114 lines
4.0 KiB
YAML
114 lines
4.0 KiB
YAML
# PostSync Job to grant schema permissions after Database CRs reconcile
|
|
#
|
|
# ROOT CAUSE: CNPG Database CR creates databases but doesn't grant schema
|
|
# permissions to the specified owner role. The bootstrap database owner
|
|
# (app) retains CREATE privilege on public schema, blocking other roles.
|
|
#
|
|
# SOLUTION: After Database CRs reconcile, connect as 'app' (DB owner) and
|
|
# grant ALL on schema public to each Database's owner role.
|
|
#
|
|
# This runs every sync (BeforeHookCreation policy), ensuring permissions
|
|
# survive CNPG database recreation or cluster rebuilds.
|
|
apiVersion: v1
|
|
kind: ServiceAccount
|
|
metadata:
|
|
name: grant-schema-permissions
|
|
namespace: ddb
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: Role
|
|
metadata:
|
|
name: grant-schema-permissions
|
|
namespace: ddb
|
|
rules:
|
|
- apiGroups: [""]
|
|
resources: ["secrets"]
|
|
verbs: ["get"]
|
|
- apiGroups: ["postgresql.cnpg.io"]
|
|
resources: ["databases"]
|
|
verbs: ["list", "get"]
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: RoleBinding
|
|
metadata:
|
|
name: grant-schema-permissions
|
|
namespace: ddb
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: grant-schema-permissions
|
|
namespace: ddb
|
|
roleRef:
|
|
kind: Role
|
|
name: grant-schema-permissions
|
|
apiGroup: rbac.authorization.k8s.io
|
|
---
|
|
apiVersion: batch/v1
|
|
kind: Job
|
|
metadata:
|
|
name: grant-schema-permissions
|
|
namespace: ddb
|
|
annotations:
|
|
argocd.argoproj.io/hook: PostSync
|
|
argocd.argoproj.io/hook-delete-policy: BeforeHookCreation
|
|
spec:
|
|
backoffLimit: 5
|
|
template:
|
|
spec:
|
|
serviceAccountName: grant-schema-permissions
|
|
restartPolicy: Never
|
|
containers:
|
|
- name: grant-permissions
|
|
image: postgres:16-alpine
|
|
command:
|
|
- /bin/sh
|
|
- -c
|
|
- |
|
|
set -e
|
|
|
|
echo "Granting schema permissions to database owners..."
|
|
|
|
# Get app user password (owns all databases)
|
|
export PGPASSWORD=$(cat /app-secret/password)
|
|
PGHOST=ddb-cluster-rw.ddb.svc.cluster.local
|
|
PGUSER=app
|
|
|
|
# Grant for authentik database
|
|
echo "Granting to authentik role in authentik database..."
|
|
psql -h "$PGHOST" -U "$PGUSER" -d authentik << 'SQL'
|
|
GRANT ALL ON SCHEMA public TO authentik;
|
|
GRANT ALL ON ALL TABLES IN SCHEMA public TO authentik;
|
|
GRANT ALL ON ALL SEQUENCES IN SCHEMA public TO authentik;
|
|
ALTER DEFAULT PRIVILEGES FOR ROLE app IN SCHEMA public GRANT ALL ON TABLES TO authentik;
|
|
ALTER DEFAULT PRIVILEGES FOR ROLE app IN SCHEMA public GRANT ALL ON SEQUENCES TO authentik;
|
|
SQL
|
|
|
|
# Grant for temporal database
|
|
echo "Granting to temporal role in temporal database..."
|
|
psql -h "$PGHOST" -U "$PGUSER" -d temporal << 'SQL'
|
|
GRANT ALL ON SCHEMA public TO temporal;
|
|
GRANT ALL ON ALL TABLES IN SCHEMA public TO temporal;
|
|
GRANT ALL ON ALL SEQUENCES IN SCHEMA public TO temporal;
|
|
ALTER DEFAULT PRIVILEGES FOR ROLE app IN SCHEMA public GRANT ALL ON TABLES TO temporal;
|
|
ALTER DEFAULT PRIVILEGES FOR ROLE app IN SCHEMA public GRANT ALL ON SEQUENCES TO temporal;
|
|
SQL
|
|
|
|
# Grant for temporal_visibility database
|
|
echo "Granting to temporal role in temporal_visibility database..."
|
|
psql -h "$PGHOST" -U "$PGUSER" -d temporal_visibility << 'SQL'
|
|
GRANT ALL ON SCHEMA public TO temporal;
|
|
GRANT ALL ON ALL TABLES IN SCHEMA public TO temporal;
|
|
GRANT ALL ON ALL SEQUENCES IN SCHEMA public TO temporal;
|
|
ALTER DEFAULT PRIVILEGES FOR ROLE app IN SCHEMA public GRANT ALL ON TABLES TO temporal;
|
|
ALTER DEFAULT PRIVILEGES FOR ROLE app IN SCHEMA public GRANT ALL ON SEQUENCES TO temporal;
|
|
SQL
|
|
|
|
echo "✅ Schema permissions granted successfully"
|
|
volumeMounts:
|
|
- name: app-secret
|
|
mountPath: /app-secret
|
|
readOnly: true
|
|
volumes:
|
|
- name: app-secret
|
|
secret:
|
|
secretName: ddb-cluster-app
|