret()
     }
-- 
2.39.5


From c3ec7070ecb72af2c3cb3a0422f38e3a55ee2689 Mon Sep 17 00:00:00 2001
From: Jean-Gabriel Gill-Couture <jg@nationtech.io>
Date: Tue, 16 Dec 2025 14:57:02 -0500
Subject: [PATCH 11/20] feat: PostgreSQL public and Connection test score, also
 moved k8s_anywhere in a folder

---
 examples/public_postgres/src/main.rs          |  33 +-
 .../{ => k8s_anywhere}/k8s_anywhere.rs        |   3 +-
 .../src/domain/topology/k8s_anywhere/mod.rs   |   3 +
 .../domain/topology/k8s_anywhere/postgres.rs  |  37 +++
 harmony/src/modules/postgresql/mod.rs         |   2 +
 .../src/modules/postgresql/score_connect.rs   | 299 ++++++++++++++++++
 .../src/modules/postgresql/score_public.rs    |  48 +--
 7 files changed, 383 insertions(+), 42 deletions(-)
 rename harmony/src/domain/topology/{ => k8s_anywhere}/k8s_anywhere.rs (99%)
 create mode 100644 harmony/src/domain/topology/k8s_anywhere/mod.rs
 create mode 100644 harmony/src/domain/topology/k8s_anywhere/postgres.rs
 create mode 100644 harmony/src/modules/postgresql/score_connect.rs

diff --git a/examples/public_postgres/src/main.rs b/examples/public_postgres/src/main.rs
index b1e9e66..43078ec 100644
--- a/examples/public_postgres/src/main.rs
+++ b/examples/public_postgres/src/main.rs
@@ -1,32 +1,33 @@
 use harmony::{
     inventory::Inventory,
-    modules::{network::TlsPassthroughScore, postgresql::PostgreSQLScore},
-    topology::{K8sAnywhereTopology, TlsRoute},
+    modules::postgresql::{PostgreSQLConnectionScore, PostgreSQLScore, PublicPostgreSQLScore},
+    topology::K8sAnywhereTopology,
 };
 
 #[tokio::main]
 async fn main() {
-    let namespace = "harmony-postgres-example".to_string();
-    let postgresql = PostgreSQLScore {
-        name: "harmony-postgres-example".to_string(), // Override default name
-        namespace: namespace.clone(),
-        ..Default::default() // Use harmony defaults, they are based on CNPG's default values :
-                             // "default" namespace, 1 instance, 1Gi storage
+    let postgres = PublicPostgreSQLScore {
+        postgres_score: PostgreSQLScore {
+            name: "harmony-postgres-example".to_string(), // Override default name
+            namespace: "harmony-public-postgres".to_string(),
+            ..Default::default() // Use harmony defaults, they are based on CNPG's default values :
+                                 // "default" namespace, 1 instance, 1Gi storage
+        },
+        hostname: "postgrestest.sto1.nationtech.io".to_string(),
     };
 
-    let tls_passthrough = TlsPassthroughScore {
-        route: TlsRoute {
-            hostname: "postgres.example.com".to_string(), // CNPG creates a -rw service for read-write endpoint
-            backend: format!("{}-rw", postgresql.name),   // Public hostname for TLS SNI
-            namespace: namespace.clone(),
-            target_port: 5432, // PostgreSQL default port
-        },
+    let test_connection = PostgreSQLConnectionScore {
+        name: "harmony-postgres-example".to_string(),
+        namespace: "harmony-public-postgres".to_string(),
+        cluster_name: "harmony-postgres-example".to_string(),
+        hostname: Some("postgrestest.sto1.nationtech.io".to_string()),
+        port_override: Some(443),
     };
 
     harmony_cli::run(
         Inventory::autoload(),
         K8sAnywhereTopology::from_env(),
-        vec![Box::new(postgresql), Box::new(tls_passthrough)],
+        vec![Box::new(postgres), Box::new(test_connection)],
         None,
     )
     .await
diff --git a/harmony/src/domain/topology/k8s_anywhere.rs b/harmony/src/domain/topology/k8s_anywhere/k8s_anywhere.rs
similarity index 99%
rename from harmony/src/domain/topology/k8s_anywhere.rs
rename to harmony/src/domain/topology/k8s_anywhere/k8s_anywhere.rs
index 5739d57..694ce85 100644
--- a/harmony/src/domain/topology/k8s_anywhere.rs
+++ b/harmony/src/domain/topology/k8s_anywhere/k8s_anywhere.rs
@@ -35,7 +35,6 @@ use crate::{
                 service_monitor::ServiceMonitor,
             },
         },
-        network::TlsPassthroughScore,
         okd::route::OKDTlsPassthroughScore,
         prometheus::{
             k8s_prometheus_alerting_score::K8sPrometheusCRDAlertingScore,
@@ -46,7 +45,7 @@ use crate::{
     topology::{TlsRoute, TlsRouter, ingress::Ingress},
 };
 
-use super::{
+use super::super::{
     DeploymentTarget, HelmCommand, K8sclient, MultiTargetTopology, PreparationError,
     PreparationOutcome, Topology,
     k8s::K8sClient,
diff --git a/harmony/src/domain/topology/k8s_anywhere/mod.rs b/harmony/src/domain/topology/k8s_anywhere/mod.rs
new file mode 100644
index 0000000..be87082
--- /dev/null
+++ b/harmony/src/domain/topology/k8s_anywhere/mod.rs
@@ -0,0 +1,3 @@
+mod k8s_anywhere;
+mod postgres;
+pub use k8s_anywhere::*;
diff --git a/harmony/src/domain/topology/k8s_anywhere/postgres.rs b/harmony/src/domain/topology/k8s_anywhere/postgres.rs
new file mode 100644
index 0000000..2774fc3
--- /dev/null
+++ b/harmony/src/domain/topology/k8s_anywhere/postgres.rs
@@ -0,0 +1,37 @@
+use async_trait::async_trait;
+
+use crate::{
+    modules::postgresql::capability::{
+        PostgreSQL, PostgreSQLConfig, PostgreSQLEndpoint, ReplicationCerts,
+    },
+    topology::K8sAnywhereTopology,
+};
+
+#[async_trait]
+impl PostgreSQL for K8sAnywhereTopology {
+    async fn deploy(&self, config: &PostgreSQLConfig) -> Result<String, String> {
+        todo!()
+    }
+
+    /// Extracts PostgreSQL-specific replication certs (PEM format) from a deployed primary cluster.
+    /// Abstracts away storage/retrieval details (e.g., secrets, files).
+    async fn get_replication_certs(&self, cluster_name: &str) -> Result<ReplicationCerts, String> {
+        todo!()
+    }
+
+    /// Gets the internal/private endpoint (e.g., k8s service FQDN:5432) for the cluster.
+    async fn get_endpoint(&self, cluster_name: &str) -> Result<PostgreSQLEndpoint, String> {
+        todo!()
+    }
+
+    /// Gets the public/externally routable endpoint if configured (e.g., OKD Route:443 for TLS passthrough).
+    /// Returns None if no public endpoint (internal-only cluster).
+    /// UNSTABLE: This is opinionated for initial multisite use cases. Networking abstraction is complex
+    /// (cf. k8s Ingress -> Gateway API evolution); may move to higher-order Networking/PostgreSQLNetworking trait.
+    async fn get_public_endpoint(
+        &self,
+        cluster_name: &str,
+    ) -> Result<Option<PostgreSQLEndpoint>, String> {
+        todo!()
+    }
+}
diff --git a/harmony/src/modules/postgresql/mod.rs b/harmony/src/modules/postgresql/mod.rs
index 11c21aa..ea50106 100644
--- a/harmony/src/modules/postgresql/mod.rs
+++ b/harmony/src/modules/postgresql/mod.rs
@@ -1,5 +1,7 @@
 pub mod capability;
 mod score;
+mod score_connect;
+pub use score_connect::*;
 pub use score::*;
 mod score_public;
 pub use score_public::*;
diff --git a/harmony/src/modules/postgresql/score_connect.rs b/harmony/src/modules/postgresql/score_connect.rs
new file mode 100644
index 0000000..fa72ba5
--- /dev/null
+++ b/harmony/src/modules/postgresql/score_connect.rs
@@ -0,0 +1,299 @@
+use async_trait::async_trait;
+use k8s_openapi::ByteString;
+use k8s_openapi::api::core::v1::Secret;
+use log::{debug, error, info, trace};
+use serde::Serialize;
+use std::collections::BTreeMap;
+use std::io::Write;
+use std::path::{Path, PathBuf};
+use std::process::Stdio;
+use tokio::process::Command;
+
+use crate::data::Version;
+use crate::interpret::{Interpret, InterpretError, InterpretName, InterpretStatus, Outcome};
+use crate::inventory::Inventory;
+use crate::score::Score;
+use crate::topology::{K8sclient, Topology};
+use harmony_types::id::Id;
+
+#[derive(Debug, Clone, Serialize)]
+pub struct PostgreSQLConnectionScore {
+    pub name: String,
+    pub namespace: String,
+    pub cluster_name: String,
+    pub hostname: Option<String>,
+    pub port_override: Option<u16>,
+}
+
+fn decode_secret(data: &BTreeMap<String, ByteString>, key: &str) -> Result<String, InterpretError> {
+    let val = data
+        .get(key)
+        .ok_or_else(|| InterpretError::new(format!("Secret missing key {}", key)))?;
+    String::from_utf8(val.0.clone())
+        .map_err(|e| InterpretError::new(format!("Failed to decode {}: {}", key, e)))
+}
+
+impl PostgreSQLConnectionScore {
+    pub fn new(namespace: &str, cluster_name: &str, hostname_override: Option<String>) -> Self {
+        Self {
+            name: format!("postgres-connection-{}", cluster_name),
+            namespace: namespace.to_string(),
+            cluster_name: cluster_name.to_string(),
+            hostname: hostname_override,
+            port_override: None,
+        }
+    }
+}
+
+impl<T: Topology + K8sclient + Send + Sync> Score<T> for PostgreSQLConnectionScore {
+    fn create_interpret(&self) -> Box<dyn Interpret<T>> {
+        Box::new(PostgreSQLConnectionInterpret {
+            score: self.clone(),
+        })
+    }
+
+    fn name(&self) -> String {
+        format!("PostgreSQLConnectionScore : {}", self.name)
+    }
+}
+
+#[derive(Debug, Clone)]
+struct PostgreSQLConnectionInterpret {
+    score: PostgreSQLConnectionScore,
+}
+
+impl PostgreSQLConnectionInterpret {
+    async fn fetch_app_secret<T: K8sclient>(&self, topo: &T) -> Result<Secret, InterpretError> {
+        let app_secret_name = format!("{}-app", self.score.cluster_name);
+        info!("Fetching app secret {}", app_secret_name);
+
+        let k8s_client = topo.k8s_client().await?;
+        k8s_client
+            .get_resource(&app_secret_name, Some(&self.score.namespace))
+            .await
+            .map_err(|e| InterpretError::new(format!("Failed to get app secret: {e}")))?
+            .ok_or_else(|| InterpretError::new(format!("App secret {} not found", app_secret_name)))
+    }
+
+    async fn fetch_ca_secret<T: K8sclient>(&self, topo: &T) -> Result<Secret, InterpretError> {
+        let ca_secret_name = format!("{}-ca", self.score.cluster_name);
+        info!("Fetching CA secret {}", ca_secret_name);
+
+        let k8s_client = topo.k8s_client().await?;
+        k8s_client
+            .get_resource(&ca_secret_name, Some(&self.score.namespace))
+            .await
+            .map_err(|e| InterpretError::new(format!("Failed to get CA secret: {e}")))?
+            .ok_or_else(|| InterpretError::new(format!("CA secret {} not found", ca_secret_name)))
+    }
+
+    fn get_secret_data(
+        &self,
+        secret: &Secret,
+        secret_type: &str,
+    ) -> Result<BTreeMap<String, ByteString>, InterpretError> {
+        secret
+            .data
+            .as_ref()
+            .ok_or_else(|| InterpretError::new(format!("{} secret has no data", secret_type)))
+            .map(|b| b.clone())
+    }
+
+    fn create_temp_dir(&self) -> Result<tempfile::TempDir, InterpretError> {
+        tempfile::Builder::new()
+            .prefix("pg-connection-test-")
+            .tempdir()
+            .map_err(|e| InterpretError::new(format!("Failed to create temp directory: {e}")))
+    }
+
+    fn write_ca_cert(
+        &self,
+        temp_dir: &Path,
+        ca_data: &BTreeMap<String, ByteString>,
+    ) -> Result<PathBuf, InterpretError> {
+        let ca_crt = ca_data
+            .get("ca.crt")
+            .ok_or_else(|| InterpretError::new("CA secret missing ca.crt".to_string()))?;
+        let ca_file = temp_dir.join("ca.crt");
+
+        std::fs::write(&ca_file, &ca_crt.0)
+            .map_err(|e| InterpretError::new(format!("Failed to write CA cert: {e}")))?;
+
+        Ok(ca_file)
+    }
+
+    fn get_host(&self, data: &BTreeMap<String, ByteString>) -> Result<String, InterpretError> {
+        self.score
+            .hostname
+            .clone()
+            .or_else(|| decode_secret(data, "host").ok())
+            .ok_or_else(|| {
+                InterpretError::new("No hostname found in secret or override".to_string())
+            })
+    }
+
+    fn get_port(&self, data: &BTreeMap<String, ByteString>) -> Result<u16, InterpretError> {
+        self.score
+            .port_override
+            .or_else(|| {
+                decode_secret(data, "port")
+                    .ok()
+                    .and_then(|p| p.parse().ok())
+            })
+            .ok_or_else(|| InterpretError::new("Port not found in secret or override".to_string()))
+    }
+
+    fn create_test_script(
+        &self,
+        temp_dir: &Path,
+        ca_file: &Path,
+        username: &str,
+        password: &str,
+        dbname: &str,
+        host: &str,
+        port: u16,
+    ) -> Result<PathBuf, InterpretError> {
+        let script_path = temp_dir.join("test_connection.sh");
+        let ca_file_in_container = Path::new("/tmp").join(ca_file.file_name().unwrap());
+        let script_content = format!(
+            "#!/bin/sh\n\\
+            psql \"host={} port={} user={} dbname={} sslmode=verify-ca sslrootcert={} sslnegotiation=direct\" -c \"SELECT 1\"",
+            host,
+            port,
+            username,
+            dbname,
+            ca_file_in_container.display()
+        );
+
+        debug!("Wrote script content : \n{script_content}");
+        std::fs::write(&script_path, script_content)
+            .map_err(|e| InterpretError::new(format!("Failed to write test script: {e}")))?;
+
+        #[cfg(unix)]
+        {
+            use std::os::unix::fs::PermissionsExt;
+            let mut perms = std::fs::metadata(&script_path)
+                .map_err(|e| InterpretError::new(format!("Failed to get script metadata: {e}")))?
+                .permissions();
+            perms.set_mode(0o755);
+            std::fs::set_permissions(&script_path, perms).map_err(|e| {
+                InterpretError::new(format!("Failed to set script permissions: {e}"))
+            })?;
+        }
+
+        Ok(script_path)
+    }
+
+    async fn run_docker_test(
+        &self,
+        temp_dir: &Path,
+        script_path: &Path,
+        password: &str,
+    ) -> Result<Outcome, InterpretError> {
+        info!("Running connection test in Docker container...");
+
+        let output = Command::new("docker")
+            .arg("run")
+            .arg("--rm")
+            .arg("-i")
+            .arg("-v")
+            .arg(format!("{}/:/tmp", temp_dir.display()))
+            .arg("--workdir")
+            .arg("/tmp")
+            .arg("--entrypoint")
+            .arg("/bin/sh")
+            .arg("postgres:latest")
+            .arg("-c")
+            .arg(format!("PGPASSWORD={} /tmp/test_connection.sh", password))
+            .env("PGPASSWORD", password)
+            .stdout(std::process::Stdio::inherit())
+            .stderr(std::process::Stdio::inherit())
+            .spawn()
+            .map_err(|e| InterpretError::new(format!("Failed to spawn docker container: {e}")))?
+            .wait_with_output()
+            .await
+            .map_err(|e| {
+                InterpretError::new(format!("Failed to wait for docker container: {e}"))
+            })?;
+
+        if output.status.success() {
+            info!("Successfully connected to PostgreSQL!");
+            Ok(Outcome::success("Connection successful".to_string()))
+        } else {
+            let stderr = String::from_utf8_lossy(&output.stderr);
+            error!("Connection failed: {}", stderr);
+            Err(InterpretError::new(format!(
+                "Connection failed: {}",
+                stderr
+            )))
+        }
+    }
+}
+
+#[async_trait]
+impl<T: Topology + K8sclient + Send + Sync> Interpret<T> for PostgreSQLConnectionInterpret {
+    fn get_name(&self) -> InterpretName {
+        InterpretName::Custom("PostgreSQLConnectionInterpret")
+    }
+
+    fn get_version(&self) -> Version {
+        todo!()
+    }
+
+    fn get_status(&self) -> InterpretStatus {
+        todo!()
+    }
+
+    fn get_children(&self) -> Vec<Id> {
+        vec![]
+    }
+
+    async fn execute(&self, _inventory: &Inventory, topo: &T) -> Result<Outcome, InterpretError> {
+        // Fetch secrets
+        let app_secret = self.fetch_app_secret(topo).await?;
+        trace!("Got app_secret {app_secret:?}");
+        let ca_secret = self.fetch_ca_secret(topo).await?;
+        trace!("Got ca_secret {ca_secret:?}");
+
+        // Get secret data
+        let app_data = self.get_secret_data(&app_secret, "App")?;
+        trace!("Got app_data {app_data:?}");
+        let ca_data = self.get_secret_data(&ca_secret, "CA")?;
+        trace!("Got ca_data {ca_data:?}");
+
+        // Create temp directory
+        let temp_dir = self.create_temp_dir()?;
+        let temp_dir_path = temp_dir.path();
+        debug!("Created temp dir {temp_dir_path:?}");
+
+        // Write CA cert
+        let ca_file = self.write_ca_cert(temp_dir_path, &ca_data)?;
+        debug!("Wrote ca_file {ca_file:?}");
+
+        // Get connection details
+        let username = decode_secret(&app_data, "username")?;
+        let password = decode_secret(&app_data, "password")?;
+        let dbname = decode_secret(&app_data, "dbname")?;
+        let host = self.get_host(&app_data)?;
+        let port = self.get_port(&app_data)?;
+
+
+        // Create test script
+        let script_path = self.create_test_script(
+            temp_dir_path,
+            &ca_file,
+            &username,
+            &password,
+            &dbname,
+            &host,
+            port,
+        )?;
+
+        debug!("Prepared test script in {}", temp_dir_path.display());
+        tokio::time::sleep(std::time::Duration::from_secs(10)).await;
+
+        // Run connection test
+        self.run_docker_test(temp_dir_path, &script_path, &password)
+            .await
+    }
+}
diff --git a/harmony/src/modules/postgresql/score_public.rs b/harmony/src/modules/postgresql/score_public.rs
index 8202176..d729005 100644
--- a/harmony/src/modules/postgresql/score_public.rs
+++ b/harmony/src/modules/postgresql/score_public.rs
@@ -37,6 +37,30 @@ impl PublicPostgreSQLScore {
     }
 }
 
+impl<T: Topology + K8sclient + TlsRouter + Send + Sync> Score<T> for PublicPostgreSQLScore {
+    fn create_interpret(&self) -> Box<dyn Interpret<T>> {
+        let rw_backend = format!("{}-rw", self.postgres_score.name);
+        let tls_route = TlsRoute {
+            namespace: self.postgres_score.namespace.clone(),
+            hostname: self.hostname.clone(),
+            backend: rw_backend,
+            target_port: 5432,
+        };
+
+        Box::new(PublicPostgreSQLInterpret {
+            postgres_score: self.postgres_score.clone(),
+            tls_route,
+        })
+    }
+
+    fn name(&self) -> String {
+        format!(
+            "PublicPostgreSQLScore({}:{})",
+            self.postgres_score.namespace, self.hostname
+        )
+    }
+}
+
 /// Custom interpret: deploy Postgres then install public TLS route.
 #[derive(Debug, Clone)]
 struct PublicPostgreSQLInterpret {
@@ -74,27 +98,3 @@ impl<T: Topology + K8sclient + TlsRouter + Send + Sync> Interpret<T> for PublicP
         )))
     }
 }
-
-impl<T: Topology + K8sclient + TlsRouter + Send + Sync> Score<T> for PublicPostgreSQLScore {
-    fn create_interpret(&self) -> Box<dyn Interpret<T>> {
-        let rw_backend = format!("{}-rw", self.postgres_score.name);
-        let tls_route = TlsRoute {
-            namespace: self.postgres_score.namespace.clone(),
-            hostname: self.hostname.clone(),
-            backend: rw_backend,
-            target_port: 5432,
-        };
-
-        Box::new(PublicPostgreSQLInterpret {
-            postgres_score: self.postgres_score.clone(),
-            tls_route,
-        })
-    }
-
-    fn name(&self) -> String {
-        format!(
-            "PublicPostgreSQLScore({}:{})",
-            self.postgres_score.namespace, self.hostname
-        )
-    }
-}
-- 
2.39.5


From 9e8f3ce52fb9211029e8d4ab61d966e9ef6e54e2 Mon Sep 17 00:00:00 2001
From: Jean-Gabriel Gill-Couture <jg@nationtech.io>
Date: Tue, 16 Dec 2025 15:53:54 -0500
Subject: [PATCH 12/20] feat(postgres): Postgres Connection Test score now has
 a script that provides more insight. Not quite working properly but easy to
 improve at this point.

---
 .../src/modules/postgresql/score_connect.rs   | 231 ++++++++++++++----
 1 file changed, 187 insertions(+), 44 deletions(-)

diff --git a/harmony/src/modules/postgresql/score_connect.rs b/harmony/src/modules/postgresql/score_connect.rs
index fa72ba5..4a7eabf 100644
--- a/harmony/src/modules/postgresql/score_connect.rs
+++ b/harmony/src/modules/postgresql/score_connect.rs
@@ -4,9 +4,7 @@ use k8s_openapi::api::core::v1::Secret;
 use log::{debug, error, info, trace};
 use serde::Serialize;
 use std::collections::BTreeMap;
-use std::io::Write;
 use std::path::{Path, PathBuf};
-use std::process::Stdio;
 use tokio::process::Command;
 
 use crate::data::Version;
@@ -16,6 +14,47 @@ use crate::score::Score;
 use crate::topology::{K8sclient, Topology};
 use harmony_types::id::Id;
 
+/// PostgreSQLConnectionScore tests PostgreSQL database connectivity and performance metrics
+/// for databases exposed via public endpoints. This score is specifically designed to verify
+/// that PostgreSQL instances installed using the PublicPostgreSQLScore can be accessed by external clients.
+///
+/// The score performs the following tests:
+/// 1. Verifies TLS/SSL connection using CA certificates from Kubernetes secrets
+/// 2. Tests basic connectivity to the database
+/// 3. (Optional, when db permissions are setup) Collects comprehensive performance metrics including :
+///    - Database size and schema usage statistics
+///    - Active connections and query activity
+///    - Performance metrics (transactions per second, cache hit ratio)
+///    - Index usage and table statistics
+///    - Configuration parameters
+///
+/// The implementation uses a Docker container running PostgreSQL client tools to execute
+/// the connection test, ensuring consistent behavior across different environments.
+///
+/// # Kubernetes Secrets Required
+///
+/// The score requires two Kubernetes secrets in the target namespace:
+/// - `{cluster_name}-app`: Contains connection parameters (host, port, username, password, dbname)
+/// - `{cluster_name}-ca`: Contains CA certificate (ca.crt) for TLS verification
+///
+/// # Usage
+///
+/// ```rust
+/// use harmony::modules::postgresql::PostgreSQLConnectionScore;
+///
+/// let score = PostgreSQLConnectionScore::new(
+///     "default",
+///     "my-postgres-cluster",
+///     None
+/// );
+/// ```
+///
+/// # Parameters
+///
+/// - `namespace`: Kubernetes namespace where the PostgreSQL secrets are located
+/// - `cluster_name`: Name of the PostgreSQL cluster (used to construct secret names)
+/// - `hostname_override`: Optional hostname override for connection testing
+/// - `port_override`: Optional port override for connection testing
 #[derive(Debug, Clone, Serialize)]
 pub struct PostgreSQLConnectionScore {
     pub name: String,
@@ -143,31 +182,13 @@ impl PostgreSQLConnectionInterpret {
             .ok_or_else(|| InterpretError::new("Port not found in secret or override".to_string()))
     }
 
-    fn create_test_script(
-        &self,
-        temp_dir: &Path,
-        ca_file: &Path,
-        username: &str,
-        password: &str,
-        dbname: &str,
-        host: &str,
-        port: u16,
-    ) -> Result<PathBuf, InterpretError> {
+    fn create_test_script(&self, temp_dir: &Path) -> Result<PathBuf, InterpretError> {
         let script_path = temp_dir.join("test_connection.sh");
-        let ca_file_in_container = Path::new("/tmp").join(ca_file.file_name().unwrap());
-        let script_content = format!(
-            "#!/bin/sh\n\\
-            psql \"host={} port={} user={} dbname={} sslmode=verify-ca sslrootcert={} sslnegotiation=direct\" -c \"SELECT 1\"",
-            host,
-            port,
-            username,
-            dbname,
-            ca_file_in_container.display()
-        );
 
-        debug!("Wrote script content : \n{script_content}");
+        let script_content = postgres_scipt_content();
         std::fs::write(&script_path, script_content)
             .map_err(|e| InterpretError::new(format!("Failed to write test script: {e}")))?;
+        debug!("Wrote script content : \n{script_content}");
 
         #[cfg(unix)]
         {
@@ -187,13 +208,15 @@ impl PostgreSQLConnectionInterpret {
     async fn run_docker_test(
         &self,
         temp_dir: &Path,
-        script_path: &Path,
+        cmd: &str,
         password: &str,
     ) -> Result<Outcome, InterpretError> {
         info!("Running connection test in Docker container...");
+        let container_cmd = format!("PGPASSWORD={} /tmp/test_connection.sh {}", password, cmd);
+        debug!("Starting docker container with cmd : {container_cmd}");
 
