From ec046cccdeebe0a709b5f1be2590df307c6162e9 Mon Sep 17 00:00:00 2001 From: Story Crater Bot <19826264+Riotpiaole@users.noreply.github.com> Date: Thu, 23 Jul 2026 08:05:03 -0700 Subject: [PATCH] fix(ddb): use app user credentials in db-permissions Job ddb-cluster-superuser secret doesn't exist (not configured). Use ddb-cluster-app secret instead - app is DB owner, can grant permissions. --- k8s/data/schemas/db-permissions-job.yaml | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/k8s/data/schemas/db-permissions-job.yaml b/k8s/data/schemas/db-permissions-job.yaml index 5ad6c05..f4fc119 100644 --- a/k8s/data/schemas/db-permissions-job.yaml +++ b/k8s/data/schemas/db-permissions-job.yaml @@ -55,11 +55,11 @@ spec: echo "Granting schema permissions to app users..." - # Get postgres password + # Get app user password export PGPASSWORD=$(cat /postgres-secret/password) - # Grant for authentik - psql -h ddb-cluster-rw -U postgres -d authentik << 'SQL' + # Grant for authentik (as app user, owner of the DB) + psql -h ddb-cluster-rw -U app -d authentik << 'SQL' GRANT ALL ON SCHEMA public TO app; GRANT ALL ON SCHEMA public TO authentik; ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON TABLES TO app; @@ -69,7 +69,7 @@ spec: SQL # Grant for temporal - psql -h ddb-cluster-rw -U postgres -d temporal << 'SQL' + psql -h ddb-cluster-rw -U app -d temporal << 'SQL' GRANT ALL ON SCHEMA public TO app; GRANT ALL ON SCHEMA public TO temporal; ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON TABLES TO app; @@ -79,7 +79,7 @@ spec: SQL # Grant for temporal_visibility - psql -h ddb-cluster-rw -U postgres -d temporal_visibility << 'SQL' + psql -h ddb-cluster-rw -U app -d temporal_visibility << 'SQL' GRANT ALL ON SCHEMA public TO app; GRANT ALL ON SCHEMA public TO temporal; ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON TABLES TO app; @@ -96,4 +96,4 @@ spec: volumes: - name: postgres-secret secret: - secretName: ddb-cluster-superuser + secretName: ddb-cluster-app