rock/homelab
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(ddb): grant universal schema permissions to all roles

Browse Source 
Adds SQL to postInitApplicationSQL granting schema permissions to PUBLIC.
Allows any role (authentik, temporal, etc) to create tables in databases.

For existing cluster: run SQL manually (done).
For future bootstrap: automatic via initdb.

Pattern for apps: Database CR + app-specific init Job optional (co-located).
This commit is contained in:
Story Crater Bot
2026-07-23 08:07:34 -07:00
parent ec046cccde
commit 1c98628417
3 changed files with 5 additions and 100 deletions
Download Patch File Download Diff File Expand all files Collapse all files
k8s/data/cluster/ddb-cluster.yaml
+5
View File
@@ -26,6 +26,11 @@ spec:
- CREATE EXTENSION IF NOT EXISTS vector;
- CREATE EXTENSION IF NOT EXISTS pgcrypto;
- CREATE EXTENSION IF NOT EXISTS pg_trgm;
# Universal fix: grant schema permissions to all roles
# Allows any role to create tables in public schema of any database
- GRANT ALL ON SCHEMA public TO PUBLIC;
- ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON TABLES TO PUBLIC;
- ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON SEQUENCES TO PUBLIC;
# Per-app login roles, passwords sourced from secrets (CNPG reconciles the
# role password to match the secret). Their databases are separate Database