-        let output = Command::new("docker")
-            .arg("run")
+        let mut cmd = Command::new("docker");
+        cmd.arg("run")
             .arg("--rm")
             .arg("-i")
             .arg("-v")
@@ -204,10 +227,12 @@ impl PostgreSQLConnectionInterpret {
             .arg("/bin/sh")
             .arg("postgres:latest")
             .arg("-c")
-            .arg(format!("PGPASSWORD={} /tmp/test_connection.sh", password))
+            .arg(container_cmd)
             .env("PGPASSWORD", password)
             .stdout(std::process::Stdio::inherit())
-            .stderr(std::process::Stdio::inherit())
+            .stderr(std::process::Stdio::inherit());
+        debug!("Running Command {cmd:?}");
+        let output = cmd
             .spawn()
             .map_err(|e| InterpretError::new(format!("Failed to spawn docker container: {e}")))?
             .wait_with_output()
@@ -220,11 +245,11 @@ impl PostgreSQLConnectionInterpret {
             info!("Successfully connected to PostgreSQL!");
             Ok(Outcome::success("Connection successful".to_string()))
         } else {
+            let stdout = String::from_utf8_lossy(&output.stdout);
             let stderr = String::from_utf8_lossy(&output.stderr);
-            error!("Connection failed: {}", stderr);
+            error!("Connection failed: stdout:\n{stdout}\nstderr:\n{stderr}");
             Err(InterpretError::new(format!(
-                "Connection failed: {}",
-                stderr
+                "Connection failed: stdout:\n{stdout}\nstderr:\n{stderr}",
             )))
         }
     }
@@ -277,23 +302,141 @@ impl<T: Topology + K8sclient + Send + Sync> Interpret<T> for PostgreSQLConnectio
         let host = self.get_host(&app_data)?;
         let port = self.get_port(&app_data)?;
 
-
         // Create test script
-        let script_path = self.create_test_script(
-            temp_dir_path,
-            &ca_file,
-            &username,
-            &password,
-            &dbname,
-            &host,
-            port,
-        )?;
+        let script_path = self.create_test_script(temp_dir_path)?;
 
+        let ca_file_in_container = Path::new("/tmp").join(ca_file.file_name().unwrap());
+        let script_cmd = format!(
+            "{host} {port} {username} {dbname} {}",
+            ca_file_in_container.display()
+        );
         debug!("Prepared test script in {}", temp_dir_path.display());
-        tokio::time::sleep(std::time::Duration::from_secs(10)).await;
-
         // Run connection test
-        self.run_docker_test(temp_dir_path, &script_path, &password)
+        self.run_docker_test(temp_dir_path, &script_cmd, &password)
             .await
     }
 }
+
+fn postgres_scipt_content() -> &'static str {
+    r#"
+#!/bin/sh
+# PostgreSQL connection test and metrics collection script
+
+# Basic connectivity test
+echo "=== CONNECTION TEST ==="
+psql "host=$1 port=$2 user=$3 dbname=$4 sslmode=verify-ca sslrootcert=$5 sslnegotiation=direct" -c "SELECT 1" > /dev/null 2>&1
+if [ $? -ne 0 ]; then
+    echo "ERROR: Connection failed"
+    exit 1
+fi
+echo "Connection successful"
+
+# Database size metrics
+echo -e "\n=== DATABASE SIZE METRICS ==="
+echo "Total database size (MB):"
+psql "host=$1 port=$2 user=$3 dbname=$4 sslmode=verify-ca sslrootcert=$5 sslnegotiation=direct" -c "SELECT pg_size_pretty(pg_database_size(current_database()))" -t -A
+
+echo "Database size breakdown:"
+psql "host=$1 port=$2 user=$3 dbname=$4 sslmode=verify-ca sslrootcert=$5 sslnegotiation=direct" -c "SELECT
+    schema_name,
+    pg_size_pretty(sum(table_size)) as total_size
+FROM (
+    SELECT
+        n.nspname as schema_name,
+        c.relname as table_name,
+        pg_total_relation_size(c.oid) as table_size
+    FROM pg_class c
+    LEFT JOIN pg_namespace n ON n.oid = c.relnamespace
+    WHERE n.nspname NOT IN ('pg_catalog', 'information_schema')
+    AND c.relkind = 'r'
+) t
+GROUP BY schema_name
+ORDER BY sum(table_size) DESC" -t
+
+# Connection and activity metrics
+echo -e "\n=== CONNECTION & ACTIVITY ==="
+echo "Active connections:"
+psql "host=$1 port=$2 user=$3 dbname=$4 sslmode=verify-ca sslrootcert=$5 sslnegotiation=direct" -c "SELECT count(*) FROM pg_stat_activity" -t -A
+
+echo "Current queries (running longer than 1 second):"
+psql "host=$1 port=$2 user=$3 dbname=$4 sslmode=verify-ca sslrootcert=$5 sslnegotiation=direct" -c "SELECT
+    pid,
+    usename,
+    query_start,
+    now() - query_start as duration,
+    state,
+    left(query, 50) as query_preview
+FROM pg_stat_activity
+WHERE state = 'active' AND now() - query_start > interval '1 second'
+ORDER BY duration DESC" -t
+
+# Performance metrics
+echo -e "\n=== PERFORMANCE METRICS ==="
+echo "Database load (transactions per second):"
+psql "host=$1 port=$2 user=$3 dbname=$4 sslmode=verify-ca sslrootcert=$5 sslnegotiation=direct" -c "SELECT
+    tps,
+    tps_commit,
+    tps_rollback,
+    blks_read,
+    blks_hit,
+    hit_ratio
+FROM (
+    SELECT
+        xact_commit as tps_commit,
+        xact_rollback as tps_rollback,
+        (xact_commit + xact_rollback) as tps,
+        blks_read,
+        blks_hit,
+        CASE WHEN blks_read + blks_hit = 0 THEN 0 ELSE (blks_hit * 100.0 / (blks_read + blks_hit))::numeric(5,2) END as hit_ratio
+    FROM pg_stat_database
+    WHERE datname = current_database()
+) stats" -t
+
+echo "Current locks:"
+psql "host=$1 port=$2 user=$3 dbname=$4 sslmode=verify-ca sslrootcert=$5 sslnegotiation=direct" -c "SELECT
+    count(*) as lock_count,
+    string_agg(mode, ', ' ORDER BY mode) as lock_modes
+FROM pg_locks" -t
+
+# Table statistics
+echo -e "\n=== TABLE STATISTICS ==="
+echo "Most accessed tables:"
+psql "host=$1 port=$2 user=$3 dbname=$4 sslmode=verify-ca sslrootcert=$5 sslnegotiation=direct" -c "SELECT
+    relname,
+    seq_scan,
+    idx_scan,
+    n_tup_ins,
+    n_tup_upd,
+    n_tup_del
+FROM pg_stat_user_tables
+ORDER BY seq_scan + idx_scan + n_tup_ins + n_tup_upd + n_tup_del DESC
+LIMIT 10" -t
+
+# Index usage
+echo -e "\n=== INDEX USAGE ==="
+echo "Index usage statistics:"
+psql "host=$1 port=$2 user=$3 dbname=$4 sslmode=verify-ca sslrootcert=$5 sslnegotiation=direct" -c "SELECT
+    indexrelname as index_name,
+    idx_scan,
+    idx_tup_read,
+    idx_tup_fetch
+FROM pg_stat_user_indexes
+ORDER BY idx_scan DESC
+LIMIT 5" -t
+
+# Configuration and limits
+echo -e "\n=== CONFIGURATION ==="
+echo "Current database parameters:"
+psql "host=$1 port=$2 user=$3 dbname=$4 sslmode=verify-ca sslrootcert=$5 sslnegotiation=direct" -c "SELECT
+    name,
+    setting,
+    unit
+FROM pg_settings
+WHERE category = 'Resource Usage'
+ORDER BY name" -t
+
+echo -e "\n=== TEST COMPLETE ==="
+echo "All metrics collected successfully"
+exit 0
+"#
+}
-- 
2.39.5


From b0383454f00b8d30390df6bb000329f48f2901ca Mon Sep 17 00:00:00 2001
From: Jean-Gabriel Gill-Couture <jg@nationtech.io>
Date: Tue, 16 Dec 2025 16:24:53 -0500
Subject: [PATCH 13/20] feat(types): Add utility initialization functions for
 StorageSize such as StorageSize::kb(324)

---
 harmony_types/Cargo.toml     |   1 +
 harmony_types/src/storage.rs | 156 ++++++++++++++++++++++++++++++++++-
 2 files changed, 156 insertions(+), 1 deletion(-)

diff --git a/harmony_types/Cargo.toml b/harmony_types/Cargo.toml
index f02874e..56b6cdf 100644
--- a/harmony_types/Cargo.toml
+++ b/harmony_types/Cargo.toml
@@ -9,3 +9,4 @@ license.workspace = true
 serde.workspace = true
 url.workspace = true
 rand.workspace = true
+serde_json.workspace = true
diff --git a/harmony_types/src/storage.rs b/harmony_types/src/storage.rs
index bd5fd95..a0a3094 100644
--- a/harmony_types/src/storage.rs
+++ b/harmony_types/src/storage.rs
@@ -1,6 +1,160 @@
 use serde::{Deserialize, Serialize};
+use std::fmt;
 
-#[derive(Copy, Clone, PartialEq, Eq, Hash, Serialize, Deserialize, PartialOrd, Ord, Debug)]
+#[derive(Clone, PartialEq, Eq, Hash, Serialize, Deserialize, PartialOrd, Ord, Debug)]
 pub struct StorageSize {
     size_bytes: u64,
+    #[serde(skip)]
+    display_suffix: Option<String>,
+}
+
+impl StorageSize {
+    pub fn new(size_bytes: u64) -> Self {
+        Self {
+            size_bytes,
+            display_suffix: None,
+        }
+    }
+
+    pub fn b(size: u64) -> Self {
+        Self {
+            size_bytes: size,
+            display_suffix: Some("B".to_string()),
+        }
+    }
+
+    pub fn kb(size: u64) -> Self {
+        Self {
+            size_bytes: size * 1024,
+            display_suffix: Some("KB".to_string()),
+        }
+    }
+
+    pub fn mb(size: u64) -> Self {
+        Self {
+            size_bytes: size * 1024 * 1024,
+            display_suffix: Some("MB".to_string()),
+        }
+    }
+
+    pub fn gb(size: u64) -> Self {
+        Self {
+            size_bytes: size * 1024 * 1024 * 1024,
+            display_suffix: Some("GB".to_string()),
+        }
+    }
+
+    pub fn gi(size: u64) -> Self {
+        Self {
+            size_bytes: size * 1024 * 1024 * 1024,
+            display_suffix: Some("GiB".to_string()),
+        }
+    }
+
+    pub fn tb(size: u64) -> Self {
+        Self {
+            size_bytes: size * 1024 * 1024 * 1024 * 1024,
+            display_suffix: Some("TB".to_string()),
+        }
+    }
+
+    pub fn ti(size: u64) -> Self {
+        Self {
+            size_bytes: size * 1024 * 1024 * 1024 * 1024,
+            display_suffix: Some("TiB".to_string()),
+        }
+    }
+
+    pub fn bytes(&self) -> u64 {
+        self.size_bytes
+    }
+}
+
+impl fmt::Display for StorageSize {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        if let Some(suffix) = &self.display_suffix {
+            write!(f, "{}{}", self.size_bytes, suffix)
+        } else {
+            write!(f, "{}B", self.size_bytes)
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_bytes() {
+        let size = StorageSize::b(123);
+        assert_eq!(size.bytes(), 123);
+        assert_eq!(size.to_string(), "123B");
+    }
+
+    #[test]
+    fn test_kilobytes() {
+        let size = StorageSize::kb(2);
+        assert_eq!(size.bytes(), 2048);
+        assert_eq!(size.to_string(), "2048KB");
+    }
+
+    #[test]
+    fn test_megabytes() {
+        let size = StorageSize::mb(3);
+        assert_eq!(size.bytes(), 3 * 1024 * 1024);
+        assert_eq!(size.to_string(), "3145728MB");
+    }
+
+    #[test]
+    fn test_gigabytes() {
+        let size = StorageSize::gb(4);
+        assert_eq!(size.bytes(), 4 * 1024 * 1024 * 1024);
+        assert_eq!(size.to_string(), "4294967296GB");
+    }
+
+    #[test]
+    fn test_gibibytes() {
+        let size = StorageSize::gi(1);
+        assert_eq!(size.bytes(), 1024 * 1024 * 1024);
+        assert_eq!(size.to_string(), "1073741824GiB");
+    }
+
+    #[test]
+    fn test_terabytes() {
+        let size = StorageSize::tb(5);
+        assert_eq!(size.bytes(), 5 * 1024 * 1024 * 1024 * 1024);
+        assert_eq!(size.to_string(), "5497558138880TB");
+    }
+
+    #[test]
+    fn test_tebibytes() {
+        let size = StorageSize::ti(1);
+        assert_eq!(size.bytes(), 1024 * 1024 * 1024 * 1024);
+        assert_eq!(size.to_string(), "1099511627776TiB");
+    }
+
+    #[test]
+    fn test_new_without_suffix() {
+        let size = StorageSize::new(999);
+        assert_eq!(size.bytes(), 999);
+        assert_eq!(size.to_string(), "999B");
+    }
+
+    #[test]
+    fn test_serde_roundtrip() {
+        let original = StorageSize::gi(1);
+        let serialized = serde_json::to_string(&original).unwrap();
+        let deserialized: StorageSize = serde_json::from_str(&serialized).unwrap();
+
+        assert_eq!(original.bytes(), deserialized.bytes());
+        // Note: suffix is lost during serialization/deserialization
+        assert_ne!(original.to_string(), deserialized.to_string());
+    }
+
+    #[test]
+    fn test_ord() {
+        let one_gb = StorageSize::gb(1);
+        let one_gi = StorageSize::gi(1);
+        assert!(one_gb < one_gi); // 1GB = 1000MB, 1GiB = 1024MB
+    }
 }
-- 
2.39.5


From 440e684b35b64fcc1ec9a012fd466b5183e6ae9a Mon Sep 17 00:00:00 2001
From: Jean-Gabriel Gill-Couture <jg@nationtech.io>
Date: Tue, 16 Dec 2025 23:35:52 -0500
Subject: [PATCH 14/20] feat: Postgresql score based on the postgres capability
 now. true infrastructure abstraction!

---
 brocade/src/lib.rs                            |   6 +-
 examples/openbao/src/main.rs                  |   2 +-
 examples/postgresql/src/main.rs               |  14 +-
 examples/public_postgres/src/main.rs          |  17 ++-
 .../domain/topology/k8s_anywhere/postgres.rs  |  17 ++-
 .../application/features/helm_argocd_score.rs |  11 +-
 harmony/src/modules/postgresql/capability.rs  |  15 +++
 harmony/src/modules/postgresql/cnpg/crd.rs    |   2 +-
 harmony/src/modules/postgresql/failover.rs    |   5 +-
 harmony/src/modules/postgresql/mod.rs         |   7 +-
 harmony/src/modules/postgresql/score.rs       | 127 ++++++++++--------
 harmony/src/modules/postgresql/score_k8s.rs   |  80 +++++++++++
 .../src/modules/postgresql/score_public.rs    |  16 +--
 harmony_types/src/storage.rs                  |  29 ++--
 14 files changed, 244 insertions(+), 104 deletions(-)
 create mode 100644 harmony/src/modules/postgresql/score_k8s.rs

diff --git a/brocade/src/lib.rs b/brocade/src/lib.rs
index c0b5b70..4bb86b3 100644
--- a/brocade/src/lib.rs
+++ b/brocade/src/lib.rs
@@ -56,7 +56,7 @@ enum ExecutionMode {
 #[derive(Clone, Debug)]
 pub struct BrocadeInfo {
     os: BrocadeOs,
-    version: String,
+    _version: String,
 }
 
 #[derive(Clone, Debug)]
@@ -263,7 +263,7 @@ async fn get_brocade_info(session: &mut BrocadeSession) -> Result<BrocadeInfo, E
 
         return Ok(BrocadeInfo {
             os: BrocadeOs::NetworkOperatingSystem,
-            version,
+            _version: version,
         });
     } else if output.contains("ICX") {
         let re = Regex::new(r"(?m)^\s*SW: Version\s*(?P<version>[a-zA-Z0-9.\-]+)")
@@ -276,7 +276,7 @@ async fn get_brocade_info(session: &mut BrocadeSession) -> Result<BrocadeInfo, E
 
         return Ok(BrocadeInfo {
             os: BrocadeOs::FastIron,
-            version,
+            _version: version,
         });
     }
 
diff --git a/examples/openbao/src/main.rs b/examples/openbao/src/main.rs
index 52c5119..63918b8 100644
--- a/examples/openbao/src/main.rs
+++ b/examples/openbao/src/main.rs
@@ -1,4 +1,4 @@
-use std::{collections::HashMap, str::FromStr};
+use std::str::FromStr;
 
 use harmony::{
     inventory::Inventory,
diff --git a/examples/postgresql/src/main.rs b/examples/postgresql/src/main.rs
index 13da98a..31a501c 100644
--- a/examples/postgresql/src/main.rs
+++ b/examples/postgresql/src/main.rs
@@ -1,14 +1,18 @@
 use harmony::{
-    inventory::Inventory, modules::postgresql::PostgreSQLScore, topology::K8sAnywhereTopology,
+    inventory::Inventory,
+    modules::postgresql::{PostgreSQLScore, capability::PostgreSQLConfig},
+    topology::K8sAnywhereTopology,
 };
 
 #[tokio::main]
 async fn main() {
     let postgresql = PostgreSQLScore {
-        name: "harmony-postgres-example".to_string(), // Override default name
-        namespace: "harmony-postgres-example".to_string(),
-        ..Default::default() // Use harmony defaults, they are based on CNPG's default values :
-                             // "default" namespace, 1 instance, 1Gi storage
+        config: PostgreSQLConfig {
+            cluster_name: "harmony-postgres-example".to_string(), // Override default name
+            namespace: "harmony-postgres-example".to_string(),
+            ..Default::default() // Use harmony defaults, they are based on CNPG's default values :
+                                 // "default" namespace, 1 instance, 1Gi storage
+        },
     };
 
     harmony_cli::run(
diff --git a/examples/public_postgres/src/main.rs b/examples/public_postgres/src/main.rs
index 43078ec..16927d1 100644
--- a/examples/public_postgres/src/main.rs
+++ b/examples/public_postgres/src/main.rs
@@ -1,17 +1,22 @@
 use harmony::{
     inventory::Inventory,
-    modules::postgresql::{PostgreSQLConnectionScore, PostgreSQLScore, PublicPostgreSQLScore},
+    modules::postgresql::{
+        K8sPostgreSQLScore, PostgreSQLConnectionScore, PublicPostgreSQLScore,
+        capability::PostgreSQLConfig,
+    },
     topology::K8sAnywhereTopology,
 };
 
 #[tokio::main]
 async fn main() {
     let postgres = PublicPostgreSQLScore {
-        postgres_score: PostgreSQLScore {
-            name: "harmony-postgres-example".to_string(), // Override default name
-            namespace: "harmony-public-postgres".to_string(),
-            ..Default::default() // Use harmony defaults, they are based on CNPG's default values :
-                                 // "default" namespace, 1 instance, 1Gi storage
+        postgres_score: K8sPostgreSQLScore {
+            config: PostgreSQLConfig {
+                cluster_name: "harmony-postgres-example".to_string(), // Override default name
+                namespace: "harmony-public-postgres".to_string(),
+                ..Default::default() // Use harmony defaults, they are based on CNPG's default values :
+                                     // 1 instance, 1Gi storage
+            },
         },
         hostname: "postgrestest.sto1.nationtech.io".to_string(),
     };
diff --git a/harmony/src/domain/topology/k8s_anywhere/postgres.rs b/harmony/src/domain/topology/k8s_anywhere/postgres.rs
index 2774fc3..275c283 100644
--- a/harmony/src/domain/topology/k8s_anywhere/postgres.rs
+++ b/harmony/src/domain/topology/k8s_anywhere/postgres.rs
@@ -1,16 +1,27 @@
 use async_trait::async_trait;
 
 use crate::{
-    modules::postgresql::capability::{
-        PostgreSQL, PostgreSQLConfig, PostgreSQLEndpoint, ReplicationCerts,
+    interpret::Outcome,
+    inventory::Inventory,
+    modules::postgresql::{
+        K8sPostgreSQLScore,
+        capability::{PostgreSQL, PostgreSQLConfig, PostgreSQLEndpoint, ReplicationCerts},
     },
+    score::Score,
     topology::K8sAnywhereTopology,
 };
 
 #[async_trait]
 impl PostgreSQL for K8sAnywhereTopology {
     async fn deploy(&self, config: &PostgreSQLConfig) -> Result<String, String> {
-        todo!()
+        K8sPostgreSQLScore {
+            config: config.clone(),
+        }
+        .interpret(&Inventory::empty(), self)
+        .await
+        .map_err(|e| format!("Failed to deploy k8s postgresql : {e}"))?;
+
+        Ok(config.cluster_name.clone())
     }
 
     /// Extracts PostgreSQL-specific replication certs (PEM format) from a deployed primary cluster.
diff --git a/harmony/src/modules/application/features/helm_argocd_score.rs b/harmony/src/modules/application/features/helm_argocd_score.rs
index 2e51a9e..4f4e649 100644
--- a/harmony/src/modules/application/features/helm_argocd_score.rs
+++ b/harmony/src/modules/application/features/helm_argocd_score.rs
@@ -1,11 +1,9 @@
 use async_trait::async_trait;
 use harmony_macros::hurl;
-use kube::{Api, api::GroupVersionKind};
-use log::{debug, warn};
+use kube::api::GroupVersionKind;
 use non_blank_string_rs::NonBlankString;
 use serde::Serialize;
-use serde::de::DeserializeOwned;
-use std::{process::Command, str::FromStr, sync::Arc};
+use std::{str::FromStr, sync::Arc};
 
 use crate::{
     data::Version,
@@ -13,10 +11,7 @@ use crate::{
     inventory::Inventory,
     modules::helm::chart::{HelmChartScore, HelmRepository},
     score::Score,
-    topology::{
-        HelmCommand, K8sclient, PreparationError, PreparationOutcome, Topology, ingress::Ingress,
-        k8s::K8sClient,
-    },
+    topology::{HelmCommand, K8sclient, Topology, ingress::Ingress, k8s::K8sClient},
 };
 use harmony_types::id::Id;
 
diff --git a/harmony/src/modules/postgresql/capability.rs b/harmony/src/modules/postgresql/capability.rs
index 9bb2148..a2d6a91 100644
--- a/harmony/src/modules/postgresql/capability.rs
+++ b/harmony/src/modules/postgresql/capability.rs
@@ -30,6 +30,21 @@ pub struct PostgreSQLConfig {
     pub instances: u32,
     pub storage_size: StorageSize,
     pub role: PostgreSQLClusterRole,
+    /// **Note :** on OpenShfit based clusters, the namespace `default` has security
+    /// settings incompatible with the default CNPG behavior.
+    pub namespace: String,
+}
+
+impl Default for PostgreSQLConfig {
+    fn default() -> Self {
+        Self {
+            cluster_name: "harmony-pg".to_string(),
+            instances: 1,
+            storage_size: StorageSize::gi(1),
+            role: PostgreSQLClusterRole::Primary,
+            namespace: "harmony".to_string(),
+        }
+    }
 }
 
 #[derive(Clone, Debug, Serialize)]
diff --git a/harmony/src/modules/postgresql/cnpg/crd.rs b/harmony/src/modules/postgresql/cnpg/crd.rs
index 122923e..c8f6126 100644
--- a/harmony/src/modules/postgresql/cnpg/crd.rs
+++ b/harmony/src/modules/postgresql/cnpg/crd.rs
@@ -12,7 +12,7 @@ use serde::{Deserialize, Serialize};
 )]
 #[serde(rename_all = "camelCase")]
 pub struct ClusterSpec {
-    pub instances: i32,
+    pub instances: u32,
     pub image_name: Option<String>,
     pub storage: Storage,
     pub bootstrap: Bootstrap,
diff --git a/harmony/src/modules/postgresql/failover.rs b/harmony/src/modules/postgresql/failover.rs
index 9e54b2f..8e80166 100644
--- a/harmony/src/modules/postgresql/failover.rs
+++ b/harmony/src/modules/postgresql/failover.rs
@@ -3,6 +3,7 @@ use log::debug;
 use log::info;
 use std::collections::HashMap;
 
+use crate::interpret::Outcome;
 use crate::{
     modules::postgresql::capability::{
         BootstrapConfig, BootstrapStrategy, ExternalClusterConfig, PostgreSQL,
@@ -25,6 +26,7 @@ impl<T: PostgreSQL> PostgreSQL for FailoverTopology<T> {
             instances: config.instances,
             storage_size: config.storage_size.clone(),
             role: PostgreSQLClusterRole::Primary,
+            namespace: config.namespace.clone(),
         };
 
         info!(
@@ -91,6 +93,7 @@ impl<T: PostgreSQL> PostgreSQL for FailoverTopology<T> {
             instances: config.instances,
             storage_size: config.storage_size.clone(),
             role: PostgreSQLClusterRole::Replica(replica_cluster_config),
+            namespace: config.namespace.clone(),
         };
 
         info!(
@@ -102,7 +105,7 @@ impl<T: PostgreSQL> PostgreSQL for FailoverTopology<T> {
 
         info!(
             "Replica cluster '{}' deployed successfully; failover topology '{}' ready",
-            replica_config.cluster_name, config.cluster_name
+            replica_config.cluster_name, replica_config.cluster_name
         );
 
         Ok(primary_cluster_name)
diff --git a/harmony/src/modules/postgresql/mod.rs b/harmony/src/modules/postgresql/mod.rs
index ea50106..75e91d6 100644
--- a/harmony/src/modules/postgresql/mod.rs
+++ b/harmony/src/modules/postgresql/mod.rs
@@ -1,8 +1,8 @@
 pub mod capability;
-mod score;
+mod score_k8s;
 mod score_connect;
 pub use score_connect::*;
-pub use score::*;
+pub use score_k8s::*;
 mod score_public;
 pub use score_public::*;
 
@@ -10,4 +10,7 @@ pub mod failover;
 mod operator;
 pub use operator::*;
 
+mod score;
+pub use score::*;
+
 pub mod cnpg;
diff --git a/harmony/src/modules/postgresql/score.rs b/harmony/src/modules/postgresql/score.rs
index 2a5e82f..72023e6 100644
--- a/harmony/src/modules/postgresql/score.rs
+++ b/harmony/src/modules/postgresql/score.rs
@@ -1,51 +1,42 @@
+use async_trait::async_trait;
+use harmony_types::id::Id;
 use serde::Serialize;
 
