Story Crater Bot
9d485d1238
CNPG Database CR creates DBs but doesn't grant schema permissions properly. Database owner is 'app' instead of specified role (authentik, temporal). PostSync Job grants ALL on schema public to both app and named roles, ensuring applications can create tables. Runs after Database CRs reconcile. Fixes: authentik InsufficientPrivilege error on migration.
100 lines
3.2 KiB
YAML
100 lines
3.2 KiB
YAML
# PostSync Job to grant schema permissions after Database CRs reconcile
|
|
# CNPG Database CR creates DBs but doesn't set schema permissions correctly
|
|
apiVersion: v1
|
|
kind: ServiceAccount
|
|
metadata:
|
|
name: db-permissions
|
|
namespace: ddb
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: Role
|
|
metadata:
|
|
name: db-permissions
|
|
namespace: ddb
|
|
rules:
|
|
- apiGroups: [""]
|
|
resources: ["secrets"]
|
|
verbs: ["get"]
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: RoleBinding
|
|
metadata:
|
|
name: db-permissions
|
|
namespace: ddb
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: db-permissions
|
|
namespace: ddb
|
|
roleRef:
|
|
kind: Role
|
|
name: db-permissions
|
|
apiGroup: rbac.authorization.k8s.io
|
|
---
|
|
apiVersion: batch/v1
|
|
kind: Job
|
|
metadata:
|
|
name: db-permissions
|
|
namespace: ddb
|
|
annotations:
|
|
argocd.argoproj.io/hook: PostSync
|
|
argocd.argoproj.io/hook-delete-policy: BeforeHookCreation
|
|
spec:
|
|
backoffLimit: 5
|
|
template:
|
|
spec:
|
|
serviceAccountName: db-permissions
|
|
restartPolicy: Never
|
|
containers:
|
|
- name: grant-permissions
|
|
image: postgres:16-alpine
|
|
command:
|
|
- /bin/sh
|
|
- -c
|
|
- |
|
|
set -e
|
|
|
|
echo "Granting schema permissions to app users..."
|
|
|
|
# Get postgres password
|
|
export PGPASSWORD=$(cat /postgres-secret/password)
|
|
|
|
# Grant for authentik
|
|
psql -h ddb-cluster-rw -U postgres -d authentik << 'SQL'
|
|
GRANT ALL ON SCHEMA public TO app;
|
|
GRANT ALL ON SCHEMA public TO authentik;
|
|
ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON TABLES TO app;
|
|
ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON SEQUENCES TO app;
|
|
ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON TABLES TO authentik;
|
|
ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON SEQUENCES TO authentik;
|
|
SQL
|
|
|
|
# Grant for temporal
|
|
psql -h ddb-cluster-rw -U postgres -d temporal << 'SQL'
|
|
GRANT ALL ON SCHEMA public TO app;
|
|
GRANT ALL ON SCHEMA public TO temporal;
|
|
ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON TABLES TO app;
|
|
ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON SEQUENCES TO app;
|
|
ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON TABLES TO temporal;
|
|
ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON SEQUENCES TO temporal;
|
|
SQL
|
|
|
|
# Grant for temporal_visibility
|
|
psql -h ddb-cluster-rw -U postgres -d temporal_visibility << 'SQL'
|
|
GRANT ALL ON SCHEMA public TO app;
|
|
GRANT ALL ON SCHEMA public TO temporal;
|
|
ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON TABLES TO app;
|
|
ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON SEQUENCES TO app;
|
|
ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON TABLES TO temporal;
|
|
ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON SEQUENCES TO temporal;
|
|
SQL
|
|
|
|
echo "Permissions granted successfully"
|
|
volumeMounts:
|
|
- name: postgres-secret
|
|
mountPath: /postgres-secret
|
|
readOnly: true
|
|
volumes:
|
|
- name: postgres-secret
|
|
secret:
|
|
secretName: ddb-cluster-superuser
|