From 1c986284173839c1b2522838d9c7ecfd8143319e Mon Sep 17 00:00:00 2001
From: Story Crater Bot <19826264+Riotpiaole@users.noreply.github.com>
Date: Thu, 23 Jul 2026 08:07:34 -0700
Subject: [PATCH] fix(ddb): grant universal schema permissions to all roles

Adds SQL to postInitApplicationSQL granting schema permissions to PUBLIC.
Allows any role (authentik, temporal, etc) to create tables in databases.

For existing cluster: run SQL manually (done).
For future bootstrap: automatic via initdb.

Pattern for apps: Database CR + app-specific init Job optional (co-located).
---
 k8s/data/cluster/ddb-cluster.yaml        |  5 ++
 k8s/data/schemas/db-permissions-job.yaml | 99 ------------------------
 k8s/data/schemas/kustomization.yaml      |  1 -
 3 files changed, 5 insertions(+), 100 deletions(-)
 delete mode 100644 k8s/data/schemas/db-permissions-job.yaml

diff --git a/k8s/data/cluster/ddb-cluster.yaml b/k8s/data/cluster/ddb-cluster.yaml
index 28da2ff..335b269 100644
--- a/k8s/data/cluster/ddb-cluster.yaml
+++ b/k8s/data/cluster/ddb-cluster.yaml
@@ -26,6 +26,11 @@ spec:
         - CREATE EXTENSION IF NOT EXISTS vector;
         - CREATE EXTENSION IF NOT EXISTS pgcrypto;
         - CREATE EXTENSION IF NOT EXISTS pg_trgm;
+        # Universal fix: grant schema permissions to all roles
+        # Allows any role to create tables in public schema of any database
+        - GRANT ALL ON SCHEMA public TO PUBLIC;
+        - ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON TABLES TO PUBLIC;
+        - ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON SEQUENCES TO PUBLIC;
 
   # Per-app login roles, passwords sourced from secrets (CNPG reconciles the
   # role password to match the secret). Their databases are separate Database
diff --git a/k8s/data/schemas/db-permissions-job.yaml b/k8s/data/schemas/db-permissions-job.yaml
deleted file mode 100644
index f4fc119..0000000
--- a/k8s/data/schemas/db-permissions-job.yaml
+++ /dev/null
@@ -1,99 +0,0 @@
-# PostSync Job to grant schema permissions after Database CRs reconcile
-# CNPG Database CR creates DBs but doesn't set schema permissions correctly
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: db-permissions
-  namespace: ddb
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: db-permissions
-  namespace: ddb
-rules:
-  - apiGroups: [""]
-    resources: ["secrets"]
-    verbs: ["get"]
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: db-permissions
-  namespace: ddb
-subjects:
-  - kind: ServiceAccount
-    name: db-permissions
-    namespace: ddb
-roleRef:
-  kind: Role
-  name: db-permissions
-  apiGroup: rbac.authorization.k8s.io
----
-apiVersion: batch/v1
-kind: Job
-metadata:
-  name: db-permissions
-  namespace: ddb
-  annotations:
-    argocd.argoproj.io/hook: PostSync
-    argocd.argoproj.io/hook-delete-policy: BeforeHookCreation
-spec:
-  backoffLimit: 5
-  template:
-    spec:
-      serviceAccountName: db-permissions
-      restartPolicy: Never
-      containers:
-      - name: grant-permissions
-        image: postgres:16-alpine
-        command:
-        - /bin/sh
-        - -c
-        - |
-          set -e
-          
-          echo "Granting schema permissions to app users..."
-          
-          # Get app user password
-          export PGPASSWORD=$(cat /postgres-secret/password)
-          
-          # Grant for authentik (as app user, owner of the DB)
-          psql -h ddb-cluster-rw -U app -d authentik << 'SQL'
-          GRANT ALL ON SCHEMA public TO app;
-          GRANT ALL ON SCHEMA public TO authentik;
-          ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON TABLES TO app;
-          ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON SEQUENCES TO app;
-          ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON TABLES TO authentik;
-          ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON SEQUENCES TO authentik;
-          SQL
-          
-          # Grant for temporal
-          psql -h ddb-cluster-rw -U app -d temporal << 'SQL'
-          GRANT ALL ON SCHEMA public TO app;
-          GRANT ALL ON SCHEMA public TO temporal;
-          ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON TABLES TO app;
-          ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON SEQUENCES TO app;
-          ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON TABLES TO temporal;
-          ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON SEQUENCES TO temporal;
-          SQL
-          
-          # Grant for temporal_visibility
-          psql -h ddb-cluster-rw -U app -d temporal_visibility << 'SQL'
-          GRANT ALL ON SCHEMA public TO app;
-          GRANT ALL ON SCHEMA public TO temporal;
-          ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON TABLES TO app;
-          ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON SEQUENCES TO app;
-          ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON TABLES TO temporal;
-          ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON SEQUENCES TO temporal;
-          SQL
-          
-          echo "Permissions granted successfully"
-        volumeMounts:
-        - name: postgres-secret
-          mountPath: /postgres-secret
-          readOnly: true
-      volumes:
-      - name: postgres-secret
-        secret:
-          secretName: ddb-cluster-app
diff --git a/k8s/data/schemas/kustomization.yaml b/k8s/data/schemas/kustomization.yaml
index f3b1d14..415fabf 100644
--- a/k8s/data/schemas/kustomization.yaml
+++ b/k8s/data/schemas/kustomization.yaml
@@ -8,7 +8,6 @@ namespace: ddb
 # GitOps-managed database schemas (ArgoCD wave 6).
 # These depend on ddb-cluster existing (bootstrap wave 0).
 resources:
-  - db-permissions-job.yaml
   - authentik-database.yaml
   - temporal-database.yaml
   - temporal-visibility-database.yaml