-use crate::interpret::Interpret;
-use crate::modules::k8s::resource::K8sResourceScore;
-use crate::modules::postgresql::cnpg::{Bootstrap, Cluster, ClusterSpec, Initdb, Storage};
+use crate::data::Version;
+use crate::interpret::{Interpret, InterpretError, InterpretName, InterpretStatus, Outcome};
+use crate::inventory::Inventory;
+use crate::modules::postgresql::capability::{PostgreSQL, PostgreSQLConfig};
 use crate::score::Score;
-use crate::topology::{K8sclient, Topology};
-use k8s_openapi::apimachinery::pkg::apis::meta::v1::ObjectMeta;
+use crate::topology::Topology;
 
-/// Deploys an opinionated, highly available PostgreSQL cluster managed by CNPG.
+/// High-level, infrastructure-agnostic PostgreSQL deployment score.
 ///
-/// # Goals
-/// - Production-ready Postgres HA (3 instances), persistent storage, app DB.
+/// Delegates to the Topology's PostgreSQL capability implementation,
+/// allowing flexibility in deployment strategy (k8s/CNPG, cloud-managed, etc.).
 ///
 /// # Usage
 /// ```
 /// use harmony::modules::postgresql::PostgreSQLScore;
-/// let score = PostgreSQLScore::new("my-app-ns");
+/// let score = PostgreSQLScore::new("harmony");
 /// ```
 ///
-/// # Limitations (Happy Path)
-/// - Requires CNPG operator installed (use CloudNativePgOperatorScore).
-/// - No backups, monitoring, extensions configured.
+/// # Design
+/// - PostgreSQLScore: High-level, relies on Topology's PostgreSQL implementation
+/// - Topology implements PostgreSQL capability (decoupled from score)
+/// - K8s topologies use K8sPostgreSQLScore internally for CNPG deployment
 ///
-/// TODO : refactor this to declare a clean dependency on cnpg operator. Then cnpg operator will
-/// self-deploy either using operatorhub or helm chart depending on k8s flavor. This is cnpg
-/// specific behavior
+/// This layered approach gives users choice:
+/// - Use PostgreSQLScore for portability across topologies
+/// - Use K8sPostgreSQLScore directly for k8s-specific control
 #[derive(Debug, Clone, Serialize)]
 pub struct PostgreSQLScore {
-    pub name: String,
-    /// **Note :** on OpenShfit based clusters, the namespace `default` has security
-    /// settings incompatible with the default CNPG behavior.
-    pub namespace: String,
-    pub instances: i32,
-    pub storage_size: String,
-    pub image_name: Option<String>,
+    pub config: PostgreSQLConfig,
 }
 
 impl Default for PostgreSQLScore {
     fn default() -> Self {
         Self {
-            name: "harmony-pg".to_string(),
-            // We are using the namespace harmony by default since some clusters (openshift family)
-            // have incompatible configuration of the default namespace with cnpg
-            namespace: "harmony".to_string(),
-            instances: 1,
-            storage_size: "1Gi".to_string(),
-            image_name: None, // This lets cnpg use its default image
+            config: PostgreSQLConfig::default(),
         }
     }
 }
@@ -53,41 +44,63 @@ impl Default for PostgreSQLScore {
 impl PostgreSQLScore {
     pub fn new(namespace: &str) -> Self {
         Self {
-            namespace: namespace.to_string(),
-            ..Default::default()
+            config: PostgreSQLConfig {
+                namespace: namespace.to_string(),
+                ..Default::default()
+            },
         }
     }
 }
 
-impl<T: Topology + K8sclient> Score<T> for PostgreSQLScore {
+impl<T: Topology + PostgreSQL + Send + Sync> Score<T> for PostgreSQLScore {
     fn create_interpret(&self) -> Box<dyn Interpret<T>> {
-        let metadata = ObjectMeta {
-            name: Some(self.name.clone()),
-            namespace: Some(self.namespace.clone()),
-            ..ObjectMeta::default()
-        };
-
-        let spec = ClusterSpec {
-            instances: self.instances,
-            image_name: self.image_name.clone(),
-            storage: Storage {
-                size: self.storage_size.clone(),
-            },
-            bootstrap: Bootstrap {
-                initdb: Initdb {
-                    database: "app".to_string(),
-                    owner: "app".to_string(),
-                },
-            },
-            ..ClusterSpec::default()
-        };
-
-        let cluster = Cluster { metadata, spec };
-
-        K8sResourceScore::single(cluster, Some(self.namespace.clone())).create_interpret()
+        Box::new(PostgreSQLInterpret {
+            config: self.config.clone(),
+        })
     }
 
     fn name(&self) -> String {
-        format!("PostgreSQLScore({})", self.namespace)
+        format!(
+            "PostgreSQLScore({}:{})",
+            self.config.namespace, self.config.cluster_name
+        )
+    }
+}
+
+/// Interpret implementation that delegates to Topology's PostgreSQL capability.
+#[derive(Debug, Clone)]
+struct PostgreSQLInterpret {
+    config: PostgreSQLConfig,
+}
+
+#[async_trait]
+impl<T: Topology + PostgreSQL + Send + Sync> Interpret<T> for PostgreSQLInterpret {
+    fn get_name(&self) -> InterpretName {
+        InterpretName::Custom("PostgreSQLInterpret")
+    }
+
+    fn get_version(&self) -> Version {
+        todo!()
+    }
+
+    fn get_status(&self) -> InterpretStatus {
+        todo!()
+    }
+
+    fn get_children(&self) -> Vec<Id> {
+        todo!()
+    }
+
+    async fn execute(&self, _inventory: &Inventory, topo: &T) -> Result<Outcome, InterpretError> {
+        // Delegate to topology's PostgreSQL capability
+        let cluster_name = topo
+            .deploy(&self.config)
+            .await
+            .map_err(|e| InterpretError::new(e))?;
+
+        Ok(Outcome::success(format!(
+            "PostgreSQL cluster '{}' deployed in namespace '{}'",
+            cluster_name, self.config.namespace
+        )))
     }
 }
diff --git a/harmony/src/modules/postgresql/score_k8s.rs b/harmony/src/modules/postgresql/score_k8s.rs
new file mode 100644
index 0000000..5e3cb08
--- /dev/null
+++ b/harmony/src/modules/postgresql/score_k8s.rs
@@ -0,0 +1,80 @@
+use serde::Serialize;
+
+use crate::interpret::Interpret;
+use crate::modules::k8s::resource::K8sResourceScore;
+use crate::modules::postgresql::capability::PostgreSQLConfig;
+use crate::modules::postgresql::cnpg::{Bootstrap, Cluster, ClusterSpec, Initdb, Storage};
+use crate::score::Score;
+use crate::topology::{K8sclient, Topology};
+use k8s_openapi::apimachinery::pkg::apis::meta::v1::ObjectMeta;
+
+/// Deploys an opinionated, highly available PostgreSQL cluster managed by CNPG.
+///
+/// # Usage
+/// ```
+/// use harmony::modules::postgresql::PostgreSQLScore;
+/// let score = PostgreSQLScore::new("my-app-ns");
+/// ```
+///
+/// # Limitations (Happy Path)
+/// - Requires CNPG operator installed (use CloudNativePgOperatorScore).
+/// - No backups, monitoring, extensions configured.
+///
+/// TODO : refactor this to declare a clean dependency on cnpg operator. Then cnpg operator will
+/// self-deploy either using operatorhub or helm chart depending on k8s flavor. This is cnpg
+/// specific behavior
+#[derive(Debug, Clone, Serialize)]
+pub struct K8sPostgreSQLScore {
+    pub config: PostgreSQLConfig,
+}
+
+impl Default for K8sPostgreSQLScore {
+    fn default() -> Self {
+        Self {
+            config: PostgreSQLConfig::default(),
+        }
+    }
+}
+
+impl K8sPostgreSQLScore {
+    pub fn new(namespace: &str) -> Self {
+        Self {
+            config: PostgreSQLConfig {
+                namespace: namespace.to_string(),
+                ..Default::default()
+            },
+        }
+    }
+}
+
+impl<T: Topology + K8sclient> Score<T> for K8sPostgreSQLScore {
+    fn create_interpret(&self) -> Box<dyn Interpret<T>> {
+        let metadata = ObjectMeta {
+            name: Some(self.config.cluster_name.clone()),
+            namespace: Some(self.config.namespace.clone()),
+            ..ObjectMeta::default()
+        };
+
+        let spec = ClusterSpec {
+            instances: self.config.instances,
+            storage: Storage {
+                size: self.config.storage_size.to_string(),
+            },
+            bootstrap: Bootstrap {
+                initdb: Initdb {
+                    database: "app".to_string(),
+                    owner: "app".to_string(),
+                },
+            },
+            ..ClusterSpec::default()
+        };
+
+        let cluster = Cluster { metadata, spec };
+
+        K8sResourceScore::single(cluster, Some(self.config.namespace.clone())).create_interpret()
+    }
+
+    fn name(&self) -> String {
+        format!("PostgreSQLScore({})", self.config.namespace)
+    }
+}
diff --git a/harmony/src/modules/postgresql/score_public.rs b/harmony/src/modules/postgresql/score_public.rs
index d729005..1ebba70 100644
--- a/harmony/src/modules/postgresql/score_public.rs
+++ b/harmony/src/modules/postgresql/score_public.rs
@@ -6,7 +6,7 @@ use crate::data::Version;
 use crate::domain::topology::router::{TlsRoute, TlsRouter};
 use crate::interpret::{Interpret, InterpretError, InterpretName, InterpretStatus, Outcome};
 use crate::inventory::Inventory;
-use crate::modules::postgresql::PostgreSQLScore;
+use crate::modules::postgresql::K8sPostgreSQLScore;
 use crate::score::Score;
 use crate::topology::{K8sclient, Topology};
 
@@ -23,7 +23,7 @@ use crate::topology::{K8sclient, Topology};
 #[derive(Debug, Clone, Serialize)]
 pub struct PublicPostgreSQLScore {
     /// Inner non-public Postgres cluster config.
-    pub postgres_score: PostgreSQLScore,
+    pub postgres_score: K8sPostgreSQLScore,
     /// Public hostname for RW TLS passthrough (port 443 → cluster-rw:5432).
     pub hostname: String,
 }
@@ -31,7 +31,7 @@ pub struct PublicPostgreSQLScore {
 impl PublicPostgreSQLScore {
     pub fn new(namespace: &str, hostname: &str) -> Self {
         Self {
-            postgres_score: PostgreSQLScore::new(namespace),
+            postgres_score: K8sPostgreSQLScore::new(namespace),
             hostname: hostname.to_string(),
         }
     }
@@ -39,9 +39,9 @@ impl PublicPostgreSQLScore {
 
 impl<T: Topology + K8sclient + TlsRouter + Send + Sync> Score<T> for PublicPostgreSQLScore {
     fn create_interpret(&self) -> Box<dyn Interpret<T>> {
-        let rw_backend = format!("{}-rw", self.postgres_score.name);
+        let rw_backend = format!("{}-rw", self.postgres_score.config.cluster_name);
         let tls_route = TlsRoute {
-            namespace: self.postgres_score.namespace.clone(),
+            namespace: self.postgres_score.config.namespace.clone(),
             hostname: self.hostname.clone(),
             backend: rw_backend,
             target_port: 5432,
@@ -56,7 +56,7 @@ impl<T: Topology + K8sclient + TlsRouter + Send + Sync> Score<T> for PublicPostg
     fn name(&self) -> String {
         format!(
             "PublicPostgreSQLScore({}:{})",
-            self.postgres_score.namespace, self.hostname
+            self.postgres_score.config.namespace, self.hostname
         )
     }
 }
@@ -64,7 +64,7 @@ impl<T: Topology + K8sclient + TlsRouter + Send + Sync> Score<T> for PublicPostg
 /// Custom interpret: deploy Postgres then install public TLS route.
 #[derive(Debug, Clone)]
 struct PublicPostgreSQLInterpret {
-    postgres_score: PostgreSQLScore,
+    postgres_score: K8sPostgreSQLScore,
     tls_route: TlsRoute,
 }
 
@@ -93,7 +93,7 @@ impl<T: Topology + K8sclient + TlsRouter + Send + Sync> Interpret<T> for PublicP
 
         Ok(Outcome::success(format!(
             "Public CNPG cluster '{}' deployed with TLS passthrough route '{}'",
-            self.postgres_score.name.clone(),
+            self.postgres_score.config.cluster_name.clone(),
             self.tls_route.hostname
         )))
     }
diff --git a/harmony_types/src/storage.rs b/harmony_types/src/storage.rs
index a0a3094..28a7ef4 100644
--- a/harmony_types/src/storage.rs
+++ b/harmony_types/src/storage.rs
@@ -5,6 +5,8 @@ use std::fmt;
 pub struct StorageSize {
     size_bytes: u64,
     #[serde(skip)]
+    display_value: Option<u64>,
+    #[serde(skip)]
     display_suffix: Option<String>,
 }
 
@@ -12,6 +14,7 @@ impl StorageSize {
     pub fn new(size_bytes: u64) -> Self {
         Self {
             size_bytes,
+            display_value: None,
             display_suffix: None,
         }
     }
@@ -19,6 +22,7 @@ impl StorageSize {
     pub fn b(size: u64) -> Self {
         Self {
             size_bytes: size,
+            display_value: Some(size),
             display_suffix: Some("B".to_string()),
         }
     }
@@ -26,6 +30,7 @@ impl StorageSize {
     pub fn kb(size: u64) -> Self {
         Self {
             size_bytes: size * 1024,
+            display_value: Some(size),
             display_suffix: Some("KB".to_string()),
         }
     }
@@ -33,6 +38,7 @@ impl StorageSize {
     pub fn mb(size: u64) -> Self {
         Self {
             size_bytes: size * 1024 * 1024,
+            display_value: Some(size),
             display_suffix: Some("MB".to_string()),
         }
     }
@@ -40,6 +46,7 @@ impl StorageSize {
     pub fn gb(size: u64) -> Self {
         Self {
             size_bytes: size * 1024 * 1024 * 1024,
+            display_value: Some(size),
             display_suffix: Some("GB".to_string()),
         }
     }
@@ -47,13 +54,15 @@ impl StorageSize {
     pub fn gi(size: u64) -> Self {
         Self {
             size_bytes: size * 1024 * 1024 * 1024,
-            display_suffix: Some("GiB".to_string()),
+            display_value: Some(size),
+            display_suffix: Some("Gi".to_string()),
         }
     }
 
     pub fn tb(size: u64) -> Self {
         Self {
             size_bytes: size * 1024 * 1024 * 1024 * 1024,
+            display_value: Some(size),
             display_suffix: Some("TB".to_string()),
         }
     }
@@ -61,6 +70,7 @@ impl StorageSize {
     pub fn ti(size: u64) -> Self {
         Self {
             size_bytes: size * 1024 * 1024 * 1024 * 1024,
+            display_value: Some(size),
             display_suffix: Some("TiB".to_string()),
         }
     }
@@ -73,7 +83,8 @@ impl StorageSize {
 impl fmt::Display for StorageSize {
     fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
         if let Some(suffix) = &self.display_suffix {
-            write!(f, "{}{}", self.size_bytes, suffix)
+            let value = self.display_value.unwrap_or(self.size_bytes);
+            write!(f, "{}{}", value, suffix)
         } else {
             write!(f, "{}B", self.size_bytes)
         }
@@ -95,42 +106,42 @@ mod tests {
     fn test_kilobytes() {
         let size = StorageSize::kb(2);
         assert_eq!(size.bytes(), 2048);
-        assert_eq!(size.to_string(), "2048KB");
+        assert_eq!(size.to_string(), "2KB");
     }
 
     #[test]
     fn test_megabytes() {
         let size = StorageSize::mb(3);
         assert_eq!(size.bytes(), 3 * 1024 * 1024);
-        assert_eq!(size.to_string(), "3145728MB");
+        assert_eq!(size.to_string(), "3MB");
     }
 
     #[test]
     fn test_gigabytes() {
         let size = StorageSize::gb(4);
         assert_eq!(size.bytes(), 4 * 1024 * 1024 * 1024);
-        assert_eq!(size.to_string(), "4294967296GB");
+        assert_eq!(size.to_string(), "4GB");
     }
 
     #[test]
     fn test_gibibytes() {
         let size = StorageSize::gi(1);
         assert_eq!(size.bytes(), 1024 * 1024 * 1024);
-        assert_eq!(size.to_string(), "1073741824GiB");
+        assert_eq!(size.to_string(), "1Gi");
     }
 
     #[test]
     fn test_terabytes() {
         let size = StorageSize::tb(5);
         assert_eq!(size.bytes(), 5 * 1024 * 1024 * 1024 * 1024);
-        assert_eq!(size.to_string(), "5497558138880TB");
+        assert_eq!(size.to_string(), "5TB");
     }
 
     #[test]
     fn test_tebibytes() {
         let size = StorageSize::ti(1);
         assert_eq!(size.bytes(), 1024 * 1024 * 1024 * 1024);
-        assert_eq!(size.to_string(), "1099511627776TiB");
+        assert_eq!(size.to_string(), "1Ti");
     }
 
     #[test]
@@ -155,6 +166,6 @@ mod tests {
     fn test_ord() {
         let one_gb = StorageSize::gb(1);
         let one_gi = StorageSize::gi(1);
-        assert!(one_gb < one_gi); // 1GB = 1000MB, 1GiB = 1024MB
+        assert!(one_gb < one_gi); // 1GB = 1000MB, 1Gi = 1024MB
     }
 }
-- 
2.39.5


From 66a9a76a6bf3e63a2dad74fd80fa279647b9cb9d Mon Sep 17 00:00:00 2001
From: Jean-Gabriel Gill-Couture <jg@nationtech.io>
Date: Wed, 17 Dec 2025 14:32:23 -0500
Subject: [PATCH 15/20] feat(postgres): Failover postgres example maybe
 working!? Added FailoverTopology implementations for required capabilities,
 documented a bit, some more tests, and quite a few utility functions

---
 Cargo.lock                                    |  16 ++
 examples/multisite_postgres/Cargo.toml        |  18 ++
 examples/multisite_postgres/src/main.rs       |  31 ++++
 harmony/src/domain/topology/failover.rs       |  30 +++-
 harmony/src/domain/topology/k8s.rs            |  25 ++-
 .../topology/k8s_anywhere/k8s_anywhere.rs     | 168 +++++++++++++++++-
 .../domain/topology/k8s_anywhere/postgres.rs  |  80 ++++++++-
 harmony/src/domain/topology/router.rs         |  16 +-
 harmony/src/modules/k8s/failover.rs           |  19 ++
 harmony/src/modules/k8s/mod.rs                |   1 +
 harmony/src/modules/network/failover.rs       |  14 ++
 harmony/src/modules/network/mod.rs            |   1 +
 harmony/src/modules/okd/route.rs              |   6 +-
 harmony/src/modules/postgresql/failover.rs    |   1 -
 harmony/src/modules/postgresql/mod.rs         |   2 +-
 harmony_types/src/lib.rs                      |   2 +-
 harmony_types/src/rfc1123.rs                  |   7 +-
 harmony_types/src/storage.rs                  |   2 +-
 18 files changed, 410 insertions(+), 29 deletions(-)
 create mode 100644 examples/multisite_postgres/Cargo.toml
 create mode 100644 examples/multisite_postgres/src/main.rs
 create mode 100644 harmony/src/modules/k8s/failover.rs
 create mode 100644 harmony/src/modules/network/failover.rs

diff --git a/Cargo.lock b/Cargo.lock
index e8bee18..ac4598b 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1776,6 +1776,21 @@ dependencies = [
  "url",
 ]
 
+[[package]]
+name = "example-multisite-postgres"
+version = "0.1.0"
+dependencies = [
+ "cidr",
+ "env_logger",
+ "harmony",
+ "harmony_cli",
+ "harmony_macros",
+ "harmony_types",
+ "log",
+ "tokio",
+ "url",
+]
+
 [[package]]
 name = "example-nanodc"
 version = "0.1.0"
@@ -2561,6 +2576,7 @@ version = "0.1.0"
 dependencies = [
  "rand 0.9.2",
  "serde",
+ "serde_json",
  "url",
 ]
 
diff --git a/examples/multisite_postgres/Cargo.toml b/examples/multisite_postgres/Cargo.toml
new file mode 100644
index 0000000..249b9f8
--- /dev/null
+++ b/examples/multisite_postgres/Cargo.toml
@@ -0,0 +1,18 @@
+[package]
+name = "example-multisite-postgres"
+edition = "2024"
+version.workspace = true
+readme.workspace = true
+license.workspace = true
+publish = false
+
+[dependencies]
+harmony = { path = "../../harmony" }
+harmony_cli = { path = "../../harmony_cli" }
+harmony_types = { path = "../../harmony_types" }
+cidr = { workspace = true }
+tokio = { workspace = true }
+harmony_macros = { path = "../../harmony_macros" }
+log = { workspace = true }
+env_logger = { workspace = true }
+url = { workspace = true }
diff --git a/examples/multisite_postgres/src/main.rs b/examples/multisite_postgres/src/main.rs
new file mode 100644
index 0000000..bcb02c1
--- /dev/null
+++ b/examples/multisite_postgres/src/main.rs
@@ -0,0 +1,31 @@
+use harmony::{
+    inventory::Inventory,
+    modules::postgresql::{
+        K8sPostgreSQLScore, PublicPostgreSQLScore, capability::PostgreSQLConfig,
+    },
+    topology::{FailoverTopology, K8sAnywhereTopology},
+};
+
+#[tokio::main]
+async fn main() {
+    let postgres = PublicPostgreSQLScore {
+        postgres_score: K8sPostgreSQLScore {
+            config: PostgreSQLConfig {
+                cluster_name: "harmony-postgres-example".to_string(), // Override default name
+                namespace: "harmony-public-postgres".to_string(),
+                ..Default::default() // Use harmony defaults, they are based on CNPG's default values :
+                                     // "default" namespace, 1 instance, 1Gi storage
+            },
+        },
+        hostname: "postgrestest.sto1.nationtech.io".to_string(),
+    };
+
+    harmony_cli::run(
+        Inventory::autoload(),
+        FailoverTopology::<K8sAnywhereTopology>::from_env(),
+        vec![Box::new(postgres)],
+        None,
+    )
+    .await
+    .unwrap();
+}
diff --git a/harmony/src/domain/topology/failover.rs b/harmony/src/domain/topology/failover.rs
index 6df9cea..43c2ac6 100644
--- a/harmony/src/domain/topology/failover.rs
+++ b/harmony/src/domain/topology/failover.rs
@@ -1,6 +1,7 @@
 use async_trait::async_trait;
 
-use crate::topology::{PreparationError, PreparationOutcome, Topology};
+use crate::topology::k8s_anywhere::K8sAnywhereConfig;
+use crate::topology::{K8sAnywhereTopology, PreparationError, PreparationOutcome, Topology};
 
 pub struct FailoverTopology<T> {
     pub primary: T,
@@ -17,3 +18,30 @@ impl<T: Send + Sync> Topology for FailoverTopology<T> {
         todo!()
     }
 }
+
+impl FailoverTopology<K8sAnywhereTopology> {
+    /// Creates a new `FailoverTopology` from environment variables.
+    ///
+    /// Expects two environment variables:
+    /// - `HARMONY_FAILOVER_TOPOLOGY_K8S_PRIMARY`: Comma-separated `key=value` pairs, e.g.,
+    ///   `kubeconfig=/path/to/primary.kubeconfig,context_name=primary-ctx`
+    /// - `HARMONY_FAILOVER_TOPOLOGY_K8S_REPLICA`: Same format for the replica.
+    ///
+    /// Parses `kubeconfig` (path to kubeconfig file) and `context_name` (Kubernetes context),
+    /// and constructs `K8sAnywhereConfig` with local installs disabled (`use_local_k3d=false`,
+    /// `autoinstall=false`, `use_system_kubeconfig=false`).
+    /// `harmony_profile` is read from `HARMONY_PROFILE` env or defaults to `"dev"`.
+    ///
+    /// Panics if required env vars are missing or malformed.
+    pub fn from_env() -> Self {
+        let primary_config =
+            K8sAnywhereConfig::remote_k8s_from_env_var("HARMONY_FAILOVER_TOPOLOGY_K8S_PRIMARY");
+        let replica_config =
+            K8sAnywhereConfig::remote_k8s_from_env_var("HARMONY_FAILOVER_TOPOLOGY_K8S_REPLICA");
+
+        let primary = K8sAnywhereTopology::with_config(primary_config);
+        let replica = K8sAnywhereTopology::with_config(replica_config);
+
+        Self { primary, replica }
+    }
+}
diff --git a/harmony/src/domain/topology/k8s.rs b/harmony/src/domain/topology/k8s.rs
index 3cab0b8..7884512 100644
--- a/harmony/src/domain/topology/k8s.rs
+++ b/harmony/src/domain/topology/k8s.rs
@@ -631,6 +631,23 @@ impl K8sClient {
     }
 
     pub async fn from_kubeconfig(path: &str) -> Option<K8sClient> {
+        Self::from_kubeconfig_with_opts(path, &KubeConfigOptions::default()).await
+    }
+
+    pub async fn from_kubeconfig_with_context(
+        path: &str,
+        context: Option<String>,
+    ) -> Option<K8sClient> {
+        let mut opts = KubeConfigOptions::default();
+        opts.context = context;
+
+        Self::from_kubeconfig_with_opts(path, &opts).await
+    }
+
+    pub async fn from_kubeconfig_with_opts(
+        path: &str,
+        opts: &KubeConfigOptions,
+    ) -> Option<K8sClient> {
         let k = match Kubeconfig::read_from(path) {
             Ok(k) => k,
             Err(e) => {
@@ -638,13 +655,9 @@ impl K8sClient {
                 return None;
             }
         };
+
         Some(K8sClient::new(
-            Client::try_from(
-                Config::from_custom_kubeconfig(k, &KubeConfigOptions::default())
-                    .await
-                    .unwrap(),
-            )
-            .unwrap(),
+            Client::try_from(Config::from_custom_kubeconfig(k, &opts).await.unwrap()).unwrap(),
         ))
     }
 }
diff --git a/harmony/src/domain/topology/k8s_anywhere/k8s_anywhere.rs b/harmony/src/domain/topology/k8s_anywhere/k8s_anywhere.rs
index 694ce85..c3c6fa3 100644
--- a/harmony/src/domain/topology/k8s_anywhere/k8s_anywhere.rs
+++ b/harmony/src/domain/topology/k8s_anywhere/k8s_anywhere.rs
@@ -644,7 +644,7 @@ impl K8sAnywhereTopology {
     }
 
     async fn try_load_kubeconfig(&self, path: &str) -> Option<K8sClient> {
-        K8sClient::from_kubeconfig(path).await
+        K8sClient::from_kubeconfig_with_context(path, self.config.k8s_context.clone()).await
     }
 
