From 9d485d12387e17556455426cfc4041110a9a5d69 Mon Sep 17 00:00:00 2001
From: Story Crater Bot <19826264+Riotpiaole@users.noreply.github.com>
Date: Thu, 23 Jul 2026 08:02:44 -0700
Subject: [PATCH] fix(ddb): add PostSync Job for database schema permissions

CNPG Database CR creates DBs but doesn't grant schema permissions properly.
Database owner is 'app' instead of specified role (authentik, temporal).

PostSync Job grants ALL on schema public to both app and named roles,
ensuring applications can create tables. Runs after Database CRs reconcile.

Fixes: authentik InsufficientPrivilege error on migration.
---
 k8s/data/schemas/db-permissions-job.yaml | 99 ++++++++++++++++++++++++
 k8s/data/schemas/kustomization.yaml      |  1 +
 2 files changed, 100 insertions(+)
 create mode 100644 k8s/data/schemas/db-permissions-job.yaml

diff --git a/k8s/data/schemas/db-permissions-job.yaml b/k8s/data/schemas/db-permissions-job.yaml
new file mode 100644
index 0000000..5ad6c05
--- /dev/null
+++ b/k8s/data/schemas/db-permissions-job.yaml
@@ -0,0 +1,99 @@
+# PostSync Job to grant schema permissions after Database CRs reconcile
+# CNPG Database CR creates DBs but doesn't set schema permissions correctly
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: db-permissions
+  namespace: ddb
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: db-permissions
+  namespace: ddb
+rules:
+  - apiGroups: [""]
+    resources: ["secrets"]
+    verbs: ["get"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: db-permissions
+  namespace: ddb
+subjects:
+  - kind: ServiceAccount
+    name: db-permissions
+    namespace: ddb
+roleRef:
+  kind: Role
+  name: db-permissions
+  apiGroup: rbac.authorization.k8s.io
+---
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: db-permissions
+  namespace: ddb
+  annotations:
+    argocd.argoproj.io/hook: PostSync
+    argocd.argoproj.io/hook-delete-policy: BeforeHookCreation
+spec:
+  backoffLimit: 5
+  template:
+    spec:
+      serviceAccountName: db-permissions
+      restartPolicy: Never
+      containers:
+      - name: grant-permissions
+        image: postgres:16-alpine
+        command:
+        - /bin/sh
+        - -c
+        - |
+          set -e
+          
+          echo "Granting schema permissions to app users..."
+          
+          # Get postgres password
+          export PGPASSWORD=$(cat /postgres-secret/password)
+          
+          # Grant for authentik
+          psql -h ddb-cluster-rw -U postgres -d authentik << 'SQL'
+          GRANT ALL ON SCHEMA public TO app;
+          GRANT ALL ON SCHEMA public TO authentik;
+          ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON TABLES TO app;
+          ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON SEQUENCES TO app;
+          ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON TABLES TO authentik;
+          ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON SEQUENCES TO authentik;
+          SQL
+          
+          # Grant for temporal
+          psql -h ddb-cluster-rw -U postgres -d temporal << 'SQL'
+          GRANT ALL ON SCHEMA public TO app;
+          GRANT ALL ON SCHEMA public TO temporal;
+          ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON TABLES TO app;
+          ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON SEQUENCES TO app;
+          ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON TABLES TO temporal;
+          ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON SEQUENCES TO temporal;
+          SQL
+          
+          # Grant for temporal_visibility
+          psql -h ddb-cluster-rw -U postgres -d temporal_visibility << 'SQL'
+          GRANT ALL ON SCHEMA public TO app;
+          GRANT ALL ON SCHEMA public TO temporal;
+          ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON TABLES TO app;
+          ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON SEQUENCES TO app;
+          ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON TABLES TO temporal;
+          ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON SEQUENCES TO temporal;
+          SQL
+          
+          echo "Permissions granted successfully"
+        volumeMounts:
+        - name: postgres-secret
+          mountPath: /postgres-secret
+          readOnly: true
+      volumes:
+      - name: postgres-secret
+        secret:
+          secretName: ddb-cluster-superuser
diff --git a/k8s/data/schemas/kustomization.yaml b/k8s/data/schemas/kustomization.yaml
index 415fabf..f3b1d14 100644
--- a/k8s/data/schemas/kustomization.yaml
+++ b/k8s/data/schemas/kustomization.yaml
@@ -8,6 +8,7 @@ namespace: ddb
 # GitOps-managed database schemas (ArgoCD wave 6).
 # These depend on ddb-cluster existing (bootstrap wave 0).
 resources:
+  - db-permissions-job.yaml
   - authentik-database.yaml
   - temporal-database.yaml
   - temporal-visibility-database.yaml