rock/homelab
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(ddb): add database-level CREATE privilege for schema creation

Browse Source 
Authentik migrations need to CREATE SCHEMA (not just tables in public schema).
This requires GRANT CREATE ON DATABASE, not just schema-level permissions.

Added to PostSync Job:
- GRANT CREATE ON DATABASE authentik TO authentik
- GRANT CREATE ON DATABASE temporal TO temporal
- GRANT CREATE ON DATABASE temporal_visibility TO temporal

App user can grant these (it owns the databases).
This commit is contained in:
Story Crater Bot
2026-07-23 09:36:23 -07:00
parent a55918e1f0
commit ce019f5f3a
1 changed files with 9 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
k8s/data/schemas/grant-schema-permissions-job.yaml
+9
View File
@@ -75,6 +75,9 @@ spec:
# Grant for authentik database
echo "Granting to authentik role in authentik database..."
psql -h "$PGHOST" -U "$PGUSER" -d authentik << 'SQL'
-- Database-level permission (needed for CREATE SCHEMA)
GRANT CREATE ON DATABASE authentik TO authentik;
-- Schema-level permissions
GRANT ALL ON SCHEMA public TO authentik;
GRANT ALL ON ALL TABLES IN SCHEMA public TO authentik;
GRANT ALL ON ALL SEQUENCES IN SCHEMA public TO authentik;
@@ -85,6 +88,9 @@ spec:
# Grant for temporal database
echo "Granting to temporal role in temporal database..."
psql -h "$PGHOST" -U "$PGUSER" -d temporal << 'SQL'
-- Database-level permission
GRANT CREATE ON DATABASE temporal TO temporal;
-- Schema-level permissions
GRANT ALL ON SCHEMA public TO temporal;
GRANT ALL ON ALL TABLES IN SCHEMA public TO temporal;
GRANT ALL ON ALL SEQUENCES IN SCHEMA public TO temporal;
@@ -95,6 +101,9 @@ spec:
# Grant for temporal_visibility database
echo "Granting to temporal role in temporal_visibility database..."
psql -h "$PGHOST" -U "$PGUSER" -d temporal_visibility << 'SQL'
-- Database-level permission
GRANT CREATE ON DATABASE temporal_visibility TO temporal;
-- Schema-level permissions
GRANT ALL ON SCHEMA public TO temporal;
GRANT ALL ON ALL TABLES IN SCHEMA public TO temporal;
GRANT ALL ON ALL SEQUENCES IN SCHEMA public TO temporal;