     fn get_k3d_installation_score(&self) -> K3DInstallationScore {
@@ -922,9 +922,59 @@ pub struct K8sAnywhereConfig {
     /// default: true
     pub use_local_k3d: bool,
     pub harmony_profile: String,
+
+    /// Name of the kubeconfig context to use.
+    ///
+    /// If None, it will use the current context.
+    ///
+    /// If the context name is not found, it will fail to initialize.
+    pub k8s_context: Option<String>,
 }
 
 impl K8sAnywhereConfig {
+    /// Reads an environment variable `env_var` and parses its content :
+    ///     Comma-separated `key=value` pairs, e.g.,
+    ///   `kubeconfig=/path/to/primary.kubeconfig,context_name=primary-ctx`
+    ///
+    /// Then creates a K8sAnywhereConfig from it local installs disabled (`use_local_k3d=false`,
+    /// `autoinstall=false`, `use_system_kubeconfig=false`).
+    /// `harmony_profile` is read from `HARMONY_PROFILE` env or defaults to `"dev"`.
+    ///
+    /// Panics if `env_var` is missing or malformed.
+    pub fn remote_k8s_from_env_var(env_var: &str) -> Self {
+        Self::remote_k8s_from_env_var_with_profile(env_var, "HARMONY_PROFILE")
+    }
+
+    pub fn remote_k8s_from_env_var_with_profile(env_var: &str, profile_env_var: &str) -> Self {
+        let env_var_value = std::env::var(env_var)
+            .map_err(|_| format!("Missing required env var {env_var}"))
+            .unwrap();
+        info!("Initializing remote k8s from env var value : {env_var_value}");
+
+        let mut kubeconfig: Option<String> = None;
+        let mut k8s_context: Option<String> = None;
+
+        for part in env_var_value.split(',') {
+            let kv: Vec<&str> = part.splitn(2, '=').collect();
+            if kv.len() == 2 {
+                match kv[0].trim() {
+                    "kubeconfig" => kubeconfig = Some(kv[1].trim().to_string()),
+                    "context_name" => k8s_context = Some(kv[1].trim().to_string()),
+                    _ => {}
+                }
+            }
+        }
+
+        K8sAnywhereConfig {
+            kubeconfig,
+            k8s_context,
+            use_system_kubeconfig: false,
+            autoinstall: false,
+            use_local_k3d: false,
+            harmony_profile: std::env::var(profile_env_var).unwrap_or_else(|_| "dev".to_string()),
+        }
+    }
+
     fn from_env() -> Self {
         Self {
             kubeconfig: std::env::var("KUBECONFIG").ok().map(|v| v.to_string()),
@@ -939,6 +989,7 @@ impl K8sAnywhereConfig {
             ),
             use_local_k3d: std::env::var("HARMONY_USE_LOCAL_K3D")
                 .map_or_else(|_| true, |v| v.parse().ok().unwrap_or(true)),
+            k8s_context: std::env::var("HARMONY_K8S_CONTEXT").ok(),
         }
     }
 }
@@ -1045,3 +1096,118 @@ impl Ingress for K8sAnywhereTopology {
         }
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::sync::atomic::{AtomicUsize, Ordering};
+
+    static TEST_COUNTER: AtomicUsize = AtomicUsize::new(0);
+
+    /// Sets environment variables with unique names to avoid concurrency issues between tests.
+    /// Returns the names of the (config_var, profile_var) used.
+    fn setup_env_vars(config_value: Option<&str>, profile_value: Option<&str>) -> (String, String) {
+        let id = TEST_COUNTER.fetch_add(1, Ordering::SeqCst);
+        let config_var = format!("TEST_VAR_{}", id);
+        let profile_var = format!("TEST_PROFILE_{}", id);
+
+        unsafe {
+            if let Some(v) = config_value {
+                std::env::set_var(&config_var, v);
+            } else {
+                std::env::remove_var(&config_var);
+            }
+
+            if let Some(v) = profile_value {
+                std::env::set_var(&profile_var, v);
+            } else {
+                std::env::remove_var(&profile_var);
+            }
+        }
+        (config_var, profile_var)
+    }
+
+    #[test]
+    fn test_remote_k8s_from_env_var_full() {
+        let (config_var, profile_var) = setup_env_vars(
+            Some("kubeconfig=/foo.kc,context_name=bar"),
+            Some("testprof"),
+        );
+
+        let cfg =
+            K8sAnywhereConfig::remote_k8s_from_env_var_with_profile(&config_var, &profile_var);
+
+        assert_eq!(cfg.kubeconfig.as_deref(), Some("/foo.kc"));
+        assert_eq!(cfg.k8s_context.as_deref(), Some("bar"));
+        assert_eq!(cfg.harmony_profile, "testprof");
+        assert!(!cfg.use_local_k3d);
+        assert!(!cfg.autoinstall);
+        assert!(!cfg.use_system_kubeconfig);
+    }
+
+    #[test]
+    fn test_remote_k8s_from_env_var_only_kubeconfig() {
+        let (config_var, profile_var) = setup_env_vars(Some("kubeconfig=/foo.kc"), None);
+
+        let cfg =
+            K8sAnywhereConfig::remote_k8s_from_env_var_with_profile(&config_var, &profile_var);
+
+        assert_eq!(cfg.kubeconfig.as_deref(), Some("/foo.kc"));
+        assert_eq!(cfg.k8s_context, None);
+        assert_eq!(cfg.harmony_profile, "dev");
+    }
+
+    #[test]
+    fn test_remote_k8s_from_env_var_only_context() {
+        let (config_var, profile_var) = setup_env_vars(Some("context_name=bar"), None);
+
+        let cfg =
+            K8sAnywhereConfig::remote_k8s_from_env_var_with_profile(&config_var, &profile_var);
+
+        assert_eq!(cfg.kubeconfig, None);
+        assert_eq!(cfg.k8s_context.as_deref(), Some("bar"));
+    }
+
+    #[test]
+    fn test_remote_k8s_from_env_var_unknown_key_trim() {
+        let (config_var, profile_var) = setup_env_vars(
+            Some(" unknown=bla , kubeconfig= /foo.kc ,context_name= bar "),
+            None,
+        );
+
+        let cfg =
+            K8sAnywhereConfig::remote_k8s_from_env_var_with_profile(&config_var, &profile_var);
+
+        assert_eq!(cfg.kubeconfig.as_deref(), Some("/foo.kc"));
+        assert_eq!(cfg.k8s_context.as_deref(), Some("bar"));
+    }
+
+    #[test]
+    fn test_remote_k8s_from_env_var_empty_malformed() {
+        let (config_var, profile_var) = setup_env_vars(Some("malformed,no=,equal"), None);
+
+        let cfg =
+            K8sAnywhereConfig::remote_k8s_from_env_var_with_profile(&config_var, &profile_var);
+
+        // Unknown/malformed ignored, defaults to None
+        assert_eq!(cfg.kubeconfig, None);
+        assert_eq!(cfg.k8s_context, None);
+    }
+
+    #[test]
+    #[should_panic(expected = "Missing required env var")]
+    fn test_remote_k8s_from_env_var_missing() {
+        let (config_var, profile_var) = setup_env_vars(None, None);
+        K8sAnywhereConfig::remote_k8s_from_env_var_with_profile(&config_var, &profile_var);
+    }
+
+    #[test]
+    fn test_remote_k8s_from_env_var_harmony_profile_default() {
+        let (config_var, profile_var) = setup_env_vars(Some("kubeconfig=/foo"), None);
+
+        let cfg =
+            K8sAnywhereConfig::remote_k8s_from_env_var_with_profile(&config_var, &profile_var);
+
+        assert_eq!(cfg.harmony_profile, "dev");
+    }
+}
diff --git a/harmony/src/domain/topology/k8s_anywhere/postgres.rs b/harmony/src/domain/topology/k8s_anywhere/postgres.rs
index 275c283..9af9810 100644
--- a/harmony/src/domain/topology/k8s_anywhere/postgres.rs
+++ b/harmony/src/domain/topology/k8s_anywhere/postgres.rs
@@ -8,9 +8,12 @@ use crate::{
         capability::{PostgreSQL, PostgreSQLConfig, PostgreSQLEndpoint, ReplicationCerts},
     },
     score::Score,
-    topology::K8sAnywhereTopology,
+    topology::{K8sAnywhereTopology, K8sclient},
 };
 
+use k8s_openapi::api::core::v1::{Secret, Service};
+use log::info;
+
 #[async_trait]
 impl PostgreSQL for K8sAnywhereTopology {
     async fn deploy(&self, config: &PostgreSQLConfig) -> Result<String, String> {
@@ -27,12 +30,78 @@ impl PostgreSQL for K8sAnywhereTopology {
     /// Extracts PostgreSQL-specific replication certs (PEM format) from a deployed primary cluster.
     /// Abstracts away storage/retrieval details (e.g., secrets, files).
     async fn get_replication_certs(&self, cluster_name: &str) -> Result<ReplicationCerts, String> {
-        todo!()
+        let k8s_client = self.k8s_client().await.map_err(|e| e.to_string())?;
+
+        let replication_secret_name = format!("{cluster_name}-replication");
+        let replication_secret = k8s_client
+            .get_resource::<Secret>(&replication_secret_name, None)
+            .await
+            .map_err(|e| format!("Failed to get {replication_secret_name}: {e}"))?
+            .ok_or_else(|| format!("Replication secret '{replication_secret_name}' not found"))?;
+
+        let ca_secret_name = format!("{cluster_name}-ca");
+        let ca_secret = k8s_client
+            .get_resource::<Secret>(&ca_secret_name, None)
+            .await
+            .map_err(|e| format!("Failed to get {ca_secret_name}: {e}"))?
+            .ok_or_else(|| format!("CA secret '{ca_secret_name}' not found"))?;
+
+        let replication_data = replication_secret
+            .data
+            .as_ref()
+            .ok_or("Replication secret has no data".to_string())?;
+        let ca_data = ca_secret
+            .data
+            .as_ref()
+            .ok_or("CA secret has no data".to_string())?;
+
+        let tls_key_bs = replication_data
+            .get("tls.key")
+            .ok_or("missing tls.key in replication secret".to_string())?;
+        let tls_crt_bs = replication_data
+            .get("tls.crt")
+            .ok_or("missing tls.crt in replication secret".to_string())?;
+        let ca_crt_bs = ca_data
+            .get("ca.crt")
+            .ok_or("missing ca.crt in CA secret".to_string())?;
+
+        let streaming_replica_key_pem = String::from_utf8_lossy(&tls_key_bs.0).to_string();
+        let streaming_replica_cert_pem = String::from_utf8_lossy(&tls_crt_bs.0).to_string();
+        let ca_cert_pem = String::from_utf8_lossy(&ca_crt_bs.0).to_string();
+
+        info!("Successfully extracted replication certs for cluster '{cluster_name}'");
+
+        Ok(ReplicationCerts {
+            ca_cert_pem,
+            streaming_replica_cert_pem,
+            streaming_replica_key_pem,
+        })
     }
 
     /// Gets the internal/private endpoint (e.g., k8s service FQDN:5432) for the cluster.
     async fn get_endpoint(&self, cluster_name: &str) -> Result<PostgreSQLEndpoint, String> {
-        todo!()
+        let k8s_client = self.k8s_client().await.map_err(|e| e.to_string())?;
+
+        let service_name = format!("{cluster_name}-rw");
+        let service = k8s_client
+            .get_resource::<Service>(&service_name, None)
+            .await
+            .map_err(|e| format!("Failed to get service '{service_name}': {e}"))?
+            .ok_or_else(|| {
+                format!("Service '{service_name}' not found for cluster '{cluster_name}")
+            })?;
+
+        let ns = service
+            .metadata
+            .namespace
+            .as_deref()
+            .unwrap_or("default")
+            .to_string();
+        let host = format!("{service_name}.{ns}.svc.cluster.local");
+
+        info!("Internal endpoint for '{cluster_name}': {host}:5432");
+
+        Ok(PostgreSQLEndpoint { host, port: 5432 })
     }
 
     /// Gets the public/externally routable endpoint if configured (e.g., OKD Route:443 for TLS passthrough).
@@ -43,6 +112,9 @@ impl PostgreSQL for K8sAnywhereTopology {
         &self,
         cluster_name: &str,
     ) -> Result<Option<PostgreSQLEndpoint>, String> {
-        todo!()
+        // TODO: Implement OpenShift Route lookup targeting '{cluster_name}-rw' service on port 5432 with TLS passthrough
+        // For now, return None assuming internal-only access or manual route configuration
+        info!("Public endpoint lookup not implemented for '{cluster_name}', returning None");
+        Ok(None)
     }
 }
diff --git a/harmony/src/domain/topology/router.rs b/harmony/src/domain/topology/router.rs
index a904e1d..f5db5bf 100644
--- a/harmony/src/domain/topology/router.rs
+++ b/harmony/src/domain/topology/router.rs
@@ -80,15 +80,15 @@ pub struct TlsRoute {
     pub namespace: String,
 }
 
-  impl  TlsRoute {
-      pub fn to_string_short(&self) -> String {
-          format!("{}-{}:{}", self.hostname, self.backend, self.target_port)
-      }
+impl TlsRoute {
+    pub fn to_string_short(&self) -> String {
+        format!("{}-{}:{}", self.hostname, self.backend, self.target_port)
+    }
 
-      pub fn backend_info_string(&self) -> String {
-          format!("{}:{}", self.backend, self.target_port)
-      }
-  }
+    pub fn backend_info_string(&self) -> String {
+        format!("{}:{}", self.backend, self.target_port)
+    }
+}
 
 /// Installs and queries TLS passthrough routes (L4 TCP/SNI forwarding, no TLS termination).
 /// Agnostic to impl: OKD Route, AWS NLB+HAProxy, k3s Envoy Gateway, Apache ProxyPass.
diff --git a/harmony/src/modules/k8s/failover.rs b/harmony/src/modules/k8s/failover.rs
new file mode 100644
index 0000000..939d9ab
--- /dev/null
+++ b/harmony/src/modules/k8s/failover.rs
@@ -0,0 +1,19 @@
+use std::sync::Arc;
+
+use async_trait::async_trait;
+use log::warn;
+
+use crate::topology::{FailoverTopology, K8sclient, k8s::K8sClient};
+
+#[async_trait]
+impl<T: K8sclient> K8sclient for FailoverTopology<T> {
+    // TODO figure out how to structure this properly. This gives access only to the primary k8s
+    // client, which will work in many cases but is clearly not good enough for all uses cases
+    // where k8s_client can be used. Logging a warning for now.
+    async fn k8s_client(&self) -> Result<Arc<K8sClient>, String> {
+        warn!(
+            "Failover topology k8s_client capability currently defers to the primary only. Make sure to check this is OK for you"
+        );
+        self.primary.k8s_client().await
+    }
+}
diff --git a/harmony/src/modules/k8s/mod.rs b/harmony/src/modules/k8s/mod.rs
index 56c9201..29264b4 100644
--- a/harmony/src/modules/k8s/mod.rs
+++ b/harmony/src/modules/k8s/mod.rs
@@ -1,5 +1,6 @@
 pub mod apps;
 pub mod deployment;
+mod failover;
 pub mod ingress;
 pub mod namespace;
 pub mod resource;
diff --git a/harmony/src/modules/network/failover.rs b/harmony/src/modules/network/failover.rs
new file mode 100644
index 0000000..897abbd
--- /dev/null
+++ b/harmony/src/modules/network/failover.rs
@@ -0,0 +1,14 @@
+use async_trait::async_trait;
+use log::warn;
+
+use crate::topology::{FailoverTopology, TlsRoute, TlsRouter};
+
+#[async_trait]
+impl<T: TlsRouter> TlsRouter for FailoverTopology<T> {
+    async fn install_route(&self, config: TlsRoute) -> Result<(), String> {
+        warn!(
+            "Failover topology TlsRouter capability currently defers to the primary only. Make sure to check this is OK for you. The Replica Topology WILL NOT be affected here"
+        );
+        self.primary.install_route(config).await
+    }
+}
diff --git a/harmony/src/modules/network/mod.rs b/harmony/src/modules/network/mod.rs
index c70dd89..53c91f2 100644
--- a/harmony/src/modules/network/mod.rs
+++ b/harmony/src/modules/network/mod.rs
@@ -1,2 +1,3 @@
+mod failover;
 mod tls_router;
 pub use tls_router::*;
diff --git a/harmony/src/modules/okd/route.rs b/harmony/src/modules/okd/route.rs
index 9ca2f82..a20c968 100644
--- a/harmony/src/modules/okd/route.rs
+++ b/harmony/src/modules/okd/route.rs
@@ -88,7 +88,11 @@ impl<T: Topology + K8sclient> Score<T> for OKDTlsPassthroughScore {
             }),
             ..Default::default()
         };
-        let route_score = OKDRouteScore::new(&self.name.to_string(), &self.route.namespace, passthrough_spec);
+        let route_score = OKDRouteScore::new(
+            &self.name.to_string(),
+            &self.route.namespace,
+            passthrough_spec,
+        );
         route_score.create_interpret()
     }
 
diff --git a/harmony/src/modules/postgresql/failover.rs b/harmony/src/modules/postgresql/failover.rs
index 8e80166..1df5008 100644
--- a/harmony/src/modules/postgresql/failover.rs
+++ b/harmony/src/modules/postgresql/failover.rs
@@ -3,7 +3,6 @@ use log::debug;
 use log::info;
 use std::collections::HashMap;
 
-use crate::interpret::Outcome;
 use crate::{
     modules::postgresql::capability::{
         BootstrapConfig, BootstrapStrategy, ExternalClusterConfig, PostgreSQL,
diff --git a/harmony/src/modules/postgresql/mod.rs b/harmony/src/modules/postgresql/mod.rs
index 75e91d6..4e6efd5 100644
--- a/harmony/src/modules/postgresql/mod.rs
+++ b/harmony/src/modules/postgresql/mod.rs
@@ -1,6 +1,6 @@
 pub mod capability;
-mod score_k8s;
 mod score_connect;
+mod score_k8s;
 pub use score_connect::*;
 pub use score_k8s::*;
 mod score_public;
diff --git a/harmony_types/src/lib.rs b/harmony_types/src/lib.rs
index 3d72c80..b367a75 100644
--- a/harmony_types/src/lib.rs
+++ b/harmony_types/src/lib.rs
@@ -1,5 +1,5 @@
 pub mod id;
 pub mod net;
+pub mod rfc1123;
 pub mod storage;
 pub mod switch;
-pub mod rfc1123;
diff --git a/harmony_types/src/rfc1123.rs b/harmony_types/src/rfc1123.rs
index 190d8c4..fc0b722 100644
--- a/harmony_types/src/rfc1123.rs
+++ b/harmony_types/src/rfc1123.rs
@@ -43,7 +43,9 @@ impl TryFrom<&str> for Rfc1123Name {
         }
 
         // Trim leading/trailing non-alphanumeric
-        content = content.trim_matches(|c: char| !c.is_ascii_alphanumeric()).to_string();
+        content = content
+            .trim_matches(|c: char| !c.is_ascii_alphanumeric())
+            .to_string();
 
         if content.is_empty() {
             return Err(format!("Input '{}' resulted in empty string", s));
@@ -55,7 +57,6 @@ impl TryFrom<&str> for Rfc1123Name {
     type Error = String;
 }
 
-
 /// Converts an `Rfc1123Name` into a `String`.
 ///
 /// This allows using `Rfc1123Name` in contexts where a `String` is expected.
@@ -99,7 +100,6 @@ impl std::fmt::Display for Rfc1123Name {
     }
 }
 
-
 #[cfg(test)]
 mod tests {
     use super::Rfc1123Name;
@@ -229,4 +229,3 @@ mod tests {
         assert_eq!(name.content, "a.b.c");
     }
 }
-
diff --git a/harmony_types/src/storage.rs b/harmony_types/src/storage.rs
index 28a7ef4..4be3ea1 100644
--- a/harmony_types/src/storage.rs
+++ b/harmony_types/src/storage.rs
@@ -71,7 +71,7 @@ impl StorageSize {
         Self {
             size_bytes: size * 1024 * 1024 * 1024 * 1024,
             display_value: Some(size),
-            display_suffix: Some("TiB".to_string()),
+            display_suffix: Some("Ti".to_string()),
         }
     }
 
-- 
2.39.5


From 204795a74f608d94398aac024519772e457fda45 Mon Sep 17 00:00:00 2001
From: Jean-Gabriel Gill-Couture <jg@nationtech.io>
Date: Wed, 17 Dec 2025 16:43:37 -0500
Subject: [PATCH 16/20] feat(failoverPostgres): Its alive! We can now deploy a
 multisite postgres instance. The public hostname is still hardcoded, we will
 have to fix that but the rest is good enough

---
 examples/multisite_postgres/env_example.sh    |   3 +
 examples/multisite_postgres/src/main.rs       |  17 +-
 examples/public_postgres/src/main.rs          |  12 +-
 harmony/src/domain/topology/failover.rs       |  21 ++-
 .../topology/k8s_anywhere/k8s_anywhere.rs     | 154 ++++++++++++++----
 .../domain/topology/k8s_anywhere/postgres.rs  |  41 +++--
 harmony/src/domain/topology/router.rs         |  14 ++
 harmony/src/modules/network/failover.rs       |   4 +
 harmony/src/modules/postgresql/capability.rs  |  27 +--
 harmony/src/modules/postgresql/failover.rs    |  47 +++---
 .../src/modules/postgresql/score_public.rs    |  32 ++--
 11 files changed, 258 insertions(+), 114 deletions(-)
 create mode 100644 examples/multisite_postgres/env_example.sh

diff --git a/examples/multisite_postgres/env_example.sh b/examples/multisite_postgres/env_example.sh
new file mode 100644
index 0000000..2ef957c
--- /dev/null
+++ b/examples/multisite_postgres/env_example.sh
@@ -0,0 +1,3 @@
+export HARMONY_FAILOVER_TOPOLOGY_K8S_PRIMARY="context=default/api-your-openshift-cluster:6443/kube:admin"
+export HARMONY_FAILOVER_TOPOLOGY_K8S_REPLICA="context=someuser/somecluster"
+export RUST_LOG="harmony=debug"
diff --git a/examples/multisite_postgres/src/main.rs b/examples/multisite_postgres/src/main.rs
index bcb02c1..7ae4beb 100644
--- a/examples/multisite_postgres/src/main.rs
+++ b/examples/multisite_postgres/src/main.rs
@@ -1,21 +1,18 @@
 use harmony::{
     inventory::Inventory,
-    modules::postgresql::{
-        K8sPostgreSQLScore, PublicPostgreSQLScore, capability::PostgreSQLConfig,
-    },
+    modules::postgresql::{PublicPostgreSQLScore, capability::PostgreSQLConfig},
     topology::{FailoverTopology, K8sAnywhereTopology},
 };
 
 #[tokio::main]
 async fn main() {
+    // env_logger::init();
     let postgres = PublicPostgreSQLScore {
-        postgres_score: K8sPostgreSQLScore {
-            config: PostgreSQLConfig {
-                cluster_name: "harmony-postgres-example".to_string(), // Override default name
-                namespace: "harmony-public-postgres".to_string(),
-                ..Default::default() // Use harmony defaults, they are based on CNPG's default values :
-                                     // "default" namespace, 1 instance, 1Gi storage
-            },
+        config: PostgreSQLConfig {
+            cluster_name: "harmony-postgres-example".to_string(), // Override default name
+            namespace: "harmony-public-postgres".to_string(),
+            ..Default::default() // Use harmony defaults, they are based on CNPG's default values :
+                                 // "default" namespace, 1 instance, 1Gi storage
         },
         hostname: "postgrestest.sto1.nationtech.io".to_string(),
     };
diff --git a/examples/public_postgres/src/main.rs b/examples/public_postgres/src/main.rs
index 16927d1..029080e 100644
--- a/examples/public_postgres/src/main.rs
+++ b/examples/public_postgres/src/main.rs
@@ -10,13 +10,11 @@ use harmony::{
 #[tokio::main]
 async fn main() {
     let postgres = PublicPostgreSQLScore {
-        postgres_score: K8sPostgreSQLScore {
-            config: PostgreSQLConfig {
-                cluster_name: "harmony-postgres-example".to_string(), // Override default name
-                namespace: "harmony-public-postgres".to_string(),
-                ..Default::default() // Use harmony defaults, they are based on CNPG's default values :
-                                     // 1 instance, 1Gi storage
-            },
+        config: PostgreSQLConfig {
+            cluster_name: "harmony-postgres-example".to_string(), // Override default name
+            namespace: "harmony-public-postgres".to_string(),
+            ..Default::default() // Use harmony defaults, they are based on CNPG's default values :
+                                 // 1 instance, 1Gi storage
         },
         hostname: "postgrestest.sto1.nationtech.io".to_string(),
     };
diff --git a/harmony/src/domain/topology/failover.rs b/harmony/src/domain/topology/failover.rs
index 43c2ac6..0388222 100644
--- a/harmony/src/domain/topology/failover.rs
+++ b/harmony/src/domain/topology/failover.rs
@@ -9,13 +9,30 @@ pub struct FailoverTopology<T> {
 }
 
 #[async_trait]
-impl<T: Send + Sync> Topology for FailoverTopology<T> {
+impl<T: Topology + Send + Sync> Topology for FailoverTopology<T> {
     fn name(&self) -> &str {
         "FailoverTopology"
     }
 
     async fn ensure_ready(&self) -> Result<PreparationOutcome, PreparationError> {
-        todo!()
+        let primary_outcome = self.primary.ensure_ready().await?;
+        let replica_outcome = self.replica.ensure_ready().await?;
+
+        match (primary_outcome, replica_outcome) {
+            (PreparationOutcome::Noop, PreparationOutcome::Noop) => Ok(PreparationOutcome::Noop),
+            (p, r) => {
+                let mut details = Vec::new();
+                if let PreparationOutcome::Success { details: d } = p {
+                    details.push(format!("Primary: {}", d));
+                }
+                if let PreparationOutcome::Success { details: d } = r {
+                    details.push(format!("Replica: {}", d));
+                }
+                Ok(PreparationOutcome::Success {
+                    details: details.join(", "),
+                })
+            }
+        }
     }
 }
 
diff --git a/harmony/src/domain/topology/k8s_anywhere/k8s_anywhere.rs b/harmony/src/domain/topology/k8s_anywhere/k8s_anywhere.rs
index c3c6fa3..4e0337b 100644
--- a/harmony/src/domain/topology/k8s_anywhere/k8s_anywhere.rs
+++ b/harmony/src/domain/topology/k8s_anywhere/k8s_anywhere.rs
@@ -106,6 +106,16 @@ impl K8sclient for K8sAnywhereTopology {
 
