rock/homelab
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(ddb): add PostSync Job for per-database schema permissions

Browse Source 
ROOT CAUSE: CNPG Database CR creates databases but doesn't grant schema
permissions to the owner role. Bootstrap DB owner 'app' retains CREATE
privilege on public schema, blocking authentik/temporal from creating tables.

SECURITY FIX: Removed insecure 'GRANT TO PUBLIC' from postInitApplicationSQL.

SOLUTION: PostSync Job connects as 'app' (DB owner) and grants schema
permissions to named roles (authentik, temporal) in their respective databases.
Runs after Database CRs reconcile, survives CNPG database recreation.

Pattern: Per-database grants via PostSync, not cluster-wide PUBLIC grants.
This commit is contained in:
Story Crater Bot
2026-07-23 09:02:19 -07:00
parent 1c98628417
commit 2499cc241f
3 changed files with 114 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
k8s/data/cluster/ddb-cluster.yaml
-5
View File
@@ -26,11 +26,6 @@ spec:
- CREATE EXTENSION IF NOT EXISTS vector;
- CREATE EXTENSION IF NOT EXISTS pgcrypto;
- CREATE EXTENSION IF NOT EXISTS pg_trgm;
# Universal fix: grant schema permissions to all roles
# Allows any role to create tables in public schema of any database
- GRANT ALL ON SCHEMA public TO PUBLIC;
- ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON TABLES TO PUBLIC;
- ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON SEQUENCES TO PUBLIC;
# Per-app login roles, passwords sourced from secrets (CNPG reconciles the
# role password to match the secret). Their databases are separate Database