fix(temporal): provision schema via CNPG temporal_visibility Database CR + enable chart schema setup/update jobs — both DBs had zero tables so server died on 'no usable database connection'

k8s/applications/temporal/temporal-values.yaml

@@ -43,19 +43,20 @@ grafana:
   enabled: false
 
 # ── Schema setup/update Jobs ──────────────────────────────────────────────────
-# Disabled: ddb-cluster's seed job (k8s/data/db-init-job.yaml) already creates
+# The `temporal` and `temporal_visibility` databases are provisioned
-# the `temporal` and `temporal_visibility` databases and runs the Temporal
+# declaratively by CNPG Database CRs (k8s/data/temporal-database.yaml,
-# schema migrations out of band. Leaving these at their chart default (true)
+# temporal-visibility-database.yaml), so createDatabase stays disabled (the
-# would spin up a schema Job on every sync that tries to wait-for-cassandra
+# `temporal` role also lacks CREATEDB). setup/update run temporal-sql-tool as
-# and run cassandra-tool commands (see note above) - pointless for us even
+# the `temporal` owner against those existing DBs to install and migrate the
-# once correctly pointed at Postgres, since schema is already seeded.
+# Temporal server schema — without them both DBs have zero tables and the
+# server dies on "no usable database connection found" (no schema_version row).
 schema:
   createDatabase:
     enabled: false
   setup:
-    enabled: false
+    enabled: true
   update:
-    enabled: false
+    enabled: true
 
 # ── Temporal server config (PostgreSQL persistence) ──────────────────────────
 server:

k8s/data/kustomization.yaml

@@ -16,5 +16,6 @@ resources:
   - forgejo-database.yaml
   - authentik-database.yaml
   - temporal-database.yaml
+  - temporal-visibility-database.yaml
 # db-role-secrets.enc.yaml is applied out-of-band (SOPS-encrypted, bootstrap) —
 # NOT listed here, or the data-schemas ArgoCD app would fail on the ciphertext.

k8s/data/temporal-visibility-database.yaml

@@ -0,0 +1,10 @@
+apiVersion: postgresql.cnpg.io/v1
+kind: Database
+metadata:
+  name: temporal-visibility
+  namespace: ddb
+spec:
+  name: temporal_visibility
+  owner: temporal
+  cluster:
+    name: ddb-cluster