 #[async_trait]
 impl TlsRouter for K8sAnywhereTopology {
+    async fn get_wildcard_domain(&self) -> Result<Option<String>, String> {
+        todo!()
+    }
+
+    /// Returns the port that this router exposes externally.
+    async fn get_router_port(&self) -> u16 {
+        // TODO un-hardcode this :)
+        443
+    }
+
     async fn install_route(&self, route: TlsRoute) -> Result<(), String> {
         let distro = self
             .get_k8s_distribution()
@@ -682,7 +692,14 @@ impl K8sAnywhereTopology {
                         return Ok(Some(K8sState {
                             client: Arc::new(client),
                             source: K8sSource::Kubeconfig,
-                            message: format!("Loaded k8s client from kubeconfig {kubeconfig}"),
+                            message: format!(
+                                "Loaded k8s client from kubeconfig {kubeconfig} using context {}",
+                                self.config
+                                    .k8s_context
+                                    .as_ref()
+                                    .map(|s| s.clone())
+                                    .unwrap_or_default()
+                            ),
                         }));
                     }
                     None => {
@@ -934,20 +951,23 @@ pub struct K8sAnywhereConfig {
 impl K8sAnywhereConfig {
     /// Reads an environment variable `env_var` and parses its content :
     ///     Comma-separated `key=value` pairs, e.g.,
-    ///   `kubeconfig=/path/to/primary.kubeconfig,context_name=primary-ctx`
+    ///   `kubeconfig=/path/to/primary.kubeconfig,context=primary-ctx`
     ///
     /// Then creates a K8sAnywhereConfig from it local installs disabled (`use_local_k3d=false`,
     /// `autoinstall=false`, `use_system_kubeconfig=false`).
     /// `harmony_profile` is read from `HARMONY_PROFILE` env or defaults to `"dev"`.
     ///
+    /// If no kubeconfig path is provided it will fall back to system kubeconfig
+    ///
     /// Panics if `env_var` is missing or malformed.
     pub fn remote_k8s_from_env_var(env_var: &str) -> Self {
         Self::remote_k8s_from_env_var_with_profile(env_var, "HARMONY_PROFILE")
     }
 
     pub fn remote_k8s_from_env_var_with_profile(env_var: &str, profile_env_var: &str) -> Self {
+        debug!("Looking for env var named : {env_var}");
         let env_var_value = std::env::var(env_var)
-            .map_err(|_| format!("Missing required env var {env_var}"))
+            .map_err(|e| format!("Missing required env var {env_var} : {e}"))
             .unwrap();
         info!("Initializing remote k8s from env var value : {env_var_value}");
 
@@ -959,16 +979,25 @@ impl K8sAnywhereConfig {
             if kv.len() == 2 {
                 match kv[0].trim() {
                     "kubeconfig" => kubeconfig = Some(kv[1].trim().to_string()),
-                    "context_name" => k8s_context = Some(kv[1].trim().to_string()),
+                    "context" => k8s_context = Some(kv[1].trim().to_string()),
                     _ => {}
                 }
             }
         }
 
+        debug!("Found in {env_var} : kubeconfig {kubeconfig:?} and context {k8s_context:?}");
+
+        let use_system_kubeconfig = kubeconfig.is_none();
+
+        if let Some(kubeconfig_value) = std::env::var("KUBECONFIG").ok().map(|v| v.to_string()) {
+            kubeconfig.get_or_insert(kubeconfig_value);
+        }
+        info!("Loading k8s environment with kubeconfig {kubeconfig:?} and context {k8s_context:?}");
+
         K8sAnywhereConfig {
             kubeconfig,
             k8s_context,
-            use_system_kubeconfig: false,
+            use_system_kubeconfig,
             autoinstall: false,
             use_local_k3d: false,
             harmony_profile: std::env::var(profile_env_var).unwrap_or_else(|_| "dev".to_string()),
@@ -1124,15 +1153,23 @@ mod tests {
                 std::env::remove_var(&profile_var);
             }
         }
+
         (config_var, profile_var)
     }
 
+    /// Runs a test in a separate thread to avoid polluting the process environment.
+    fn run_in_isolated_env<F>(f: F)
+    where
+        F: FnOnce() + Send + 'static,
+    {
+        let handle = std::thread::spawn(f);
+        handle.join().expect("Test thread panicked");
+    }
+
     #[test]
     fn test_remote_k8s_from_env_var_full() {
-        let (config_var, profile_var) = setup_env_vars(
-            Some("kubeconfig=/foo.kc,context_name=bar"),
-            Some("testprof"),
-        );
+        let (config_var, profile_var) =
+            setup_env_vars(Some("kubeconfig=/foo.kc,context=bar"), Some("testprof"));
 
         let cfg =
             K8sAnywhereConfig::remote_k8s_from_env_var_with_profile(&config_var, &profile_var);
@@ -1159,39 +1196,88 @@ mod tests {
 
     #[test]
     fn test_remote_k8s_from_env_var_only_context() {
-        let (config_var, profile_var) = setup_env_vars(Some("context_name=bar"), None);
+        run_in_isolated_env(|| {
+            unsafe {
+                std::env::remove_var("KUBECONFIG");
+            }
+            let (config_var, profile_var) = setup_env_vars(Some("context=bar"), None);
 
-        let cfg =
-            K8sAnywhereConfig::remote_k8s_from_env_var_with_profile(&config_var, &profile_var);
+            let cfg =
+                K8sAnywhereConfig::remote_k8s_from_env_var_with_profile(&config_var, &profile_var);
 
-        assert_eq!(cfg.kubeconfig, None);
-        assert_eq!(cfg.k8s_context.as_deref(), Some("bar"));
+            assert_eq!(cfg.kubeconfig, None);
+            assert_eq!(cfg.k8s_context.as_deref(), Some("bar"));
+        });
     }
 
     #[test]
     fn test_remote_k8s_from_env_var_unknown_key_trim() {
-        let (config_var, profile_var) = setup_env_vars(
-            Some(" unknown=bla , kubeconfig= /foo.kc ,context_name= bar "),
-            None,
-        );
+        run_in_isolated_env(|| {
+            unsafe {
+                std::env::remove_var("KUBECONFIG");
+            }
+            let (config_var, profile_var) = setup_env_vars(
+                Some(" unknown=bla , kubeconfig= /foo.kc ,context= bar "),
+                None,
+            );
 
-        let cfg =
-            K8sAnywhereConfig::remote_k8s_from_env_var_with_profile(&config_var, &profile_var);
+            let cfg =
+                K8sAnywhereConfig::remote_k8s_from_env_var_with_profile(&config_var, &profile_var);
 
-        assert_eq!(cfg.kubeconfig.as_deref(), Some("/foo.kc"));
-        assert_eq!(cfg.k8s_context.as_deref(), Some("bar"));
+            assert_eq!(cfg.kubeconfig.as_deref(), Some("/foo.kc"));
+            assert_eq!(cfg.k8s_context.as_deref(), Some("bar"));
+        });
     }
 
     #[test]
     fn test_remote_k8s_from_env_var_empty_malformed() {
-        let (config_var, profile_var) = setup_env_vars(Some("malformed,no=,equal"), None);
+        run_in_isolated_env(|| {
+            unsafe {
+                std::env::remove_var("KUBECONFIG");
+            }
+            let (config_var, profile_var) = setup_env_vars(Some("malformed,no=,equal"), None);
 
-        let cfg =
-            K8sAnywhereConfig::remote_k8s_from_env_var_with_profile(&config_var, &profile_var);
+            let cfg =
+                K8sAnywhereConfig::remote_k8s_from_env_var_with_profile(&config_var, &profile_var);
 
-        // Unknown/malformed ignored, defaults to None
-        assert_eq!(cfg.kubeconfig, None);
-        assert_eq!(cfg.k8s_context, None);
+            // Unknown/malformed ignored, defaults to None
+            assert_eq!(cfg.kubeconfig, None);
+            assert_eq!(cfg.k8s_context, None);
+        });
+    }
+
+    #[test]
+    fn test_remote_k8s_from_env_var_kubeconfig_fallback() {
+        run_in_isolated_env(|| {
+            unsafe {
+                std::env::set_var("KUBECONFIG", "/fallback/path");
+            }
+            let (config_var, profile_var) = setup_env_vars(Some("context=bar"), None);
+
+            let cfg =
+                K8sAnywhereConfig::remote_k8s_from_env_var_with_profile(&config_var, &profile_var);
+
+            assert_eq!(cfg.kubeconfig.as_deref(), Some("/fallback/path"));
+            assert_eq!(cfg.k8s_context.as_deref(), Some("bar"));
+        });
+    }
+
+    #[test]
+    fn test_remote_k8s_from_env_var_kubeconfig_no_fallback_if_provided() {
+        run_in_isolated_env(|| {
+            unsafe {
+                std::env::set_var("KUBECONFIG", "/fallback/path");
+            }
+            let (config_var, profile_var) =
+                setup_env_vars(Some("kubeconfig=/primary/path,context=bar"), None);
+
+            let cfg =
+                K8sAnywhereConfig::remote_k8s_from_env_var_with_profile(&config_var, &profile_var);
+
+            // Primary path should take precedence
+            assert_eq!(cfg.kubeconfig.as_deref(), Some("/primary/path"));
+            assert_eq!(cfg.k8s_context.as_deref(), Some("bar"));
+        });
     }
 
     #[test]
@@ -1202,12 +1288,18 @@ mod tests {
     }
 
     #[test]
-    fn test_remote_k8s_from_env_var_harmony_profile_default() {
-        let (config_var, profile_var) = setup_env_vars(Some("kubeconfig=/foo"), None);
+    fn test_remote_k8s_from_env_var_context_key() {
+        let (config_var, profile_var) = setup_env_vars(
+            Some("context=default/api-sto1-harmony-mcd:6443/kube:admin"),
+            None,
+        );
 
         let cfg =
             K8sAnywhereConfig::remote_k8s_from_env_var_with_profile(&config_var, &profile_var);
 
-        assert_eq!(cfg.harmony_profile, "dev");
+        assert_eq!(
+            cfg.k8s_context.as_deref(),
+            Some("default/api-sto1-harmony-mcd:6443/kube:admin")
+        );
     }
 }
diff --git a/harmony/src/domain/topology/k8s_anywhere/postgres.rs b/harmony/src/domain/topology/k8s_anywhere/postgres.rs
index 9af9810..7051a1b 100644
--- a/harmony/src/domain/topology/k8s_anywhere/postgres.rs
+++ b/harmony/src/domain/topology/k8s_anywhere/postgres.rs
@@ -29,19 +29,21 @@ impl PostgreSQL for K8sAnywhereTopology {
 
     /// Extracts PostgreSQL-specific replication certs (PEM format) from a deployed primary cluster.
     /// Abstracts away storage/retrieval details (e.g., secrets, files).
-    async fn get_replication_certs(&self, cluster_name: &str) -> Result<ReplicationCerts, String> {
+    async fn get_replication_certs(&self, config: &PostgreSQLConfig) -> Result<ReplicationCerts, String> {
+        let cluster_name = &config.cluster_name;
+        let namespace = &config.namespace;
         let k8s_client = self.k8s_client().await.map_err(|e| e.to_string())?;
 
         let replication_secret_name = format!("{cluster_name}-replication");
         let replication_secret = k8s_client
-            .get_resource::<Secret>(&replication_secret_name, None)
+            .get_resource::<Secret>(&replication_secret_name, Some(namespace))
             .await
             .map_err(|e| format!("Failed to get {replication_secret_name}: {e}"))?
             .ok_or_else(|| format!("Replication secret '{replication_secret_name}' not found"))?;
 
         let ca_secret_name = format!("{cluster_name}-ca");
         let ca_secret = k8s_client
-            .get_resource::<Secret>(&ca_secret_name, None)
+            .get_resource::<Secret>(&ca_secret_name, Some(namespace))
             .await
             .map_err(|e| format!("Failed to get {ca_secret_name}: {e}"))?
             .ok_or_else(|| format!("CA secret '{ca_secret_name}' not found"))?;
@@ -79,12 +81,15 @@ impl PostgreSQL for K8sAnywhereTopology {
     }
 
     /// Gets the internal/private endpoint (e.g., k8s service FQDN:5432) for the cluster.
-    async fn get_endpoint(&self, cluster_name: &str) -> Result<PostgreSQLEndpoint, String> {
+    async fn get_endpoint(&self, config: &PostgreSQLConfig) -> Result<PostgreSQLEndpoint, String> {
+        let cluster_name = &config.cluster_name;
+        let namespace = &config.namespace;
+
         let k8s_client = self.k8s_client().await.map_err(|e| e.to_string())?;
 
         let service_name = format!("{cluster_name}-rw");
         let service = k8s_client
-            .get_resource::<Service>(&service_name, None)
+            .get_resource::<Service>(&service_name, Some(namespace))
             .await
             .map_err(|e| format!("Failed to get service '{service_name}': {e}"))?
             .ok_or_else(|| {
@@ -104,17 +109,17 @@ impl PostgreSQL for K8sAnywhereTopology {
         Ok(PostgreSQLEndpoint { host, port: 5432 })
     }
 
-    /// Gets the public/externally routable endpoint if configured (e.g., OKD Route:443 for TLS passthrough).
-    /// Returns None if no public endpoint (internal-only cluster).
-    /// UNSTABLE: This is opinionated for initial multisite use cases. Networking abstraction is complex
-    /// (cf. k8s Ingress -> Gateway API evolution); may move to higher-order Networking/PostgreSQLNetworking trait.
-    async fn get_public_endpoint(
-        &self,
-        cluster_name: &str,
-    ) -> Result<Option<PostgreSQLEndpoint>, String> {
-        // TODO: Implement OpenShift Route lookup targeting '{cluster_name}-rw' service on port 5432 with TLS passthrough
-        // For now, return None assuming internal-only access or manual route configuration
-        info!("Public endpoint lookup not implemented for '{cluster_name}', returning None");
-        Ok(None)
-    }
+    // /// Gets the public/externally routable endpoint if configured (e.g., OKD Route:443 for TLS passthrough).
+    // /// Returns None if no public endpoint (internal-only cluster).
+    // /// UNSTABLE: This is opinionated for initial multisite use cases. Networking abstraction is complex
+    // /// (cf. k8s Ingress -> Gateway API evolution); may move to higher-order Networking/PostgreSQLNetworking trait.
+    // async fn get_public_endpoint(
+    //     &self,
+    //     cluster_name: &str,
+    // ) -> Result<Option<PostgreSQLEndpoint>, String> {
+    //     // TODO: Implement OpenShift Route lookup targeting '{cluster_name}-rw' service on port 5432 with TLS passthrough
+    //     // For now, return None assuming internal-only access or manual route configuration
+    //     info!("Public endpoint lookup not implemented for '{cluster_name}', returning None");
+    //     Ok(None)
+    // }
 }
diff --git a/harmony/src/domain/topology/router.rs b/harmony/src/domain/topology/router.rs
index f5db5bf..26aa572 100644
--- a/harmony/src/domain/topology/router.rs
+++ b/harmony/src/domain/topology/router.rs
@@ -110,4 +110,18 @@ pub trait TlsRouter: Send + Sync {
     /// Example: OKD Route{ host, to: backend:target_port, tls: {passthrough} };
     ///          HAProxy frontend→backend \"postgres-upstream\".
     async fn install_route(&self, config: TlsRoute) -> Result<(), String>;
+
+    /// Gets the base domain that can be used to deploy applications that will be automatically
+    /// routed to this cluster.
+    ///
+    /// For example, if we have *.apps.nationtech.io pointing to a public load balancer, then this
+    /// function would return
+    ///
+    /// ```
+    /// Some(String::new("apps.nationtech.io"))
+    /// ```
+    async fn get_wildcard_domain(&self) -> Result<Option<String>, String>;
+
+    /// Returns the port that this router exposes externally.
+    async fn get_router_port(&self) -> u16;
 }
diff --git a/harmony/src/modules/network/failover.rs b/harmony/src/modules/network/failover.rs
index 897abbd..9c99c5e 100644
--- a/harmony/src/modules/network/failover.rs
+++ b/harmony/src/modules/network/failover.rs
@@ -5,6 +5,10 @@ use crate::topology::{FailoverTopology, TlsRoute, TlsRouter};
 
 #[async_trait]
 impl<T: TlsRouter> TlsRouter for FailoverTopology<T> {
+    async fn get_wildcard_domain(&self) -> Result<Option<String>, String> {todo!()}
+
+    /// Returns the port that this router exposes externally.
+    async fn get_router_port(&self) -> u16 {todo!()}
     async fn install_route(&self, config: TlsRoute) -> Result<(), String> {
         warn!(
             "Failover topology TlsRouter capability currently defers to the primary only. Make sure to check this is OK for you. The Replica Topology WILL NOT be affected here"
diff --git a/harmony/src/modules/postgresql/capability.rs b/harmony/src/modules/postgresql/capability.rs
index a2d6a91..2de12a8 100644
--- a/harmony/src/modules/postgresql/capability.rs
+++ b/harmony/src/modules/postgresql/capability.rs
@@ -9,19 +9,19 @@ pub trait PostgreSQL: Send + Sync {
 
     /// Extracts PostgreSQL-specific replication certs (PEM format) from a deployed primary cluster.
     /// Abstracts away storage/retrieval details (e.g., secrets, files).
-    async fn get_replication_certs(&self, cluster_name: &str) -> Result<ReplicationCerts, String>;
+    async fn get_replication_certs(&self, config: &PostgreSQLConfig) -> Result<ReplicationCerts, String>;
 
     /// Gets the internal/private endpoint (e.g., k8s service FQDN:5432) for the cluster.
-    async fn get_endpoint(&self, cluster_name: &str) -> Result<PostgreSQLEndpoint, String>;
+    async fn get_endpoint(&self, config: &PostgreSQLConfig) -> Result<PostgreSQLEndpoint, String>;
 
-    /// Gets the public/externally routable endpoint if configured (e.g., OKD Route:443 for TLS passthrough).
-    /// Returns None if no public endpoint (internal-only cluster).
-    /// UNSTABLE: This is opinionated for initial multisite use cases. Networking abstraction is complex
-    /// (cf. k8s Ingress -> Gateway API evolution); may move to higher-order Networking/PostgreSQLNetworking trait.
-    async fn get_public_endpoint(
-        &self,
-        cluster_name: &str,
-    ) -> Result<Option<PostgreSQLEndpoint>, String>;
+    // /// Gets the public/externally routable endpoint if configured (e.g., OKD Route:443 for TLS passthrough).
+    // /// Returns None if no public endpoint (internal-only cluster).
+    // /// UNSTABLE: This is opinionated for initial multisite use cases. Networking abstraction is complex
+    // /// (cf. k8s Ingress -> Gateway API evolution); may move to higher-order Networking/PostgreSQLNetworking trait.
+    // async fn get_public_endpoint(
+    //     &self,
+    //     cluster_name: &str,
+    // ) -> Result<Option<PostgreSQLEndpoint>, String>;
 }
 
 #[derive(Clone, Debug, Serialize)]
@@ -34,6 +34,13 @@ pub struct PostgreSQLConfig {
     /// settings incompatible with the default CNPG behavior.
     pub namespace: String,
 }
+impl PostgreSQLConfig {
+    pub fn with_namespace(&self, namespace: &str) -> PostgreSQLConfig {
+        let mut new = self.clone();
+        new.namespace = namespace.to_string();
+        new
+    }
+}
 
 impl Default for PostgreSQLConfig {
     fn default() -> Self {
diff --git a/harmony/src/modules/postgresql/failover.rs b/harmony/src/modules/postgresql/failover.rs
index 1df5008..10fd654 100644
--- a/harmony/src/modules/postgresql/failover.rs
+++ b/harmony/src/modules/postgresql/failover.rs
@@ -3,6 +3,7 @@ use log::debug;
 use log::info;
 use std::collections::HashMap;
 
+use crate::topology::TlsRouter;
 use crate::{
     modules::postgresql::capability::{
         BootstrapConfig, BootstrapStrategy, ExternalClusterConfig, PostgreSQL,
@@ -13,7 +14,7 @@ use crate::{
 };
 
 #[async_trait]
-impl<T: PostgreSQL> PostgreSQL for FailoverTopology<T> {
+impl<T: PostgreSQL + TlsRouter> PostgreSQL for FailoverTopology<T> {
     async fn deploy(&self, config: &PostgreSQLConfig) -> Result<String, String> {
         info!(
             "Starting deployment of failover topology '{}'",
@@ -39,20 +40,19 @@ impl<T: PostgreSQL> PostgreSQL for FailoverTopology<T> {
 
         info!("Retrieving replication certificates for primary '{primary_cluster_name}'");
 
-        let certs = self
-            .primary
-            .get_replication_certs(&primary_cluster_name)
-            .await?;
+        let certs = self.primary.get_replication_certs(&primary_config).await?;
 
         info!("Replication certificates retrieved successfully");
 
         info!("Retrieving public endpoint for primary '{primary_cluster_name}");
 
-        let endpoint = self
-            .primary
-            .get_public_endpoint(&primary_cluster_name)
-            .await?
-            .ok_or_else(|| "No public endpoint configured on primary cluster".to_string())?;
+        // TODO we should be getting the public endpoint for a service by calling a method on
+        // TlsRouter capability.
+        // Something along the lines of `TlsRouter::get_hostname_for_service(...).await?;`
+        let endpoint = PostgreSQLEndpoint {
+            host: "postgrestest.sto1.nationtech.io".to_string(),
+            port: self.primary.get_router_port().await,
+        };
 
         info!(
             "Public endpoint '{}:{}' retrieved for primary",
@@ -110,18 +110,21 @@ impl<T: PostgreSQL> PostgreSQL for FailoverTopology<T> {
         Ok(primary_cluster_name)
     }
 
-    async fn get_replication_certs(&self, cluster_name: &str) -> Result<ReplicationCerts, String> {
-        self.primary.get_replication_certs(cluster_name).await
-    }
-
-    async fn get_endpoint(&self, cluster_name: &str) -> Result<PostgreSQLEndpoint, String> {
-        self.primary.get_endpoint(cluster_name).await
-    }
-
-    async fn get_public_endpoint(
+    async fn get_replication_certs(
         &self,
-        cluster_name: &str,
-    ) -> Result<Option<PostgreSQLEndpoint>, String> {
-        self.primary.get_public_endpoint(cluster_name).await
+        config: &PostgreSQLConfig,
+    ) -> Result<ReplicationCerts, String> {
+        self.primary.get_replication_certs(config).await
     }
+
+    async fn get_endpoint(&self, config: &PostgreSQLConfig) -> Result<PostgreSQLEndpoint, String> {
+        self.primary.get_endpoint(config).await
+    }
+
+    // async fn get_public_endpoint(
+    //     &self,
+    //     cluster_name: &str,
+    // ) -> Result<Option<PostgreSQLEndpoint>, String> {
+    //     self.primary.get_public_endpoint(cluster_name).await
+    // }
 }
diff --git a/harmony/src/modules/postgresql/score_public.rs b/harmony/src/modules/postgresql/score_public.rs
index 1ebba70..44298cf 100644
--- a/harmony/src/modules/postgresql/score_public.rs
+++ b/harmony/src/modules/postgresql/score_public.rs
@@ -6,9 +6,9 @@ use crate::data::Version;
 use crate::domain::topology::router::{TlsRoute, TlsRouter};
 use crate::interpret::{Interpret, InterpretError, InterpretName, InterpretStatus, Outcome};
 use crate::inventory::Inventory;
-use crate::modules::postgresql::K8sPostgreSQLScore;
+use crate::modules::postgresql::capability::{PostgreSQL, PostgreSQLConfig};
 use crate::score::Score;
-use crate::topology::{K8sclient, Topology};
+use crate::topology::Topology;
 
 /// Deploys a public PostgreSQL cluster: CNPG + TLS passthrough route for RW endpoint.
 /// For failover/multisite: exposes single-instance or small HA Postgres publicly.
@@ -23,7 +23,7 @@ use crate::topology::{K8sclient, Topology};
 #[derive(Debug, Clone, Serialize)]
 pub struct PublicPostgreSQLScore {
     /// Inner non-public Postgres cluster config.
-    pub postgres_score: K8sPostgreSQLScore,
+    pub config: PostgreSQLConfig,
     /// Public hostname for RW TLS passthrough (port 443 → cluster-rw:5432).
     pub hostname: String,
 }
@@ -31,24 +31,24 @@ pub struct PublicPostgreSQLScore {
 impl PublicPostgreSQLScore {
     pub fn new(namespace: &str, hostname: &str) -> Self {
         Self {
-            postgres_score: K8sPostgreSQLScore::new(namespace),
+            config: PostgreSQLConfig::default().with_namespace(namespace),
             hostname: hostname.to_string(),
         }
     }
 }
 
-impl<T: Topology + K8sclient + TlsRouter + Send + Sync> Score<T> for PublicPostgreSQLScore {
+impl<T: Topology + PostgreSQL + TlsRouter + Send + Sync> Score<T> for PublicPostgreSQLScore {
     fn create_interpret(&self) -> Box<dyn Interpret<T>> {
-        let rw_backend = format!("{}-rw", self.postgres_score.config.cluster_name);
+        let rw_backend = format!("{}-rw", self.config.cluster_name);
         let tls_route = TlsRoute {
-            namespace: self.postgres_score.config.namespace.clone(),
+            namespace: self.config.namespace.clone(),
             hostname: self.hostname.clone(),
             backend: rw_backend,
             target_port: 5432,
         };
 
         Box::new(PublicPostgreSQLInterpret {
-            postgres_score: self.postgres_score.clone(),
+            config: self.config.clone(),
             tls_route,
         })
     }
@@ -56,7 +56,7 @@ impl<T: Topology + K8sclient + TlsRouter + Send + Sync> Score<T> for PublicPostg
     fn name(&self) -> String {
         format!(
             "PublicPostgreSQLScore({}:{})",
-            self.postgres_score.config.namespace, self.hostname
+            self.config.namespace, self.hostname
         )
     }
 }
@@ -64,12 +64,14 @@ impl<T: Topology + K8sclient + TlsRouter + Send + Sync> Score<T> for PublicPostg
 /// Custom interpret: deploy Postgres then install public TLS route.
 #[derive(Debug, Clone)]
 struct PublicPostgreSQLInterpret {
-    postgres_score: K8sPostgreSQLScore,
+    config: PostgreSQLConfig,
     tls_route: TlsRoute,
 }
 
