4612b5e68d
Resolves the #63 root cause: CNPG managed.roles expects each role to reference its own type=kubernetes.io/basic-auth Secret with literal 'username'/'password' keys (see cloudnative-pg/internal/management/utils/secrets.go). The previous shared 'postgres-users' Secret with role-name-suffixed keys (forgejo-password, umami-password, scoble_audit_writer-password) was never going to reconcile, so forgejo/umami had been silently missing from the database for the entire lifetime of the cluster. Changes: - secret-{forgejo,umami,scrole}.yaml: per-role basic-auth Secrets in 'database' ns. forgejo/umami passwords stay at the existing <change-me> placeholder. scrole gets a new random 32-byte password. - secret-scoble-policy-pg-creds.yaml: Opaque Secret in 'scoble-policy' ns with username/password/jdbc-url for the audit-sink Integration to mount. - migrate.sql: drops the previous scoble_policy_audit (decision_id/actor/action shape) and recreates the schema.sql shape (agent_id/kamelet_ref/decision/etc.) with the right indexes, check constraint, and scrole GRANTs. - apply-schema-pod.yaml: one-shot Pod that runs migrate.sql using the CNPG superuser Secret as credential source. - schema.sql: now also documents the scrole GRANTs needed (idempotent). - README.md: updated with apply+verify steps, #62/#64 known issues, and the full diagnosis of #63. End-to-end verified 2026-06-07 23:55 UTC: - All 3 managed roles (forgejo, umami, scoble_audit_writer) exist in PG. - scrole can SELECT/INSERT on scoble_policy_audit. - A 'smoke-1' row is in the table; a Kafka message at scoble-kafka:9092 in the audit-sink shape is consumable end-to-end. - Legacy 'postgres-users' secret deleted (no longer referenced by the cluster). Refs: marcus/engineering#43, marcus/engineering#63
32 lines
834 B
YAML
32 lines
834 B
YAML
apiVersion: v1
|
|
kind: Pod
|
|
metadata:
|
|
name: apply-schema
|
|
namespace: scobleclaw
|
|
spec:
|
|
restartPolicy: Never
|
|
containers:
|
|
- name: psql
|
|
image: postgres:17-alpine
|
|
command: ["/bin/sh", "-c"]
|
|
args:
|
|
- |
|
|
apk add --no-cache postgresql-client >/dev/null 2>&1
|
|
SUPER_PW=$(cat /secrets/super/password)
|
|
PGPASSWORD="$SUPER_PW" psql \
|
|
-h postgres-scobleclaw-rw.database.svc.cluster.local \
|
|
-U postgres -d app -v ON_ERROR_STOP=1 \
|
|
-f /sql/migrate.sql
|
|
env:
|
|
- name: PGPASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: postgres-scobleclaw-superuser
|
|
key: password
|
|
volumeMounts:
|
|
- name: sql
|
|
mountPath: /sql
|
|
volumes:
|
|
- name: sql
|
|
configMap:
|
|
name: scrole-schema
|