From 46ec0caf5d4cf0833144c4472395a8fdf88b42fe Mon Sep 17 00:00:00 2001
From: Story Crater Bot <19826264+Riotpiaole@users.noreply.github.com>
Date: Tue, 21 Jul 2026 21:09:03 -0700
Subject: [PATCH] =?UTF-8?q?fix(temporal):=20provision=20schema=20via=20CNP?=
 =?UTF-8?q?G=20temporal=5Fvisibility=20Database=20CR=20+=20enable=20chart?=
 =?UTF-8?q?=20schema=20setup/update=20jobs=20=E2=80=94=20both=20DBs=20had?=
 =?UTF-8?q?=20zero=20tables=20so=20server=20died=20on=20'no=20usable=20dat?=
 =?UTF-8?q?abase=20connection'?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 k8s/applications/temporal/temporal-values.yaml | 17 +++++++++--------
 k8s/data/kustomization.yaml                    |  1 +
 k8s/data/temporal-visibility-database.yaml     | 10 ++++++++++
 3 files changed, 20 insertions(+), 8 deletions(-)
 create mode 100644 k8s/data/temporal-visibility-database.yaml

diff --git a/k8s/applications/temporal/temporal-values.yaml b/k8s/applications/temporal/temporal-values.yaml
index 952eed3..7d44ee9 100644
--- a/k8s/applications/temporal/temporal-values.yaml
+++ b/k8s/applications/temporal/temporal-values.yaml
@@ -43,19 +43,20 @@ grafana:
   enabled: false
 
 # ── Schema setup/update Jobs ──────────────────────────────────────────────────
-# Disabled: ddb-cluster's seed job (k8s/data/db-init-job.yaml) already creates
-# the `temporal` and `temporal_visibility` databases and runs the Temporal
-# schema migrations out of band. Leaving these at their chart default (true)
-# would spin up a schema Job on every sync that tries to wait-for-cassandra
-# and run cassandra-tool commands (see note above) - pointless for us even
-# once correctly pointed at Postgres, since schema is already seeded.
+# The `temporal` and `temporal_visibility` databases are provisioned
+# declaratively by CNPG Database CRs (k8s/data/temporal-database.yaml,
+# temporal-visibility-database.yaml), so createDatabase stays disabled (the
+# `temporal` role also lacks CREATEDB). setup/update run temporal-sql-tool as
+# the `temporal` owner against those existing DBs to install and migrate the
+# Temporal server schema — without them both DBs have zero tables and the
+# server dies on "no usable database connection found" (no schema_version row).
 schema:
   createDatabase:
     enabled: false
   setup:
-    enabled: false
+    enabled: true
   update:
-    enabled: false
+    enabled: true
 
 # ── Temporal server config (PostgreSQL persistence) ──────────────────────────
 server:
diff --git a/k8s/data/kustomization.yaml b/k8s/data/kustomization.yaml
index 8f46450..94c358c 100644
--- a/k8s/data/kustomization.yaml
+++ b/k8s/data/kustomization.yaml
@@ -16,5 +16,6 @@ resources:
   - forgejo-database.yaml
   - authentik-database.yaml
   - temporal-database.yaml
+  - temporal-visibility-database.yaml
 # db-role-secrets.enc.yaml is applied out-of-band (SOPS-encrypted, bootstrap) —
 # NOT listed here, or the data-schemas ArgoCD app would fail on the ciphertext.
diff --git a/k8s/data/temporal-visibility-database.yaml b/k8s/data/temporal-visibility-database.yaml
new file mode 100644
index 0000000..4ec95c0
--- /dev/null
+++ b/k8s/data/temporal-visibility-database.yaml
@@ -0,0 +1,10 @@
+apiVersion: postgresql.cnpg.io/v1
+kind: Database
+metadata:
+  name: temporal-visibility
+  namespace: ddb
+spec:
+  name: temporal_visibility
+  owner: temporal
+  cluster:
+    name: ddb-cluster