 #[async_trait]
-impl<T: Topology + K8sclient + TlsRouter + Send + Sync> Interpret<T> for PublicPostgreSQLInterpret {
+impl<T: Topology + PostgreSQL + TlsRouter + Send + Sync> Interpret<T>
+    for PublicPostgreSQLInterpret
+{
     fn get_name(&self) -> InterpretName {
         InterpretName::Custom("PublicPostgreSQLInterpret")
     }
@@ -82,9 +84,11 @@ impl<T: Topology + K8sclient + TlsRouter + Send + Sync> Interpret<T> for PublicP
     fn get_children(&self) -> Vec<Id> {
         todo!()
     }
-    async fn execute(&self, inventory: &Inventory, topo: &T) -> Result<Outcome, InterpretError> {
+    async fn execute(&self, _inventory: &Inventory, topo: &T) -> Result<Outcome, InterpretError> {
         // Deploy CNPG cluster first (creates -rw service)
-        self.postgres_score.interpret(inventory, topo).await?;
+        topo.deploy(&self.config)
+            .await
+            .map_err(|e| InterpretError::new(e))?;
 
         // Expose RW publicly via TLS passthrough
         topo.install_route(self.tls_route.clone())
@@ -93,7 +97,7 @@ impl<T: Topology + K8sclient + TlsRouter + Send + Sync> Interpret<T> for PublicP
 
         Ok(Outcome::success(format!(
             "Public CNPG cluster '{}' deployed with TLS passthrough route '{}'",
-            self.postgres_score.config.cluster_name.clone(),
+            self.config.cluster_name.clone(),
             self.tls_route.hostname
         )))
     }
-- 
2.39.5


From ef307081d8d1dcead9e8b972078ae0538fc2908b Mon Sep 17 00:00:00 2001
From: Jean-Gabriel Gill-Couture <jg@nationtech.io>
Date: Mon, 22 Dec 2025 09:54:27 -0500
Subject: [PATCH 17/20] chore: slight refactor of postgres public score

---
 .../src/modules/postgresql/score_public.rs    | 29 ++++++++++---------
 1 file changed, 15 insertions(+), 14 deletions(-)

diff --git a/harmony/src/modules/postgresql/score_public.rs b/harmony/src/modules/postgresql/score_public.rs
index 44298cf..66cf1a9 100644
--- a/harmony/src/modules/postgresql/score_public.rs
+++ b/harmony/src/modules/postgresql/score_public.rs
@@ -37,7 +37,7 @@ impl PublicPostgreSQLScore {
     }
 }
 
-impl<T: Topology + PostgreSQL + TlsRouter + Send + Sync> Score<T> for PublicPostgreSQLScore {
+impl<T: Topology + PostgreSQL + TlsRouter> Score<T> for PublicPostgreSQLScore {
     fn create_interpret(&self) -> Box<dyn Interpret<T>> {
         let rw_backend = format!("{}-rw", self.config.cluster_name);
         let tls_route = TlsRoute {
@@ -69,21 +69,9 @@ struct PublicPostgreSQLInterpret {
 }
 
 #[async_trait]
-impl<T: Topology + PostgreSQL + TlsRouter + Send + Sync> Interpret<T>
+impl<T: Topology + PostgreSQL + TlsRouter> Interpret<T>
     for PublicPostgreSQLInterpret
 {
-    fn get_name(&self) -> InterpretName {
-        InterpretName::Custom("PublicPostgreSQLInterpret")
-    }
-    fn get_version(&self) -> Version {
-        todo!()
-    }
-    fn get_status(&self) -> InterpretStatus {
-        todo!()
-    }
-    fn get_children(&self) -> Vec<Id> {
-        todo!()
-    }
     async fn execute(&self, _inventory: &Inventory, topo: &T) -> Result<Outcome, InterpretError> {
         // Deploy CNPG cluster first (creates -rw service)
         topo.deploy(&self.config)
@@ -101,4 +89,17 @@ impl<T: Topology + PostgreSQL + TlsRouter + Send + Sync> Interpret<T>
             self.tls_route.hostname
         )))
     }
+
+    fn get_name(&self) -> InterpretName {
+        InterpretName::Custom("PublicPostgreSQLInterpret")
+    }
+    fn get_version(&self) -> Version {
+        todo!()
+    }
+    fn get_status(&self) -> InterpretStatus {
+        todo!()
+    }
+    fn get_children(&self) -> Vec<Id> {
+        todo!()
+    }
 }
-- 
2.39.5


From 4d535e192da3eb7038d267c54e75e0bd7c318f7f Mon Sep 17 00:00:00 2001
From: Jean-Gabriel Gill-Couture <jg@nationtech.io>
Date: Mon, 22 Dec 2025 16:02:10 -0500
Subject: [PATCH 18/20] feat: Add new nats example

---
 examples/nats/Cargo.toml  | 18 ++++++++++++
 examples/nats/src/main.rs | 61 +++++++++++++++++++++++++++++++++++++++
 2 files changed, 79 insertions(+)
 create mode 100644 examples/nats/Cargo.toml
 create mode 100644 examples/nats/src/main.rs

diff --git a/examples/nats/Cargo.toml b/examples/nats/Cargo.toml
new file mode 100644
index 0000000..2d2dcec
--- /dev/null
+++ b/examples/nats/Cargo.toml
@@ -0,0 +1,18 @@
+[package]
+name = "example-nats"
+edition = "2024"
+version.workspace = true
+readme.workspace = true
+license.workspace = true
+publish = false
+
+[dependencies]
+harmony = { path = "../../harmony" }
+harmony_cli = { path = "../../harmony_cli" }
+harmony_types = { path = "../../harmony_types" }
+cidr = { workspace = true }
+tokio = { workspace = true }
+harmony_macros = { path = "../../harmony_macros" }
+log = { workspace = true }
+env_logger = { workspace = true }
+url = { workspace = true }
diff --git a/examples/nats/src/main.rs b/examples/nats/src/main.rs
new file mode 100644
index 0000000..a3e50d3
--- /dev/null
+++ b/examples/nats/src/main.rs
@@ -0,0 +1,61 @@
+use std::str::FromStr;
+
+use harmony::{
+    inventory::Inventory,
+    modules::helm::chart::{HelmChartScore, HelmRepository, NonBlankString},
+    topology::K8sAnywhereTopology,
+};
+use harmony_macros::hurl;
+use log::info;
+
+#[tokio::main]
+async fn main() {
+    // env_logger::init();
+    let values_yaml = Some(
+        r#"config:
+  cluster:
+    enabled: true
+    replicas: 3
+  jetstream:
+    enabled: true
+    fileStorage:
+      enabled: true
+      size: 10Gi
+      storageDirectory: /data/jetstream
+  leafnodes:
+    enabled: false
+    # port: 7422
+  gateway:
+    enabled: false
+    # name: my-gateway
+    # port: 7522"#
+            .to_string(),
+    );
+    let namespace = "nats";
+    let nats = HelmChartScore {
+        namespace: Some(NonBlankString::from_str(namespace).unwrap()),
+        release_name: NonBlankString::from_str("nats").unwrap(),
+        chart_name: NonBlankString::from_str("nats/nats").unwrap(),
+        chart_version: None,
+        values_overrides: None,
+        values_yaml,
+        create_namespace: true,
+        install_only: true,
+        repository: Some(HelmRepository::new(
+            "nats".to_string(),
+            hurl!("https://nats-io.github.io/k8s/helm/charts/"),
+            true,
+        )),
+    };
+
+    harmony_cli::run(
+        Inventory::autoload(),
+        K8sAnywhereTopology::from_env(),
+        vec![Box::new(nats)],
+        None,
+    )
+    .await
+    .unwrap();
+
+    info!("Enjoy! You can test your nats cluster by running : `kubectl exec -n {namespace} -it deployment/nats-box -- nats pub test hi`");
+}
-- 
2.39.5


From 457d3d45466f6f7286d9292779fff9af480c61ee Mon Sep 17 00:00:00 2001
From: wjro <wrolleman@nationtech.io>
Date: Tue, 6 Jan 2026 13:06:59 -0500
Subject: [PATCH 19/20] fix tests, cargo fmt, introduced crate serial_test to
 allow sequential testing env sensitive tests

---
 Cargo.lock                                    |  87 ++++++++++++++++++
 examples/nats/src/main.rs                     |   4 +-
 harmony/Cargo.toml                            |   1 +
 .../k8s_anywhere/.k8s_anywhere.rs.swp         | Bin 0 -> 65536 bytes
 .../topology/k8s_anywhere/k8s_anywhere.rs     |   9 ++
 .../domain/topology/k8s_anywhere/postgres.rs  |   5 +-
 harmony/src/domain/topology/router.rs         |   7 +-
 harmony/src/modules/network/failover.rs       |   8 +-
 harmony/src/modules/network/tls_router.rs     |   1 +
 harmony/src/modules/postgresql/capability.rs  |   5 +-
 .../src/modules/postgresql/score_public.rs    |   4 +-
 11 files changed, 118 insertions(+), 13 deletions(-)
 create mode 100644 harmony/src/domain/topology/k8s_anywhere/.k8s_anywhere.rs.swp

diff --git a/Cargo.lock b/Cargo.lock
index ac4598b..f3befcc 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1809,6 +1809,21 @@ dependencies = [
  "url",
 ]
 
+[[package]]
+name = "example-nats"
+version = "0.1.0"
+dependencies = [
+ "cidr",
+ "env_logger",
+ "harmony",
+ "harmony_cli",
+ "harmony_macros",
+ "harmony_types",
+ "log",
+ "tokio",
+ "url",
+]
+
 [[package]]
 name = "example-ntfy"
 version = "0.1.0"
@@ -1883,6 +1898,36 @@ dependencies = [
  "url",
 ]
 
+[[package]]
+name = "example-postgresql"
+version = "0.1.0"
+dependencies = [
+ "cidr",
+ "env_logger",
+ "harmony",
+ "harmony_cli",
+ "harmony_macros",
+ "harmony_types",
+ "log",
+ "tokio",
+ "url",
+]
+
+[[package]]
+name = "example-public-postgres"
+version = "0.1.0"
+dependencies = [
+ "cidr",
+ "env_logger",
+ "harmony",
+ "harmony_cli",
+ "harmony_macros",
+ "harmony_types",
+ "log",
+ "tokio",
+ "url",
+]
+
 [[package]]
 name = "example-pxe"
 version = "0.1.0"
@@ -2435,6 +2480,7 @@ dependencies = [
  "serde_json",
  "serde_with",
  "serde_yaml",
+ "serial_test",
  "similar",
  "sqlx",
  "strum 0.27.2",
@@ -5116,6 +5162,15 @@ dependencies = [
  "winapi-util",
 ]
 
+[[package]]
+name = "scc"
+version = "2.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "46e6f046b7fef48e2660c57ed794263155d713de679057f2d0c169bfc6e756cc"
+dependencies = [
+ "sdd",
+]
+
 [[package]]
 name = "schannel"
 version = "0.1.27"
@@ -5200,6 +5255,12 @@ dependencies = [
  "untrusted",
 ]
 
+[[package]]
+name = "sdd"
+version = "3.0.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "490dcfcbfef26be6800d11870ff2df8774fa6e86d047e3e8c8a76b25655e41ca"
+
 [[package]]
 name = "sec1"
 version = "0.7.3"
@@ -5437,6 +5498,32 @@ dependencies = [
  "unsafe-libyaml",
 ]
 
+[[package]]
+name = "serial_test"
+version = "3.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0d0b343e184fc3b7bb44dff0705fffcf4b3756ba6aff420dddd8b24ca145e555"
+dependencies = [
+ "futures-executor",
+ "futures-util",
+ "log",
+ "once_cell",
+ "parking_lot",
+ "scc",
+ "serial_test_derive",
+]
+
+[[package]]
+name = "serial_test_derive"
+version = "3.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6f50427f258fb77356e4cd4aa0e87e2bd2c66dbcee41dc405282cae2bfc26c83"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.106",
+]
+
 [[package]]
 name = "sha1"
 version = "0.10.6"
diff --git a/examples/nats/src/main.rs b/examples/nats/src/main.rs
index a3e50d3..ca0d7d5 100644
--- a/examples/nats/src/main.rs
+++ b/examples/nats/src/main.rs
@@ -57,5 +57,7 @@ async fn main() {
     .await
     .unwrap();
 
-    info!("Enjoy! You can test your nats cluster by running : `kubectl exec -n {namespace} -it deployment/nats-box -- nats pub test hi`");
+    info!(
+        "Enjoy! You can test your nats cluster by running : `kubectl exec -n {namespace} -it deployment/nats-box -- nats pub test hi`"
+    );
 }
diff --git a/harmony/Cargo.toml b/harmony/Cargo.toml
index 634cbe9..9086e84 100644
--- a/harmony/Cargo.toml
+++ b/harmony/Cargo.toml
@@ -79,6 +79,7 @@ sqlx.workspace = true
 inquire.workspace = true
 brocade = { path = "../brocade" }
 option-ext = "0.2.0"
+serial_test = "3.3.1"
 
