Azure Database for PostgreSQL Flexible Server
What does zop.dev create for Azure Database for PostgreSQL Flexible Server?
ZopDay creates a managed PostgreSQL server on Azure, running PostgreSQL 16 unless you choose 15 or 14. Each server gets at least 32 GB of storage, a private subnet and a private DNS zone, and it is never opened to public access. The admin login is zopadmin, and ZopDay stores its generated password in 1 Key Vault secret.
| Field | Value |
|---|---|
| Cloud | azure |
Azure Database for PostgreSQL Flexible Server is Microsoft’s managed PostgreSQL service. ZopDay creates one as a PostgreSQL job. ZopDay calls Azure directly with the cloud account you connected, and the job page shows each step as it runs.
What steps does a PostgreSQL job run on Azure
First the job creates a network, but only when you pick neither a cluster nor an existing network.
Then it adds a subnet for the database, creates the server, waits for the server to be ready and
stores the credentials. The subnet is a /24 named after the server: a server called orders gets
orders-db-subnet. ZopDay adds it to the VNet and delegates it to
Microsoft.DBforPostgreSQL/flexibleServers. Its third octet is derived from the server name and
falls between 16 and 255. That keeps it clear of the node subnet at the start of the range.
Next ZopDay makes a private DNS zone named after the server, such as
orders.private.postgres.database.azure.com. It links the zone to the VNet with auto-registration
off. Then it creates the server inside the delegated subnet. Applications reach the server at a host
such as orders.postgres.database.azure.com on port 5432.
Which PostgreSQL versions, sizes and storage can you pick on Azure
Engine version: 16 (preselected), 15 or 14Instance type: one of five sizes, Standard_B1ms preselectedStorage: at least 32 GB (the Provision screen enforces it, and ZopDay raises API requests to 32 GB)High Availability: off by default; on means zone-redundantNetwork: Create new VPC (default) or Use existing VPCResource group: create new (zop-orders for a server called orders, when left empty) or use existingThe Provision screen preselects Standard_B1ms. If you create the server through the ZopDay API and
leave the version, size and storage out, ZopDay uses PostgreSQL 16, Standard_B2s and 20 GB of
storage. It then raises the storage to 32 GB.
When ZopDay creates the server, it always sets the Burstable compute tier, whatever size you pick. That includes the D-series sizes. A later update job sets the tier from the size: D-series is General Purpose, E or M is Memory Optimized, and anything else is Burstable.
Which Advanced settings does ZopDay not apply when it creates the server
Advanced settings also shows Public Access, Deletion Protection and Automated Backups. ZopDay does not send any of them to Azure when it creates the server. The server always sits privately in its delegated subnet. Backups follow Azure’s defaults for a new flexible server. You can change backup retention later through an update job.
Where are the Azure PostgreSQL admin and app credentials stored
The admin login is zopadmin, because Azure rejects reserved names such as postgres. ZopDay
generates a 24-character password. It then writes one Key Vault secret named after the server: a
server called orders gets zop-ds-orders. The secret holds the endpoint, port, username, password
and database name as JSON.
The vault is the ZopDay-tagged vault already in the resource group. If there is none, ZopDay creates
one named from zop-, the resource group and a random suffix. ZopDay keeps only a reference to the
vault and the secret. Once the secret is written, ZopDay clears the temporary copy of the password
from the job’s record.
To give an application its own login, add a database on the server from a connected cluster. ZopDay
rejects the request until the server is connected to that cluster. Adding the database runs a job in
the cluster’s zop-system namespace. That job creates the database plus two users named after it: a
database called billing gets an editor user, billing_user, and a read-only user,
billing_rduser. Both logins are stored as Kubernetes Secrets in that namespace.
TLS is required
A new flexible server has the require_secure_transport server setting on, and ZopDay leaves it on.
Every connection must use TLS. The connection string ZopDay gives your application already has TLS
turned on, so it works as is. If your application connects with the separate host, user and
password values instead, turn on TLS in its database settings.
How do Azure PostgreSQL update and delete jobs work
Changes to instance size, storage, high availability or backup retention run as an update job.
Deleting the job first soft-deletes the Key Vault secret. ZopDay does not purge it, so it stays recoverable for the vault’s retention period: 90 days, unless the vault was set up otherwise. ZopDay then removes the server, its private DNS zone and the delegated subnet. It also removes the network when the job created its own. When ZopDay also created the resource group, it removes the whole resource group, Key Vault included. ZopDay takes no export before deleting, so export the data first if you need it.