Story Crater Bot
c2bcda58d9
ARCHITECTURAL CHANGE: Align with CNPG design intent BEFORE (Complex, broken): - Per-app roles (authentik, temporal) with Database CR owner field - Database CR doesn't transfer ownership properly - Needed manual permission grants (PostSync Job) - Apps couldn't create tables without grants from 'app' role AFTER (Simple, works): - All apps use shared 'app' bootstrap user - Database CRs: owner: app (matches actual ownership) - No permission grants needed (owner has full rights) - Isolation via separate database names only CHANGES: - Database CRs: owner changed from app-specific to 'app' - ddb-cluster.yaml: removed managed.roles section - Deleted grant-schema-permissions PostSync Job - Follows Forgejo pattern (already working this way) MANUAL STEPS REQUIRED: 1. Update authentik-secrets: AUTHENTIK_POSTGRESQL__USER=app 2. Update temporal secrets: similar change 3. Recreate databases with app as owner 4. Restart applications Benefits: - Simpler architecture - No permission grant complexity - Aligns with CNPG single-cluster design - Matches working Forgejo implementation
18 lines
437 B
YAML
18 lines
437 B
YAML
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
kind: Kustomization
|
|
metadata:
|
|
name: data-schemas
|
|
|
|
namespace: ddb
|
|
|
|
# GitOps-managed database schemas (ArgoCD wave 6).
|
|
# These depend on ddb-cluster existing (bootstrap wave 0).
|
|
resources:
|
|
- authentik-database.yaml
|
|
- temporal-database.yaml
|
|
- temporal-visibility-database.yaml
|
|
- schemas.yaml
|
|
- db-init-job.yaml
|
|
|
|
# db-role-secrets.enc.yaml handled by SOPS secrets Application (wave 4)
|