Story Crater Bot
2499cc241f
ROOT CAUSE: CNPG Database CR creates databases but doesn't grant schema permissions to the owner role. Bootstrap DB owner 'app' retains CREATE privilege on public schema, blocking authentik/temporal from creating tables. SECURITY FIX: Removed insecure 'GRANT TO PUBLIC' from postInitApplicationSQL. SOLUTION: PostSync Job connects as 'app' (DB owner) and grants schema permissions to named roles (authentik, temporal) in their respective databases. Runs after Database CRs reconcile, survives CNPG database recreation. Pattern: Per-database grants via PostSync, not cluster-wide PUBLIC grants.
19 lines
475 B
YAML
19 lines
475 B
YAML
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
kind: Kustomization
|
|
metadata:
|
|
name: data-schemas
|
|
|
|
namespace: ddb
|
|
|
|
# GitOps-managed database schemas (ArgoCD wave 6).
|
|
# These depend on ddb-cluster existing (bootstrap wave 0).
|
|
resources:
|
|
- grant-schema-permissions-job.yaml
|
|
- authentik-database.yaml
|
|
- temporal-database.yaml
|
|
- temporal-visibility-database.yaml
|
|
- schemas.yaml
|
|
- db-init-job.yaml
|
|
|
|
# db-role-secrets.enc.yaml handled by SOPS secrets Application (wave 4)
|