Story Crater Bot
2499cc241f
ROOT CAUSE: CNPG Database CR creates databases but doesn't grant schema permissions to the owner role. Bootstrap DB owner 'app' retains CREATE privilege on public schema, blocking authentik/temporal from creating tables. SECURITY FIX: Removed insecure 'GRANT TO PUBLIC' from postInitApplicationSQL. SOLUTION: PostSync Job connects as 'app' (DB owner) and grants schema permissions to named roles (authentik, temporal) in their respective databases. Runs after Database CRs reconcile, survives CNPG database recreation. Pattern: Per-database grants via PostSync, not cluster-wide PUBLIC grants.
81 lines
2.1 KiB
YAML
81 lines
2.1 KiB
YAML
apiVersion: postgresql.cnpg.io/v1
|
|
kind: Cluster
|
|
metadata:
|
|
name: ddb-cluster
|
|
namespace: ddb
|
|
labels:
|
|
app: postgresql
|
|
layer: data
|
|
spec:
|
|
# 3-replica cluster — distributed across control-plane nodes (cp-1, cp-2, cp-3)
|
|
# Provides HA for Forgejo and other stateful apps using shared DDB
|
|
instances: 3
|
|
|
|
# PostgreSQL 16.2
|
|
imageName: ghcr.io/cloudnative-pg/postgresql:16.2
|
|
|
|
# Bootstrap: create app database + extensions
|
|
bootstrap:
|
|
initdb:
|
|
database: app
|
|
owner: app
|
|
encoding: UTF8
|
|
localeCollate: C
|
|
localeCType: C
|
|
postInitApplicationSQL:
|
|
- CREATE EXTENSION IF NOT EXISTS vector;
|
|
- CREATE EXTENSION IF NOT EXISTS pgcrypto;
|
|
- CREATE EXTENSION IF NOT EXISTS pg_trgm;
|
|
|
|
# Per-app login roles, passwords sourced from secrets (CNPG reconciles the
|
|
# role password to match the secret). Their databases are separate Database
|
|
# CRs (see authentik-database.yaml / temporal-database.yaml) owned by these
|
|
# roles. Replaces the old helmfile post-sync user-creation hook.
|
|
managed:
|
|
roles:
|
|
- name: authentik
|
|
ensure: present
|
|
login: true
|
|
passwordSecret:
|
|
name: authentik-db-role
|
|
- name: temporal
|
|
ensure: present
|
|
login: true
|
|
passwordSecret:
|
|
name: temporal-db-role
|
|
|
|
# Disable superuser (security)
|
|
enableSuperuserAccess: false
|
|
|
|
# PostgreSQL configuration
|
|
postgresql:
|
|
parameters:
|
|
shared_buffers: "256MB"
|
|
max_parallel_workers: "4"
|
|
max_parallel_workers_per_gather: "4"
|
|
# WAL archiving for backups
|
|
archive_mode: "on"
|
|
archive_timeout: "5min"
|
|
log_destination: "csvlog"
|
|
log_directory: "/controller/log"
|
|
log_filename: "postgres"
|
|
log_rotation_age: "0"
|
|
dynamic_shared_memory_type: "posix"
|
|
|
|
# Storage on Longhorn
|
|
storage:
|
|
size: 10Gi
|
|
storageClass: longhorn
|
|
|
|
# Monitoring
|
|
monitoring:
|
|
enablePodMonitor: false
|
|
disableDefaultQueries: false
|
|
customQueriesConfigMap:
|
|
- name: cnpg-default-monitoring
|
|
key: queries
|
|
|
|
# Pod anti-affinity for spreading replicas
|
|
affinity:
|
|
podAntiAffinityType: preferred
|