 [dev-dependencies]
 pretty_assertions.workspace = true
diff --git a/harmony/src/domain/topology/k8s_anywhere/.k8s_anywhere.rs.swp b/harmony/src/domain/topology/k8s_anywhere/.k8s_anywhere.rs.swp
new file mode 100644
index 0000000000000000000000000000000000000000..ff072bdf30904b956fa1e5a335c27ce06a755416
GIT binary patch
literal 65536
zcmeI537A|*b?+OD%@S-d%S(VHzHWm&g3*j*8QZii8F?hzLY7BQBiR^XTCJWtGwtc=
z9(VVQJeGt>SQ3&vc1VKRmjpsW*i68|d~A=M1QN4vNeKDEzOUiI`~7RVx9;uRGb3XH
zyf^*nukN`^EvHUZopb8csY4sD*tt7;*vO_5pL>={kJxl|<K+){T<LA)JC+VNn$37l
zH<tg{=QdorXTzf|YPV+xKKxkw;OO>tePJ$c^}3@owa#3-wUm5!JN41Y_FS#e8tt{`
z+s*d$(&+4Y-D<71ba*E2#F;-vI^BU;t=(9oz#0WY3M}-dHk^0z{>^7?+NjHCluwWD
zeXsrD6KlWMD6mF>H43azV2uK66j-Cc8U@xUuttIZ$0^X8Kc#d7b-bgi=c4<*L+<+|
z_jl8MAI{ysbMF2Za`*4z{`TgCahHM5=dSL4?7rWUyMH%#ea3yC?h5SR{|$HjD);^5
z-2J<|>-*gIzvb?q?5;o3eV=oJ{o&I;#a*9t-%rWizlXbCbKl?2-9OP?Khu3r+{ym%
z>AOEmWA6U-x%)1;(qr8Hx8&}-%WGe26j-Cc8U@xUuttG33an9JjRI>FSfjui1=c9A
zMu9>K)F!R&|7|Ivtp9uc|FtNzuK~{hbx;9iaCh)Al;M8{&jyD<4O|R%fb+op!H-d>
z{{?&myc!$<F*pT$8D;!+;F;hN;9Dr~uLOI*7I1g)b`<_6fC;c2JPe!+et@CiZ@`t{
zGOz<|20y{T@FVa;@bBQMU=Cab)`JIt?_;F+IJgDG;89=#>;dE8T<{=pSMY5N9-jrD
z2A=}&051Z6432^}m;+6)4~&6_f(L;!KpET(d<n(>&EN^(5^x4M9Yo+%@So`MF9$ua
z7n}%wjI#eD@NsYxh{2=4Rp2~u7T5?zK?Ht)E#p<-M(}L#EN}%_4^9L>qHVteOdInG
zpJV2K{W|;X&B^c4(P-cJ_VH+;wE@qJ$$EP-j(RhVZd6%so~d=0TJ>nE6-~#zYNx%>
zi#yf%cBePAt{XR})<+w*MhlzHiH?|uM@emO+*|0hx+D@udXOJA{YR4a^(ek>zTJ(x
ze3MwK)@&|~<V)CVPqt4VDkuT&B$IW@S+y=BK`Hje-GyfFg7NuYqush-qStA(rne49
z?gs^I%*{8Wea-G(Q;BG*-HCRc*WKpaO!hh76COO{fT?t~*QqsnSC>kba4Gr5XNS7I
zS}z`{HygOL@YQa`L+jVuN<iP}*!hMW`l-+5+>f?wjXH)j(T+}Ms7%(8eLrfn8ofrX
z*|<KQj1DdIqIhn;w^SbKwX0oI3z8l#nS|Vb6YaU!7Gb@THHAr^XvRHzDcTav)q3?A
z_t%l*E}uy_YPEZrA}+<f+qH18(TE&=EKOmvq4kcP65i8oORW9|-`1&L05Qi*Tl6<L
zw;Y*|x54Y})>LD<61faKql}r$TP?j+u*rs+iH3vk?9=0|dOQ|4n-}a_I0T2sy|}wQ
zcxbD8xfi!;tzLDm)~Zd%o&2lkb@!S3yX|fNl5#YZ%02J+p6X7BH@E8f`GrHYeP^NG
z8_4OCai_5u4~>b1hokNBp@r%73CpYamI}7Em$mD)=B~|?!=<>jFsC#p+6$d}Z2F8#
z$s{oxnFQ06w#QR7dZ$fh*XHiUwYf%f$^JP$AGf+Qjj5i$sAAg;3dy%}ZgX+B3rQ=k
z^V@8?rl^&))b_Gvj--`68<kSJ8G449_7ThW_G30d_0iy`{)A+g$GyYt&g`Ccvr%7~
zU}WjV(@VqApv&#{eDST4($fd7Qi6=dO0iP01F-JEA(aYklVP8<Z1%F{;^C;^p`Kwo
zpJE#h?#7+P+M!0X(IX?A_Zq#nM%PMZTQlzT_Qv%X9_rXEeD0Qz_S&9KJYS>Abdd3d
zUY*g4jNN!^pV%JHH`_~c5ZqVmFa!)om&VPxvGyFDV{%w+X4`2v+6@~u>_bTsQIG+H
zYn!4hbmOSIFi*FtxG#o3H!OQML#pVf1IptkhG7P~=?)xJsqC~rTx)jg?M_^&Oz6v&
zI%wwLr`lk?LnWC37f5AK@_Tney5XoZ(>_$KiGE~Pb!qRtbo?SiQ?3R1C`EmsZ8c4~
z?`^1*<~6o=`+$_v6nq;i?e^?srD7)NN@aZ4cF3`(*6sFYxHLVJD@(4jxj&VfIHpmL
ztBzTqn!VsCV9BQk{U;@d8xE^(_^pU0<A(wk?0-3}QMFBz*I>^|rQl+92Bxakk#l;M
z;{8e05iQa;W18=>+M&2P5jW#H$@afcP<hqql1^=kfqQ$cSF;1pL|k9!#E<B<Te>z}
z@W6arPcBdBkCG=&_}!PV@5y~PlDw8rr#o|~jX;%_G%3XPn!9I8(_i9c3mDb9{tZ|$
zNs}&}{7%yEPe{!$ZAln1sV9VPo4%807P8utbhm7>vrHyI(^e`Zl21F$GWq4mIvk02
zDiy;)$xZj8kFNrz2#3qu7@dqWN9eh3tg$^U+EeSz>|2_TgM?-`Q`}vfx9@B*{WqIt
zG!6RYTzhh%DSow?G+K)crtJ;`_D=uP(xcHr>Yhgw)gAX!Q`|z=-jA<?Q+bo5cDSFx
zm|EA&rA*8S+iTA@+KjNM2#gv|>N(#IzHw(#qb2f%5pC^Nyt{dMQeuY2*{Sw$bhy@O
zF)(YuRufe!wfP3mY+q_2Bh<$aT|>tc%d{8fuV5--4%yYvoM7+lj(auUb|ZV|P>q5t
zZsPs1=0ca+?QJ*Xi+CPd4@dfAZ#;!kuwasP)V1Tf-lCI27(07tuw^u9nc~<onL;}M
z^=gmifkvIF`ld~1ZLU=I+8>wK=3-l$L$z*v&e;@YM{Bwv=_)qgmCAJ7VvuT9=NCFs
zgk0qVodX((q*ehr-;%o96SvmexaZe3k&^XA`#N#FyEZ?p>85UGtYpTtO@in;9Q7J=
zP<8u)oq)+r`u{u84JXherT_c&<)5MFe+S$Q{v133>;V^nlfd7j<G&m{2gnX^19$+C
z?*B1#{AYtFgU5s42a8}U_#JQ;a4UNMyTLS=0(-z$(fhvwUITs~On^(kHt=w8Huxbn
zfRBTBfE&QI;Qru#-~{kOYymF-6X0IpBv1lBL;wE{cm?<a&;g_1bnrd&{TG85fj<K4
zfb0OW0lWfCg9Bhckgk6zI2n8v{r%6u7H}>&2Rs;jA07U!Ksx;)a3#0`YzO}ioxcG7
z5&R{X0tdi;pf=bG);_=16v&$h)?1ap&sRoaFHc$}Xq3TZL$}x7B!dgn!_tPi`efxC
zj54EU0IW^UHCknB`|t_Wr>2dLj8N3WY%)?q?PPDv)KFj<KwLwbtj5=#K9p+uN`ToV
ztGqI5#dGamT-6vi#e7+fTZ`4jTBmxr(VNjEIn`*!L+h*vrW?c2I(Jon1+|m0fx<;w
z(kz3!%3a2f>`ZK_;i|Ib_^6Vmq@0Js5{3oD^wGuGGVd$a9V)3Tn6c2sv11LWzAIC8
zHeO1M5N90FE9k^ZAT<L0qKSGORWlSebatd)shV?*ZkGu$sA6}fz0gGRt+g8UA?$O^
zF&Lw^MCIM~QA}6YE;Kq^gHs|{pp0%Wf()R}u^bZwytxc3N0u`VDftx=NGua!S8(r-
z&UYGfwa(J$JW^C&N|-43*!z+0N4DxwuQrRlvV$%=86(J~?5tYq^NVb7rC-pKbXlJq
zD_bgQtg!6AB~#&H-?0oCF)`5pa>QJr>y%8U?!T1d{Z%80zy`>Dn1ta4jG6l{+A%hM
z`NcagDGx{G(JACpB(Yi70NJr{q1CNT$z<fy>nyaY4gPi82(|H~y6n)=qwax~SUIIa
zwbicrjH`_)jbe+9$#^p0^1_b%%Vkwx;*?htx_J8hk{E9VCMjmhm3i;iho5}Y+<pvH
z*ctOfW74e)pJw#h-<oZ;54T3=YE4YqbBxK2=@vFAbRsvGviQ<A{r*>G6uV8#lvHrI
z)!s791XOF5*B4S{Ii}KFzZmz8Q@J7W_8pbX3J!*S*Fd))2NleAKlf}o)ozc>*3CTm
zt1|ZF8b>2xzZj{jb}D4?(sYR}hnlr$*q9OA%ovT@+C|B%7(uTHHY(|L|2a<fEcy5J
z{j0`%juw((F(5SN`k7Dq|JmrWk3`><{y*kauMeT)zX?1M90rSEC%7*tfe)hRzZJXz
zydFFq{4w|=@KA6nxHI@ybp20*zXeO63p!v5JPe!){vO@`X7CDdDYyjO8N45T|Jh(3
z>;@6IKe!(_8GICd{|LAq%z(RqJA?P2?>`ST!4!zWRp5c(1n_lq{+q#HgZ*G1*a|)c
z4L%881+D>)0fsKW*6Qe5;nygzMu9a7tWn^<lLA?3;J;6=Ohn?6N)Uej|4|)(8B%_`
z)m+jtwJfszQkL2wl?`)Ro?k?AHcN~qlks9X5PNga&tj-`IVG*_8#@1JqCgfX3r-yF
z7xsUVoFeHuXCppNfxF-0<&~BUHC8efnFdQOMyqSH(}zx%$&&TSYIlhx#kp#lLSKWq
zhifdLHtag>phuKmQ~p#{7Iym{GFE(L+s`O6Vu@{5$1MdskXIOg9r;JRzoJ#t@<^ij
zIeVz(rId;R?N{K+l5$;%$EFsV&6OBy2B)TGJaP>@GPHign%jrU`)FAFWIJ(f63aA(
z_}O?eY-E+rzNys>EeG3&vBS>S4!4G;TuoBT>cy4l;+B@>DbPcriMTb%*O|Bv^cv2)
z#6(#0^(rvLUU2c&p(#?at5L?i7fVT0Gs`F};Pb0%eY@l}Y>JNQskYc|PzTnkaf)nB
zb4R9ivqY`+gGQ&_lB?H9eobZInn!BKN=H;RM)ogVNsZINj4)vB%A^p*O*{`$n(3lG
zX+qx09i}oIEe3p}=NnVTf^WEM5w~1bSgU9lo|+5Fproh#XSD^lW{ljLn-V#89OX_E
zvBj4D{~C1SN%Usv|7SWO>22uvF92HikHJ>(Y4myN{I`IkU=#Q-`uok`72vr*YyOA8
zeZfiKC+P9t2j2zX0sjF$1>Osu1)d461XqCXqto96v=883;IowJrQjvt=^zFw=kI_o
zQ|8ZrPlH#3>w)zAP2dc0Kk!@N`{?!G1m6J91&g2wE(Q+=_W_?n&;JC_-hdB)7l1_&
zfz!ar;BT;z{56oj|0wt|>---DuLDm6H-N{24yb^CVXgo3;6q>zG{G>q1NaDQ{2u`C
z2X6&W1~WkG|EGad!Oi&XzZtv~TnM&;dxC$&S3~|9w}6sqeDlBgmE*$vSe}XvtC$Fs
zU_OCFm`EntByT;g&o5GRQ2GVpgTFj*!02E9wZp!Xp|-fWpkQrml|3_D^2)Wr?Q2S2
z6EbhJBf<*P`Dz7-+?vBm0>GM($>x;unve+*)`ZNGM(Q;o^EiaHRBXiQ>epDvRKxpE
zpKP2+q*gTc&m}Ww$zRbB9#Dj7T}$4z-sz}IJ0|v3_v{_Nc;{t1sz;9Dc+v><Xd^Y4
zty+?v`(C_a+ui{$p}A~{OyXnX`!C<OWADgR%qF^OZE|vG6K==2HQUWE6Y;fU-JYBL
znH6&SXjsQe<hEz6V_Ok>)Y2+Jfb31PqjHEHLdIj+e*67!`R$c>NVAQyJ!KTE!Lksh
zhRG2_QYA1E_t<)wYGLx`YSa$lJ08jVkG0gswJ0n$?L?WQHtb*M;2O0Q;S#pM(}&oB
z6vx)1t~+8SQ>$BM$j8>IUK>yD{arRVLfYW3N~IMa9@+>AP3hzUZqzR8yv#NZUc>1*
zcq661^Y}LJ*nK_^KEH$$ywOa%=v!wTz<x5MAvoQJmI`<2FR>bXH}w^M%44;bc0RHh
zDYAP_E09KXl5@o*d;09II!cV!Qf5PBc5PX^J@fmMY{g4Hzd~g$TS7hBe`WAh-H~*w
z{h@<PP#%-ppV{F#g_FFiXr?mxy{Agpe~e6RiDNdRvN1O4o=3D}hb=(IMvmAgj$w4n
zQpP7^H>o!2Ba`fmIZzfs7rN!E50veT<*TK;&~c1erR3kre;-?aVb;+s|3GmglrOHK
zrNcJu$n^7Qr`_~5hF!NKZ~IP`90T(onXBP$N@E|bdgrx#3H0|!?J&EF2d2``h+!h@
zrWa?6Y3QG_YL50Tm@SnX7)7*~ZG+zzCC>-x|M=^ged5ypn@<0~34Q-Yptb)=aDQ+=
za7XYy^!^utOTh*pzyB|y>wgg31pX3S0{#y={nx-3z-Pgyfpq^5fR};Cf;N!v|8Ie>
zq4U2HJQ<9GGr*70^}hk$1fB<O1X}Mu7n}jK-v3SX{5OFXcoa}vfL%aw0e%yF2p#{m
z;HBWtz%#%FAOfcW#RbqFfLBY;2af|+f{j4?03HawhtB_9@K$gO_!Dq07y>^<-~TZ9
zTktp_8^G1z(O@I^9y<Sb!E?c%gM;8~a4PsRy8b)B-+?!R=Ym~8@dqCYehd5zz5i|C
zCh!Ju6dVDM0w)3O@xK$e?H|uE`qozdkwXjYt!JCH**C*h|7Lv1Zk!qF)~cEgSfy}x
zH>A6oHY_&c!%V)dZlDI6$=4<nq!T)cn=L@h;_SD<8i|e2ZKYyQyvbj$MJ|6CK}){4
zK`u$jS%2x&>OGE(n8XVd`9OQ=t87k+TiP$KJw5A37FvfpwRsm)z^7KeD6VzlP9*su
z$wH+!F9%XXS^&LjJ8^Ej88HzOV!Pe1dJQ}MtnF{eq*b-$aD+776q4ar@2=Cc)4s0~
z*y|L*?tD!P;ATEwg;^S@5|t-RH8W#XS|dHn4qa`Y;?c!T%RDx%jaED~;E}XsRZ2|h
z@*A@PQ>rcaNNs+;xkNkEY>PNT3|rqVXs|w^X35vd<dS`!tO730C00b@glP?DW|Hn}
z5E3st2HeoCZ7}yY*aj%4lZq>qx<dFu`XbLJ`KT&M#q@{&q^<0)7-sPMvnmy{A%o1j
zLz_1iO__Fxce&<0*_38d6<@N+WOsGI<$7{Nb5V7n)oV1_PvW;=vpu3Vxny@t=qbm5
z`l-+8s0kRtHrm#-ixna<5t*{f4p(*x@Nz_Ojjq`Ot-g(<$W}b0)LJXLhVIS7+LT5d
zj*>}{|FXQ|3cezbxaYFG;Vurfy7aE5cJGGchZ@ml=HD`Ft0sB`i!o+)reh}s%k?%R
zt5jLC(X48=;nA_`rysaF+u7`6Ci8A3GT%N-Ncy0PVs6nT?Dk@cbXmCFn9h_G#3sV3
zBAa}M%9DO?Za3Relg7_n&J$pcC?h64GW5F$txTGKlEt31Z@9jYgynEcoPMWne{7CG
z<VrUF2iMHL(ydey1_-3v9LbBtUfWV>=Ts8@Gm<M<vMYQj*%s?q%XbxI(~^JNf4gWc
z8g(-FBu-b2yc@KRUg|Gs-Uq}djrxGp31^fqZZ9Brdp>6Sa#yQrZW7G2Vahi?6<0u{
z?trF_&g^AfsB2HCqpp94hke=oB`bcrB2?KGoqMH-(gWu@D<=fgn@_iIe)Bh!VgDqj
zzEQ+`Dzv$m9fZ3hE;*W>$QlwVh$__XOgom<YdN-Z^X4UXm-#ZJ4ku1Vvf659&q1XL
zgZiWmstS2>tT?Oc;gtrkMA%9DhZnfqDDAR~QoX=FYRnHVlu|!e4fjRb@V!?APC8d5
zT9?~&uG=PHl&y3!g4ojd0VM6GHdvEuo1Y_8Q?^SM&8ForGLO-Oi5H@{Rp^97Ix=|^
z48ugmKu$Ele%h4_kCjWRlmF~uovc65kM`@kP&d)hXwWk*HjdZSy#`(KY3n;%4_%=n
zE98`ZhM!~t3oq)o=@@3;|4`aEm5SM^z%EiFT=gf{pRdv~#7Nm!m;6WlzY+y|;qg-F
zESXKFL*}&+Z4AQ`fh}KCX@ILl!(V@4f4artNOGgpAnJ~LRoF%s5|!<IqY~Sp&$cO-
zOTHHRPWActXliv#4JI-SAv#3nZ5RG2Iugswkyi}*Rem#mO7IBZ4s;WBa#t)X_nM+5
z-Nw&vhN5=bC87-S6twq&Y{H(b2DYX|)n58PYJceyT2Bu2|97G1zY{zSJQd7=32;yF
zBlP{xgIj^(0LtgT3dX@%;C|plpcsHZ0&f7X2fqi-0S^Ut1Rq1^e+GCuSOW6<KO1}p
zz5m<bec%tlF>n|xfF6iJ8QcMU8~y*E!0W&@;4Gjx0Cxl*K=+qj;07=QykCI)0bT^2
z4HPHvDIf+{fOEkA0P+cV4tO>=0xkq!N7sKZxEVYRoCod&?gZoy@Llk2@GbCf;6`vg
zm<5XcHv~S5&aZfXiuLzD!S4e30lWgd06ZT&9!U4UFZeNf{a3*!!E3?u!Slcq!32>0
zueSTR+AsKo-0OcQk_OD7z)K@8HdcQx%LM~LfY?7awqs&KJ?3~t440V^l58LI*<0gY
zUl&B0CazOo7c?Cwox@bAU>r;4o1)Rn4umC72YvSsZ`$sw&{Zz<N%(M=F)Hr#3+;Nw
z^j>c$X@{|ik{K+BG*guV+^Cy?EjH{>s#>X^ySlr6Uh;*=4!x<YH{V7-6SZ=d5I@0B
z%r@rdrFHE|0^vksdzqXey$c%?O=93jXLI|&6Cq$EbT?zsCdn$=vL&4P$1N{aDwh+d
zENnDYCwR$f>~4-<o?b(i-l+m6GK53e@d_hJ(<aL+SH$%TE^1$Q!Q@gaGNG}2;Ia$)
zLQD}o&&B9dF%mv2mTPRux!0FW+R2J!A3un*802Dw4Oy`#Z8#S$i`FbC<LxFEWjReX
zUYXnU)a}i2O0&P29hYV1Z9Vz(mU_Ec!a>SQ=^vqsu%6~Zh;bvPZ58~|D`c4tGN`zT
z;-yt0tL9bl*UMDE4vJ}431pAu`cPWbWT3g-I}U=G4;@t~#wYAPAl6n9tGgkfsQ6as
zN*nW7c9c#?SngVV7XMmSAnjn5YrOW{JS$$DF+4z-TlFlKmPT!?PevFFc+^-htmPyQ
zb-O+p&?M3?2inWVK<Z5D&M*NL&HN*I8u#9MoRjr)HaV1r$R!|lbuYUmI3I;?q=6MK
zyND)cTS=L8((KPO7&BwJiFOsEafYw5Bk?bSH;-=^&KB<H8G;A#`Obv5y^fCDMw~E0
z#olJdE{V_l=jZ0-0?{gv%2uIWdRqtc8bd56di$b@9dkFa4Fz`p+)Zq}PGU%fL_aI_
ztt`3RLK(-hzF(n8Y^tsg4qlr`o-8h1ayzg=CpO+dY#UhABmvDxndPr+iDgl5+c0%z
zxwonnbh`kxY#o9!i1h2sf=4Q?*lRZJg-$bfBWtqG-o)l!(%b%1wk6c^vs;i(R}O=<
z2(|k%bs0ouU)Q0OgK{-fITB-7$(PE17cjEnH7(>>-vfO33>h}y64PnKo#KjQyK;G^
z*PHKFMo0S>6%&$Dqr}dW6l)oF@HJh5AA-eGw{}{@2GajgK}#QY`v08MA-{^A|8k(%
z|NFo_z=_~z==DDZ9|i9QF9DASyTJKCd;d2B*#Yhf-ie<7W^f}=Ou#3C8^AGe6x6^r
za26<m_o4qk4NQQYU<_OYP69tb-~Zp>DPTVs1rGwJf!_r;qw~v0pa<k1@I!R|9{}xd
z*bg2KE(F^D|159=cq}*owEtiJ0G~(C{}A|nPys{WOmH{w5%hem`#%Cm_t*OWzoXN?
z0w@mPlYrL$wHIJLxEuH(#Qhw28khmoAOfd>Z=m0Q9efNt16&6Vfky+y1e6V69k?UV
zd4(SauLFwl-vJK<Kcn5g2~7JzLeI|n*19>fEqiwM+F+M~s;&D$KvDgv&&Y_gKvpU)
zeoSD9vX2mM+Sv7sUEecq`N%P|_`ks~(@PDvVSj7&I_nxev)G+Cx}xjUG)y50m>`^r
z;29KhtS@e-yJ_T)fp=9-Vq#)s?gc@5gZ^O3lD}V6-uyFxJgdOuIQk8Cl(21)ijRg~
z^=4da#go}VA`}+Wxl6SeQP2)z$KZ1qcZZJFE0F>gAC2lGjc)bu3^JUN2a)3ll2w;x
ze&(Y$o|&d@MLLtE#?6#HbVI9o))45{nHPFf=M5cNBGL6D?b#ujE=wwfK6=62;-y^7
zQmjM!wq3q`+urRXlSCn#jNJ<Sp>xjePe*Bu$Tx$1V6CB}i$|ly5%1B}XDe-Ys@jpI
z2w-*r-gt${;-W>*Uaic8pCmPTG@7)x%nXL<HKl{e)x75Jm2|~_OsXaSmzjU$E>fie
zqMC80Ft=&%72Hdj1eCQez&e?*wT5N02U2)zNy;NCL%~Fp(}VO>s+A8icDs&TFbT@q
zj=N22z9uvp%l=bK1C}L*qXmTs<U{}yxIZI<s4V(q>tL^~rj*H|NI^N3iYu#K8ZE9W
zA@$wDN+{0xB4E05i*_T^_&509_^_gnx4J{++0EUucdGR-=^OW0V)aM*Kj=9AiQ8J=
z+!DmkQR`evMRiXXH+-@6O`lmBIy!wcnjX<e&fvkgQAQtEbmfsmIvZ)UbAd;FBCN0C
z7t}4786Y+*6?I~4b(Tv0asLfLRptpD?*Lg@$w`M7|I9$g&0;+}nSN4U)>4dya(ql&
zTUU%nSCrS9m8JT+dy1a!<Y`HKgk`mfc!u%rAQ^=zu+-ds74QU%w(Z%80whYWPy_$Q
zQd)=P(rU{sO01;(C&F`fl2X;ZxVo>iq>&=^iq5Z!<=NDj&l%^nFsQR{hU~gl67x}s
z8#z3`KvvQnO~T1SnA$D>RKFX_y5d2kcs1K(l6Lj<mom3b{pPd~YxS`ga*oaU5(Uru
zAnDHACikK}dLwfpjD2wV*OZ@eLtj-!6F9UunaT+?ChD)PiQ7eBj!DS|4K|aRd-wQg
zw5vb<un#)iceK&38|l)D=p-yh9&^%EP-}lsi6(!`PbpW0Ctamu_e4blS|)(L6KgY@
zsd&al*S}z5t6v7j(BLj|q|iiYwVNPD|11h2f&Fzz%2vDDFyS9x#+bEislzOSA=@ny
z6?ZcAC4E+FYd+4UmE*BDmrOz2fAZ~$I~}udsoz0;49%RWx6=vb_q>Kvpkr0NcSmu8
zes$C>&gK(T;rf<mFCQP@v&`D8mgaJ!i;_9!{QpsjOE)?FKX&^6+tKx(4W_`AU;~ie
z{{iqqa6M=Mt@~dE9tq9?XM($f|3sJ9IRNhh()$(r?|g7F(AxhUz&Fw9KLnl+t_9n`
zZ-bM;+tKG=1fBz)2A&F9pbB<@hk;YUPto(g1U?8}2(AQIfC~6c@FglIAAo0qCjjja
zI1PLeUH={6Pk{7)odxhCbo_q=ivKqY9s+a*pw0m30-XVH3V1tu{VTyyuoqki<mbN*
zMBp^=GxYm!0_py51oHjA23!J80v|=Ee+_ssklz1ra3Xj+I{g#C+2AyA0=Sj7QTx0>
zZKRJHFaK%a_`T`evp1fTHM;3BZz#of%qYMD<IpA6(Tx)#+~6OkCU5o1fEb&{t}fss
zy_^~wopSAsWr;i)>=PKUCKDE-(VAbdHUk_Zw@+wu-|ijzF5R(zVuhE}f*>}T${L?s
zSL5y8Rd#z~94(-LSq30fN@AyVZoA3f#jXG<KQ?Tg*1@u2qfLvL0+csz%v$SnH0%;$
zz2XnZNlK`Lc5-Da7)(}eurY=LSD;omGi3F1Op%4hanXjv9=*YAw3J~yo4^W29Z8x>
z3;VP?QV6j%-#o73W;z*gPt?wupHaCl3q7XOV)a{t0!vO}#c?%E3pQlCS~@|ezm$7H
za}-?ClksGur|p7{{v5*>=ZL1K^uey<3~%mPB2RY*J*)xTyjAd@49}cJRKsz_ZavxL
z6ZD&A{dN~)5*fTB4|4{t{B{qEI+sf(X%%mdp2!?(mE&Arz~xHZCQ=p$P7rkj<4|W|
zWm+lGUK4Q_FBj=)STI)iQb-%Ix+hI}8zta4yX%dAPG+E4hSJ);fbPP2D&c)x0m|nr
z-{n0$%+8?YsOk^y8bD9Is<VX#jn~SDRU5XecA8<IFXo%h89K;_0XJQo&k&*bEjw7~
z|CMvV7|bG{&EdN2xu*Szt8)IN#y)l%GyAy<$YNqF*`rJbQ3c<p_F=r++pwC-ZN|nb
zk~*%w%X83eoEdT>ysy@;$Pk}zx*V^sFrN3d3~f^C<8Ky)(M7P^s<#;Vm3GQ9S5$sz
zZkkN(44O2wQ6=dw%o%-~Rg`IV#_)s=*u;!>dAq*pBH87F+dj3}{*X;=`RT?NbA|b4
z#kpR+x9Ufr*~ASUOWr8N*ADCrZZ*bkYs=6-*Xji`*^2qA0nAQ$Gk$vcE4Y%&L(eDu
z&y^e5gt4^UXAJPqy2q@M-Spn#=U3obW-CnSA*<$0v5sKXaQSNR_*Pz)+Q!bBA$B_0
z1=R6<q@=p)<GDU~W?8;ZDrH|US_LbrR=zg`w9VfN_&BowmfwT9g5Xr7MXZXuj-OkK
zD(pBWZ3IuRWdE$`EZgkLWx4S2u01x;Gr3VR+);wTXrqJ+dXgO?@+*>s`6vZftYE>j
zxJ-H$%QahQ?7m$cfjA<mDv@b)aF`7HNmkzf|GiHCpRpQd=`-m2?*(rLuLge#o({Ah
z;9PJY@GbQGo57R80pRt2#r^*h`u%&ri-FGns{)<>HwqpI?gLH%vIo2ieZLEKfIEQ`
zz?abN-wAF6()o1`pw{>m3*c>F3A8~2DE9yT!Eb>7M7MuFcpR7nd%*p{chT?v0lW*m
z72E>;2pj>A2KNQ>`M(J~33R{(;D_k@{{-G6y&t>{#NZroD)=0_{#(FPz~g~@{Z9oy
zLC1eFcpQkqKClja4jum=z`KBA|J?$f2o(G8TyQ%02s*#k`d<RB2J-XY3$(}oeYBI>
z>OI~T;M%LCw%5m7;&o=SU)yl&2X3XKiiHW~+N>=z%w{Lq>@$oueJjL7s_k~!!|k86
z4(KBUYav}yE16>OUshRi3zjmZ1z|P_Ga8+#b5x@ZF1<4|<77}e)|O81%Tv)oMw~Zj
z)|*kK$Sl?*Yei|04|}|6oG(GT+>+nCV=0$g_!{Aq>Y=hLTCilM(K}mU$cf2C$5>n2
zVOceIZ=i*u`<WwUYm0aaOI_?=y~u9fDXEevnbTjo9=5Fh)~B3WW1I(E5)8y_cS~~4
zG(vWq3>vc7fLStG@n2ymn{?qi!+W%@*({E~irFC1jka!yHU%T8sF{0WOH>diCaJ<+
zmyit^(>UjBmcne@hibcH0uA|c>f5fm=i6ILO7OQiEk2Cm;E!)4)`hk345q6h1}aob
z>WrY8G;r2%>un`pjN(11JFQ<N>P`}Z#>z+8R&k7mW~GP@MNjxifufpIv9l|^eXppL
zx6A%hN7H1PE+G{<vvK)M+}Eo~+Z8i@p53&6%}_68{2UEaJ+|60CnD1!`#0!&5y815
zGNtFQq>SUOGvQ&IYQVs$Ir+KrTh=!_ZAsTTST5R=Yy`o}ICFTr>k~%NS<QngUA{gU
z&+7@R8tk?Q(ubQ}lA2_mFWxtkb%xIDnen>>GLNK{4rI!NN&H%F(0~Oyr%I|@(D>$W
zUDGFc^|;!;h(iKGBtMV8b+vFcuqg-KR8^8ZSJ4iAt7BQOdEXX&kFDGuPF$_trcG`o
z)niao`GKI`l=06B$N6#9Sw%AwQ%;@CD+g28PPTAu<Nwo#*7e(|b>gQvx!b9f{+#tn
zg@I<Oaa}HTJ??eu(dCL^tw@_UZrqsCRJHe;on2?FM49sC?&dO|X?L+qWnOTx*0On6
z+GU>8r64ti3^%2i1LOS=ssd`r&lQ7NDv_I<c^tDp;c$$CR21q-*@bWMw0p7WX<G@N
zH$EQf_0HFNT|u@s0q5lJy5EqK5R;L^I%K*m{S@QZ!~HsdA3TdFkus@Eq$Jwtlbc)$
z^g1sqFohJKQODfdZE$b|i%WwZah+k%ZF3^Dv63HdcUWO6&c{AQKt$I4i=VJA9z}OE
z#>(5#L}@H)USGC<_;s{^KP{;X?LxgYM!<j<T>l)*JK5f{f{n<CKz5}R4!y*!neN^0
zX5jp~QJ%?$?eY{gUgu4f7g%iysnNvr+!|UdnH_y+%(7s*9#!(hS(y_DEwpsv#YWeJ
z{<3T#{r^mK$d@|(|0<_XehdBnE8xrEW#9nV540EHuHdiH@&5w692^1_a5j+d|JTsz
z{~5dz90qluGXZvi`++Z_-@gHLKpp%pxDPl5Xzl-1==n#$^+5alzlL7_R-pa;SAkQ(
z$I$7urauSH2PcB}qr*QBJPe!+K7;<Qn0|`ozXkj*xC8hKdi#gKAA@b+fk5l}KS6K*
zI`|rR9XJNIfO~*1qq~0sydS&|JRST2coKLd*a7}Ux;uCS_$%;A&;z@{y}*0X-=~4r
z^hNKN<aKzj%V)oRqvJn0-6p81Jc?qSnPIG~e*d=4)i8cvY>LFF+Ee%~7Y&v}W!O=}
zxH1x5In$`mplA|@c`4c%9VV58sf@$x_MO4ra63b|L$Qf-)g~xwEuz=VD7I=_@lc5o
z*dUSULWUVd%4<g^@Yms)S}!_m0*W5uoiLA`rYy7M?T_1@sVyqq!?h(Pitd7fLO|6y
z&auUuff~1DqtW76$^biR9+*c|9*K6>mPnqeXET_J<7U)saELcaQ*R~PiAknSgj(nX
zL8_fD`)7#O8qLIH14TH!WG-$tla$o^^`OZ$oS}5ltOL0n^ll%2V5%^ane}Ki8|`(h
zk9WijR7`KGndsFzChj3~v-h)u4CYn461k#Th3%~B&p{a?KDj@2sT{U%RIf1+5!aOC
zg2TMou;C)X$|ci!l|dg?YzT;)`cFCqHXHrsaIJ&5RZ?F1$Z9i-OCmnU##>D%S4}mh
zWtH@&BKc8IkEbJ_dD%LuU*0yyxZ0RH&h2u6wqqDWIw59OpGSH&nf`=zMIX^jepAlz
zE;~EeN8Guxj?axV*ubalPVS`jo9!CxlRqcQGlH8%d@lO-3~?DRif!$?!5OxB?^&o@
zL|o?m{(M6+E3?(osQ)>=tq(gaQsbe$l>I+2^obThMI!l1Mn|-2Vi_VALn%yWMT3){
z?n~iY{<m-9)SuGd(f8oW9b2h#1tLh8vj1JACYJoo<-TRS96H)%>q{aft?oUx)1bfP
zjFf|N(t?0LO>V{H4QJc-TJhPkn3zrZr0*TeO`E4po@su!#e~Flf?hTTYf;&qcO*KI
zb7xt$K;DaB*LmFuW6UEOSHgP5z20YP=eNL_+Fn?u^-~L{(P5RR!h#p{cjaN8acO4b
zLiiFCjVdV>hti);Gb+d^Kd_|lWE!Dhc+o6qikQB_7#OV++vLae^pT(lg+^ds9^$|=
z%$cL_G}po?Cg3kYLhCg}b4P&DSeBfPhngrMBa#DESlDI8!Svm91VGY3Y^W3MSHcqW
zQj6$cEV4}_b4)g-TzsCc5e-Vd8F<OWIz^Hq&==7_*kjT)flZMurVv<IWNS@x@&MLd
z1;oeOQYqGmT&%O&h-^r~nfi=iMzqr;VIyetlT%a<I-DJ86E#=Tg~TtmPB=-y?0v9|
z)Nej@8_zs1a_qorjHyWxMFXwe#J_g#(1m^kJ0)UDf>g&`=;p&)^}U01<-D@Z{BJv?
zyTZbk(g----nPqPT+R^DE;D3jO_|<paaJ3R&up3*B!(vWiLYEKtbN7Y$#77@I>@Jn
z*^ENE*MyY1Kx<8_;F4XN`*nu=?qO7AW6>>^oYS0((()usr)s!(%xE2M-)cJURQ>K1
za}292b~YT?h?6=sYPl&UnN)-QmKoX@=`Bs#YxmX+DDNIatF&X;A{DGjSaGqupYcq|
zZ9wyI#!N;DDJaBiVQ4TC(m;u?zi9n}WlG0YlnS1P&rSTlA@t3sIsJd1(>*_hj(-GP
z3eEsuLa%=d&|d!@*bg27b^@IP_z>`5@DJ$s&j(ubzYa+MKLG9lZbi3Oy#K4gox!Wo
z?X|xDTp*wR3&5FR9r#Tk|NeV|ThRBP2^PQ>@H2G%Z-6g?&x6l_zXCUc!$5od75D$+
z*Z|%Rs^Br;Lhygk|8E6<3H}f$w*Oth2hsm;0FMFM*Z*mB{@(-I&o3YUdxF=a<4=H5
z@QD*RO8~3~^4tFpbo!@*MQ{*o0;hskL08fCsjJiVlg=CEJ}XJu>2V~kPbYI}#$2BS
zv>KKk)svd-=Uihl%<6Js8QhdzSU^oHePUIyFry^Xo*ZUi?qo;C{O#Li3d$#1V8+cq
zlJ{`W-}ir)r;_tSR@VyA&_Zjr)jrI=a_z!eU%YbblMlaF*hEwcpDp^`HwE6dEkyaG
z2bmr7&!wTf9HGz@JR=q}?CMF=SGC(3yfR<t;}Zk&Z#%VMIq4vLB{O@s=dF=xRiZ+X
zj1i`+-@)Rj_Xn`PCyFo8a~3TZIV@RLOQy`hy;P<4h2@Bke762?XF(a9j#m&IcSw+4
zfjyQPAX9}b5NF22xRuMiyv!}t#@o|W!eYjiHlV|!(ooWvtuE7P-@DLwtY$iR*v*;K
zJOT9`jJip3nZSbnVasxoeI%>KBR0=KV%3AFP-;A*>sf`*KfhiIpV36pB#`EeyOqyE
zW<DzjuhJVUXbDF3cE>tId1bzwS|FLGS~^|}3CVFl>YmjXFvJ!iXZnzTR(I$?c|)BA
zMB}Ji?={U?UJ5tAVOvBb1iX%-4UMQXLmQT_&id*&0YC4%)tzykTcOMxRLe0~u?+3$
z=9lA-H(u!K;;8m{$CP}&`YxK)$}rWwxJ7)q-L+P2nji{d-NY{^v+SL<n|M2$=I9;Q
zu@?w^*tP8bmOa)yo-`Ly<FHC$c&%sjD#q7dU{|qhYptoKNPaK8iSpt@c6ikSZq4qP
z?^kHn<tsNFWlCBgyE`elq>}nip{rOyh!)<>XK1-x-N-8H9F@eudF{?@l>^cn^(CEb
zMh~4{LNYJ;{QP%r(a&Edk7D5qKOLK&w*Ovk^VwsvVfE4EVs97mff5fA4#$@yS%$CU
zO!Y{~7utVo$QeL_O5`1l3Uk@Ypj14t6=sssJRHoNxx^XHf~6UiZ*XV|cK16S85(7}
zOR};XjIIS7oHlM&7EWiXymMqhBDNbS5>!`vdVPmTG(|T?sOCjIW7sSmm>Gc;YBjbd
zhj1`k*4Y&9HeJ^w5VC8IO*I}=P4_NbHYt$46Vt8+BL;o5zGz%Oml=N4V0K<J;VOKO
z@Qj-stMsr<H?ZrH*_g8`=p;&eKi@Z~wYwqp#uF`QY%#PUNy?s^O;{?|;|o@Q^ooq1
zTl7Eck~%5EISA{5S${<EBUQiPXbl^7mQJ2<v!ijJ3fC^MTbi>xjoq@_ZZ5cWGY##B
zjsA~nUV5U_{~zh}f5ra)8=x})p9I?A?m)5s-v!<X<OA?3un$ZC>HnW3G1&m#3*`U*
z0`OGO2Im6V0p5%5|2m*^|Hi>a@OAWj#rFF%a0O6ozkf#8m!JQ2;1S?1;8p1LSAes?
zr_twc1m}W#gYTlpzYshDw18sve;!@_B|vfet_Sknzbm*Eeg54*zWaX<+Moq?0PWq^
zd3|38Ujy$3e+T{yJQiFG?hCYs|4HC#a3OdAI2F7Rz5gjdXY`#9?ghRJeP08f1w`v7
zfaD{7^q*h?^q1HYRd`^X?w4JJX$;w!Sjf(IDbe>?Pu3YanJ|=kKT*WI=vC5HePH!|
zX=cz-LK#o{;58=!s6%CThlUKQ%mO2v{?sSXb&|*+`QZNQI(-Mm*d9Z7@=jpJsXkO}
z5{-uWH`)G4KbwzJ$uB!F=N=<*EkUIE3-YfWWBZ0<RYk?r?#2F8%<k?q89ivzAqO+$
z8?$Nu2)_P8GdsC)-C8&O(2^$Sf~N&a)F8G<O2$6$^nDd4xkHH(MwADAdR&%$A)Gk^
z4p@~KEWbQwvy^3Z_3`$N$<q$*$-L*P+s79}ed2K1+G?ewD+Jr0)BZD$DP4{(X#n_s
zi^PgurlfrI@%nA*=AGswUzDbq?|jsG*xn!H;3}t9Dw&k{FUzXgzw}HhRrI%uji?{A
zxlhz8p5^`dV~%HGMl->UL`A1djQfE3uAqHU@(b4km1%#u2Vd2l+f*yPsE?<Azu7dk
zj3g~G$W~fFHKi@7V9grJ)YNYcEg<fi3AF6G3MSA3`t*-7;<2L7n%z?;n5MH=5sgv;
zr@M~&#Dia)-O~>{uEk|EOiPrEH{lc<Rw5W!yk1kh$Wp8q2U?0!T{HM$@Jp#5|8nep
z$FV2scmmlCl5CbYqI-Gcb{2BRoLA3ycsiD1!D5AC?fX|l-Wf2NuTB73sfJd0AL%#q
z7nt||dj%x<|D%4}*m9iz$Dii&J#_tVfUkkCf?L5&KzjgofGuDhxFfg&coDk)61Wy9
z9-!X~@ICZ>?FV==_&qQS_JDElAn-fj%@p9Z;70IRApd|zgAL$8K<5E|1-u+Q4m=j<
zOu$L-0Pr8!1r+=5Pr*6hN7x2l2A&6YfiZ9j_$O=xj|a!VQSjT~3)l!=0}g>*;3wDy
z{tM`wzh{AGf=Tcoa1!`e>;q2&+rWdsy}^m#zpw}V7(5T$2x{OU_$l^)cZ0WpE5Q|@
z0?Od7Kz;-71}_8Kz_~!a0~^78z==R{|6U*13&J@ebx>i~Y7etf+*+(u7HjBdyY^qS
zV{H8Li+5f^ob)#F+^t8c3AtXpm1ZK128&s}Fq~;gnWv(9`b*bYJ7f>-lFqxEYAD)S
zwnXl7l_C<7tP^a<c46MDM<aGtFJ{bqIeSRP9T4wNMMujT_X5xI!uv|0&vz!9gmfI|
zCX~BT;55pt?49<<d`zm6sG*P3z~u|8$)1Ec8hx?RX}7e2!y4w&CJdc1IaZcfI;@I&
zkJzA4I&wA`ud<DhCg%;<NE-^hl-{rb;er%GS)lJRnIdi*XCZNv3>o-OwuC~`lYE+`
z%qK0J^0lomdDTlzHV8Zl_z}lJ$D&H`?r~BtNj^)y>|ZK<{}o*|4j4y@@3DMo+?dM}
z&w_TNs@7<`cwp1jF8)RsQz*yl%0?f%W@&iKrkHTyZAj3`hKmO_`V#cZg|mwzO-^UP
zYQH5qD|cJ%IJ;PhuHXbkW2>PI^Y{#mbcx&0YYm+>9G$u4%=LKOv9F}gDsd{1V`4Oq
zO1y9_XgSfoJ9OsonOejsnM(7YvXa>>pkQJqVhM{5r9~huJf?Xh?<6!D_)3zG>!dsV
zUKjP$PCVDfXImZCxUExO_P-EQzSiWtOqQTC707f)6+bc9rX@3%@#(L|tcV;9&k^3;
z=o&xhPJHb`qk|ggGxM2<&+Tc#Ntsp8Oc9_&wwJoQsU+yT(Pizn@pV>n_?%?rn+&Rz
zRLDhnvg9x>#(rAR5N`b~-MBvFa&$4HBwK41@WZ{mY^;QCo-vh4dyuYHD#w!(%lVgX
z+q--G@~add_TrtF?Ql!-%a=M^(6B^mqfr)2_S9O9dRHpaL074R5>t~iQaNC+)|ACO
zo*Xf?;3fYZ?VMs|B^;NuT%*?^$RbB=u!Bz{f3vCCt7&#z%e$e^_0uQlzoUb>`PGz3
zhC<7t2XnMIXj+#>cHX94<#NzWum_V;M+bxXa*LTx4-Q8M3rA{qdwu%yKDo}D!_{zw
zugUV2n+i?ep}I}^yU_2=B9=KPTk&lsqal-%xvNcbz5u?;{yU1IgXtu(WmFU$?X^ee
zIUc9hSsF?24ZERti@UX<-n;H#kW6GF@UVlOL5uayNfM5iwwP{xkkP5Z`M*&-GCg7^
zelf#dC`|3ln3c@jFn>c;2pB}OHHmg1MWe^UrRD(U_=*j!-cK7wI?Mdx)@8=Hv?Oqr
zwl8{-K%G{6B^M2|56)~paGcd>s=3qsdr6}u#2__|o#{(7x=nwf(^1J?KK*ZAu8jTW
z(qy3Z&nsV&8nFYpDwpG1c4?c@+g3~uh}{w<s6>a_?Pgl*Bp$AoTzu*MceJlI3&F9@
z*JDnxsZ%aO;Y4ld#Q*bJ>!d+RUpqZ0SZ%S*9!4!OYm{G@hilzX?^WYNOX}x6lJ$A`
zZ+6eJ^_6sO1^f4{1XT`tRlYvk?J+tPvxMZ+_TS1woMyVma1<nChYU8rm_p+z@BN|t
zu2w@p1&SDn{Hb$vDHHtB1RqXDs4y>IAJ;WahKLAkfzf(m%?x9H<E2&O(`Hqx^-0nL
zYRlYW1{a^V|Mr7Z#5e`N+5It-hO}zC<gpy-)eYQ$nW{N-+=i_WcNw?)J1d#!O-)M@
zLinB5CLKfa5<|+0uIZ?ZdX6ug|Mm@%{JoF7%;4|(N?KG~1kMxeMVDHo$!~^+sJ7#}
zUC?grJ`VQXmegffCR@NQu4q^};{ZXQIm&!!tZDl9_W01k^!ls)aFfosI4w#4zW|M2
zXULb(|7%wLH!=SXqSu#!&iZ>C(Aj>cfDfUwzZK~GzK!6k=;;3jJ_9}lJ_+6rUILy7
zra=uH1lr&KO?388f@cD+%RiXkUqpBR1o$|3Id}$`1a+Wz{wILHMUQ_W*a_t4|1fYa
zI0u{nK8#NPN^m`x2W{{W@B?)FTfjBoAb1pbB)AeN&i{kK1HjkO@ul-O!Np)R*Z_vX
zSJCs|4PFnP0d&sa5;zPN!8CX{P^^IG0G;(W1%|*0;7#cJ{|oE@+rhoTt?2iE0h(Yx
zknXQD{nQ>GSDW0%PqfS@jb3IrwdhHsI<n%~7x}F44GE(~5zWGsb8bQ5Ef?N$=jtMz
zg>SAL^(=h)I3u8iud0RvqoI|;C;e};dXGneJ?hj4qDfaB5}!)HY@hQ!Q#y3+)vhE4
zk6z||i%~vVk@k)q<s;g%NDSa(BW9);VRGP*JUh7gQm?pj(6~)*!X=-+=x80Nq^}_G
z+x^GJ?<z-#WIbOl5I!o9UXc@ssYswvICnfJR}^krQxQf-(=D6`PKtD6wtH%>lRA{N
z*Jyiol8vDXmcjn4CW0c;Gov|Tn&0&rA<EaRZ09)FBoPeA!BIbF95B`4m@Ag33PxfT
zuE+;Qb<a6@l=Q6s*mD|7{!c^EK`tZasSH)KDfew3+h@FP$IPr;;2Wz<i^^=&9L1P%
zC3nY2rHbgXrMxg(%)Z2|$A^;@;DE4@p$m$f7yG<>&0$RT4e#HqW?x;KnU^mmVyBDY
zIk>rx6->3JS|XV~#(3oR1?IFiEFN9La3S8%Rm|4pjBqS@-w0B~l`NUG+<$UfnM5Lh
z?#4*8owzCOC0QBw;r|}@6xGZ>kb4thcN%GUz-trsZu*WLBTOS&iESh&-^-*$fc>~r
z=VSu)YI%(04x3Mf5S8Ega`czkjAh&7#ng<#02F4OCC-tOQp0x5krh&5szg?y?tv?K
zJ`3zkrd@Y0G<yw8sifNuW(}vfrIkp3sQ~hM#gmrtSHA+Mo4_3|8J4yD9N~xJgT4ma
z8&aAp)uO#siO*7!+>v9^L)f@Znn{XmdtlshUOUdaHrdOQ&4c*@&tsK*MPDWrNuPin
z`UBWz?0I@RaTF}1O5cW#nwIoSdQl(K@Ppl&lS;0)QoUYTpHH%kZHE5tXCb@Mgzjb(
zXlWr%6N)D@%MdA<G=(KOF#wSmT?AVpcI<@8J_ZNlvwY<WD?5~yQY9_iR^Uze$?=Hh
zC|st^<@f*NkF6yA$4s*H@}5;$bU9NCHy4+5Bbgu^osA<}(1F}c8`Nl74?mM;+B@XZ
z?M+0!pV?JWI<4#(K~AzR`|jzV9X#fiR+?hdLa3T*DreuwFH<Ep#a-u3R9QgVx8srf
z+zMLC1xiC7!_Ub%#VlaSNHHAQgN=<fhyl<nzNN8;^+;au%8X+JOSFGtNA<Gtv2B-C
z(f^&T)0P8H?=Rf4rC4dDP3ayjT9M1<lN<X77CkZ0W++zjrPnvMHY1+plJuG}os`ho
zY)YDpP@9QErubkA2?jGS67UOcS}J{`n@Lm&XR=hCR?$dilFheLV2&AB(QW(pjqkji
tBe5^LEZ0JXMKSrTz%Yen5yuo*U$Tn;2``ItCa#*;w_|rTwL(z7{|nvx^Em(j

