Story Crater Bot
c2bcda58d9
ARCHITECTURAL CHANGE: Align with CNPG design intent BEFORE (Complex, broken): - Per-app roles (authentik, temporal) with Database CR owner field - Database CR doesn't transfer ownership properly - Needed manual permission grants (PostSync Job) - Apps couldn't create tables without grants from 'app' role AFTER (Simple, works): - All apps use shared 'app' bootstrap user - Database CRs: owner: app (matches actual ownership) - No permission grants needed (owner has full rights) - Isolation via separate database names only CHANGES: - Database CRs: owner changed from app-specific to 'app' - ddb-cluster.yaml: removed managed.roles section - Deleted grant-schema-permissions PostSync Job - Follows Forgejo pattern (already working this way) MANUAL STEPS REQUIRED: 1. Update authentik-secrets: AUTHENTIK_POSTGRESQL__USER=app 2. Update temporal secrets: similar change 3. Recreate databases with app as owner 4. Restart applications Benefits: - Simpler architecture - No permission grant complexity - Aligns with CNPG single-cluster design - Matches working Forgejo implementation
11 lines
220 B
YAML
11 lines
220 B
YAML
apiVersion: postgresql.cnpg.io/v1
|
|
kind: Database
|
|
metadata:
|
|
name: authentik
|
|
namespace: ddb
|
|
spec:
|
|
name: authentik
|
|
owner: app # All apps use shared 'app' user (CNPG design pattern)
|
|
cluster:
|
|
name: ddb-cluster
|