literal 0
HcmV?d00001

diff --git a/harmony/src/domain/topology/k8s_anywhere/k8s_anywhere.rs b/harmony/src/domain/topology/k8s_anywhere/k8s_anywhere.rs
index 4e0337b..76971f0 100644
--- a/harmony/src/domain/topology/k8s_anywhere/k8s_anywhere.rs
+++ b/harmony/src/domain/topology/k8s_anywhere/k8s_anywhere.rs
@@ -1128,6 +1128,8 @@ impl Ingress for K8sAnywhereTopology {
 
 #[cfg(test)]
 mod tests {
+    use serial_test::serial;
+
     use super::*;
     use std::sync::atomic::{AtomicUsize, Ordering};
 
@@ -1167,6 +1169,7 @@ mod tests {
     }
 
     #[test]
+    #[serial]
     fn test_remote_k8s_from_env_var_full() {
         let (config_var, profile_var) =
             setup_env_vars(Some("kubeconfig=/foo.kc,context=bar"), Some("testprof"));
@@ -1183,6 +1186,7 @@ mod tests {
     }
 
     #[test]
+    #[serial]
     fn test_remote_k8s_from_env_var_only_kubeconfig() {
         let (config_var, profile_var) = setup_env_vars(Some("kubeconfig=/foo.kc"), None);
 
@@ -1195,6 +1199,7 @@ mod tests {
     }
 
     #[test]
+    #[serial]
     fn test_remote_k8s_from_env_var_only_context() {
         run_in_isolated_env(|| {
             unsafe {
@@ -1211,6 +1216,7 @@ mod tests {
     }
 
     #[test]
+    #[serial]
     fn test_remote_k8s_from_env_var_unknown_key_trim() {
         run_in_isolated_env(|| {
             unsafe {
@@ -1230,6 +1236,7 @@ mod tests {
     }
 
     #[test]
+    #[serial]
     fn test_remote_k8s_from_env_var_empty_malformed() {
         run_in_isolated_env(|| {
             unsafe {
@@ -1247,6 +1254,7 @@ mod tests {
     }
 
     #[test]
+    #[serial]
     fn test_remote_k8s_from_env_var_kubeconfig_fallback() {
         run_in_isolated_env(|| {
             unsafe {
@@ -1263,6 +1271,7 @@ mod tests {
     }
 
     #[test]
+    #[serial]
     fn test_remote_k8s_from_env_var_kubeconfig_no_fallback_if_provided() {
         run_in_isolated_env(|| {
             unsafe {
diff --git a/harmony/src/domain/topology/k8s_anywhere/postgres.rs b/harmony/src/domain/topology/k8s_anywhere/postgres.rs
index 7051a1b..2bf800b 100644
--- a/harmony/src/domain/topology/k8s_anywhere/postgres.rs
+++ b/harmony/src/domain/topology/k8s_anywhere/postgres.rs
@@ -29,7 +29,10 @@ impl PostgreSQL for K8sAnywhereTopology {
 
     /// Extracts PostgreSQL-specific replication certs (PEM format) from a deployed primary cluster.
     /// Abstracts away storage/retrieval details (e.g., secrets, files).
-    async fn get_replication_certs(&self, config: &PostgreSQLConfig) -> Result<ReplicationCerts, String> {
+    async fn get_replication_certs(
+        &self,
+        config: &PostgreSQLConfig,
+    ) -> Result<ReplicationCerts, String> {
         let cluster_name = &config.cluster_name;
         let namespace = &config.namespace;
         let k8s_client = self.k8s_client().await.map_err(|e| e.to_string())?;
diff --git a/harmony/src/domain/topology/router.rs b/harmony/src/domain/topology/router.rs
index 26aa572..5217c82 100644
--- a/harmony/src/domain/topology/router.rs
+++ b/harmony/src/domain/topology/router.rs
@@ -60,6 +60,7 @@ impl Router for UnmanagedRouter {
 ///     hostname: "postgres-cluster-example.public.domain.io".to_string(),
 ///     backend: "postgres-cluster-example-rw".to_string(),  // k8s Service or HAProxy upstream
 ///     target_port: 5432,
+///     namespace: "sample-namespace".to_string(),
 /// };
 /// ```
 #[derive(Clone, Debug, Serialize)]
@@ -115,11 +116,7 @@ pub trait TlsRouter: Send + Sync {
     /// routed to this cluster.
     ///
     /// For example, if we have *.apps.nationtech.io pointing to a public load balancer, then this
-    /// function would return
-    ///
-    /// ```
-    /// Some(String::new("apps.nationtech.io"))
-    /// ```
+    /// function would install route apps.nationtech.io
     async fn get_wildcard_domain(&self) -> Result<Option<String>, String>;
 
     /// Returns the port that this router exposes externally.
diff --git a/harmony/src/modules/network/failover.rs b/harmony/src/modules/network/failover.rs
index 9c99c5e..3880c02 100644
--- a/harmony/src/modules/network/failover.rs
+++ b/harmony/src/modules/network/failover.rs
@@ -5,10 +5,14 @@ use crate::topology::{FailoverTopology, TlsRoute, TlsRouter};
 
 #[async_trait]
 impl<T: TlsRouter> TlsRouter for FailoverTopology<T> {
-    async fn get_wildcard_domain(&self) -> Result<Option<String>, String> {todo!()}
+    async fn get_wildcard_domain(&self) -> Result<Option<String>, String> {
+        todo!()
+    }
 
     /// Returns the port that this router exposes externally.
-    async fn get_router_port(&self) -> u16 {todo!()}
+    async fn get_router_port(&self) -> u16 {
+        todo!()
+    }
     async fn install_route(&self, config: TlsRoute) -> Result<(), String> {
         warn!(
             "Failover topology TlsRouter capability currently defers to the primary only. Make sure to check this is OK for you. The Replica Topology WILL NOT be affected here"
diff --git a/harmony/src/modules/network/tls_router.rs b/harmony/src/modules/network/tls_router.rs
index 75f1a00..762f981 100644
--- a/harmony/src/modules/network/tls_router.rs
+++ b/harmony/src/modules/network/tls_router.rs
@@ -25,6 +25,7 @@ use crate::topology::{K8sclient, Topology};
 ///     backend: "postgres-cluster-rw".to_string(),
 ///     hostname: "postgres-rw.example.com".to_string(),
 ///     target_port: 5432,
+///     namespace: "example-namespace".to_string(),
 ///   },
 /// };
 /// ```
diff --git a/harmony/src/modules/postgresql/capability.rs b/harmony/src/modules/postgresql/capability.rs
index 2de12a8..81ca83e 100644
--- a/harmony/src/modules/postgresql/capability.rs
+++ b/harmony/src/modules/postgresql/capability.rs
@@ -9,7 +9,10 @@ pub trait PostgreSQL: Send + Sync {
 
     /// Extracts PostgreSQL-specific replication certs (PEM format) from a deployed primary cluster.
     /// Abstracts away storage/retrieval details (e.g., secrets, files).
-    async fn get_replication_certs(&self, config: &PostgreSQLConfig) -> Result<ReplicationCerts, String>;
+    async fn get_replication_certs(
+        &self,
+        config: &PostgreSQLConfig,
+    ) -> Result<ReplicationCerts, String>;
 
     /// Gets the internal/private endpoint (e.g., k8s service FQDN:5432) for the cluster.
     async fn get_endpoint(&self, config: &PostgreSQLConfig) -> Result<PostgreSQLEndpoint, String>;
diff --git a/harmony/src/modules/postgresql/score_public.rs b/harmony/src/modules/postgresql/score_public.rs
index 66cf1a9..eaf3c88 100644
--- a/harmony/src/modules/postgresql/score_public.rs
+++ b/harmony/src/modules/postgresql/score_public.rs
@@ -69,9 +69,7 @@ struct PublicPostgreSQLInterpret {
 }
 
 #[async_trait]
-impl<T: Topology + PostgreSQL + TlsRouter> Interpret<T>
-    for PublicPostgreSQLInterpret
-{
+impl<T: Topology + PostgreSQL + TlsRouter> Interpret<T> for PublicPostgreSQLInterpret {
     async fn execute(&self, _inventory: &Inventory, topo: &T) -> Result<Outcome, InterpretError> {
         // Deploy CNPG cluster first (creates -rw service)
         topo.deploy(&self.config)
-- 
2.39.5


From 5935d664072b8225b6521205b91d49125f8f63d2 Mon Sep 17 00:00:00 2001
From: wjro <wrolleman@nationtech.io>
Date: Tue, 6 Jan 2026 15:02:30 -0500
Subject: [PATCH 20/20] removed serial_test crate to keep tests running un
 parallel

---
 Cargo.lock                                    | 75 +++++--------------
 harmony/Cargo.toml                            |  1 -
 .../topology/k8s_anywhere/k8s_anywhere.rs     |  9 ---
 harmony/src/modules/brocade.rs                |  5 +-
 harmony/src/modules/okd/mod.rs                |  2 +-
 5 files changed, 21 insertions(+), 71 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 4ff5922..204fabc 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -690,6 +690,24 @@ dependencies = [
  "tokio",
 ]
 
+[[package]]
+name = "brocade-snmp-server"
+version = "0.1.0"
+dependencies = [
+ "base64 0.22.1",
+ "brocade",
+ "env_logger",
+ "harmony",
+ "harmony_cli",
+ "harmony_macros",
+ "harmony_secret",
+ "harmony_types",
+ "log",
+ "serde",
+ "tokio",
+ "url",
+]
+
 [[package]]
 name = "brocade-switch"
 version = "0.1.0"
@@ -2497,7 +2515,6 @@ dependencies = [
  "serde_json",
  "serde_with",
  "serde_yaml",
- "serial_test",
  "similar",
  "sqlx",
  "strum 0.27.2",
@@ -5193,15 +5210,6 @@ dependencies = [
  "winapi-util",
 ]
 
-[[package]]
-name = "scc"
-version = "2.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "46e6f046b7fef48e2660c57ed794263155d713de679057f2d0c169bfc6e756cc"
-dependencies = [
- "sdd",
-]
-
 [[package]]
 name = "schannel"
 version = "0.1.27"
@@ -5286,12 +5294,6 @@ dependencies = [
  "untrusted",
 ]
 
-[[package]]
-name = "sdd"
-version = "3.0.10"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "490dcfcbfef26be6800d11870ff2df8774fa6e86d047e3e8c8a76b25655e41ca"
-
 [[package]]
 name = "sec1"
 version = "0.7.3"
@@ -5529,32 +5531,6 @@ dependencies = [
  "unsafe-libyaml",
 ]
 
-[[package]]
-name = "serial_test"
-version = "3.3.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0d0b343e184fc3b7bb44dff0705fffcf4b3756ba6aff420dddd8b24ca145e555"
-dependencies = [
- "futures-executor",
- "futures-util",
- "log",
- "once_cell",
- "parking_lot",
- "scc",
- "serial_test_derive",
-]
-
-[[package]]
-name = "serial_test_derive"
-version = "3.3.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6f50427f258fb77356e4cd4aa0e87e2bd2c66dbcee41dc405282cae2bfc26c83"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.106",
-]
-
 [[package]]
 name = "sha1"
 version = "0.10.6"
@@ -6198,21 +6174,6 @@ version = "0.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8f50febec83f5ee1df3015341d8bd429f2d1cc62bcba7ea2076759d315084683"
 
-[[package]]
-name = "test-score"
-version = "0.1.0"
-dependencies = [
- "base64 0.22.1",
- "env_logger",
- "harmony",
- "harmony_cli",
- "harmony_macros",
- "harmony_types",
- "log",
- "tokio",
- "url",
-]
-
 [[package]]
 name = "thiserror"
 version = "1.0.69"
diff --git a/harmony/Cargo.toml b/harmony/Cargo.toml
index 9086e84..634cbe9 100644
--- a/harmony/Cargo.toml
+++ b/harmony/Cargo.toml
@@ -79,7 +79,6 @@ sqlx.workspace = true
 inquire.workspace = true
 brocade = { path = "../brocade" }
 option-ext = "0.2.0"
-serial_test = "3.3.1"
 
 [dev-dependencies]
 pretty_assertions.workspace = true
diff --git a/harmony/src/domain/topology/k8s_anywhere/k8s_anywhere.rs b/harmony/src/domain/topology/k8s_anywhere/k8s_anywhere.rs
index 76971f0..4e0337b 100644
--- a/harmony/src/domain/topology/k8s_anywhere/k8s_anywhere.rs
+++ b/harmony/src/domain/topology/k8s_anywhere/k8s_anywhere.rs
@@ -1128,8 +1128,6 @@ impl Ingress for K8sAnywhereTopology {
 
 #[cfg(test)]
 mod tests {
-    use serial_test::serial;
-
     use super::*;
     use std::sync::atomic::{AtomicUsize, Ordering};
 
@@ -1169,7 +1167,6 @@ mod tests {
     }
 
     #[test]
-    #[serial]
     fn test_remote_k8s_from_env_var_full() {
         let (config_var, profile_var) =
             setup_env_vars(Some("kubeconfig=/foo.kc,context=bar"), Some("testprof"));
@@ -1186,7 +1183,6 @@ mod tests {
     }
 
     #[test]
-    #[serial]
     fn test_remote_k8s_from_env_var_only_kubeconfig() {
         let (config_var, profile_var) = setup_env_vars(Some("kubeconfig=/foo.kc"), None);
 
@@ -1199,7 +1195,6 @@ mod tests {
     }
 
     #[test]
-    #[serial]
     fn test_remote_k8s_from_env_var_only_context() {
         run_in_isolated_env(|| {
             unsafe {
@@ -1216,7 +1211,6 @@ mod tests {
     }
 
     #[test]
-    #[serial]
     fn test_remote_k8s_from_env_var_unknown_key_trim() {
         run_in_isolated_env(|| {
             unsafe {
@@ -1236,7 +1230,6 @@ mod tests {
     }
 
     #[test]
-    #[serial]
     fn test_remote_k8s_from_env_var_empty_malformed() {
         run_in_isolated_env(|| {
             unsafe {
@@ -1254,7 +1247,6 @@ mod tests {
     }
 
     #[test]
-    #[serial]
     fn test_remote_k8s_from_env_var_kubeconfig_fallback() {
         run_in_isolated_env(|| {
             unsafe {
@@ -1271,7 +1263,6 @@ mod tests {
     }
 
     #[test]
-    #[serial]
     fn test_remote_k8s_from_env_var_kubeconfig_no_fallback_if_provided() {
         run_in_isolated_env(|| {
             unsafe {
diff --git a/harmony/src/modules/brocade.rs b/harmony/src/modules/brocade.rs
index de6b957..a52dd6e 100644
--- a/harmony/src/modules/brocade.rs
+++ b/harmony/src/modules/brocade.rs
@@ -69,13 +69,12 @@ impl<T: Topology> Interpret<T> for BrocadeEnableSnmpInterpret {
 
         let brocade = brocade::init(
             &switch_addresses,
-            22,
             &config.username,
             &config.password,
-            Some(BrocadeOptions {
+            BrocadeOptions {
                 dry_run: self.score.dry_run,
                 ..Default::default()
-            }),
+            },
         )
         .await
         .expect("Brocade client failed to connect");
diff --git a/harmony/src/modules/okd/mod.rs b/harmony/src/modules/okd/mod.rs
index 282fbe6..5d6d18d 100644
--- a/harmony/src/modules/okd/mod.rs
+++ b/harmony/src/modules/okd/mod.rs
@@ -13,8 +13,8 @@ pub mod dns;
 pub mod installation;
 pub mod ipxe;
 pub mod load_balancer;
-pub mod route;
 pub mod okd_node;
+pub mod route;
 pub mod templates;
 pub mod upgrade;
 pub use bootstrap_01_prepare::*;
-- 
2.39.5