4612b5e68d
Resolves the #63 root cause: CNPG managed.roles expects each role to reference its own type=kubernetes.io/basic-auth Secret with literal 'username'/'password' keys (see cloudnative-pg/internal/management/utils/secrets.go). The previous shared 'postgres-users' Secret with role-name-suffixed keys (forgejo-password, umami-password, scoble_audit_writer-password) was never going to reconcile, so forgejo/umami had been silently missing from the database for the entire lifetime of the cluster. Changes: - secret-{forgejo,umami,scrole}.yaml: per-role basic-auth Secrets in 'database' ns. forgejo/umami passwords stay at the existing <change-me> placeholder. scrole gets a new random 32-byte password. - secret-scoble-policy-pg-creds.yaml: Opaque Secret in 'scoble-policy' ns with username/password/jdbc-url for the audit-sink Integration to mount. - migrate.sql: drops the previous scoble_policy_audit (decision_id/actor/action shape) and recreates the schema.sql shape (agent_id/kamelet_ref/decision/etc.) with the right indexes, check constraint, and scrole GRANTs. - apply-schema-pod.yaml: one-shot Pod that runs migrate.sql using the CNPG superuser Secret as credential source. - schema.sql: now also documents the scrole GRANTs needed (idempotent). - README.md: updated with apply+verify steps, #62/#64 known issues, and the full diagnosis of #63. End-to-end verified 2026-06-07 23:55 UTC: - All 3 managed roles (forgejo, umami, scoble_audit_writer) exist in PG. - scrole can SELECT/INSERT on scoble_policy_audit. - A 'smoke-1' row is in the table; a Kafka message at scoble-kafka:9092 in the audit-sink shape is consumable end-to-end. - Legacy 'postgres-users' secret deleted (no longer referenced by the cluster). Refs: marcus/engineering#43, marcus/engineering#63
30 lines
1.6 KiB
SQL
30 lines
1.6 KiB
SQL
-- Apply the scoble_policy_audit schema. Idempotent.
|
|
--
|
|
-- USAGE (one-time, on a fresh CNPG cluster or to re-sync):
|
|
-- kubectl create configmap -n scobleclaw scrole-schema --from-file=schema.sql=audit-sink/schema.sql
|
|
-- kubectl apply -f audit-sink/provisioning/jobs/apply-schema-pod.yaml
|
|
-- kubectl logs -n scobleclaw apply-schema
|
|
--
|
|
-- The CNPG superuser password is in `postgres-scobleclaw-superuser` Secret
|
|
-- in the `database` namespace. We pass it via PGPASSWORD env var in the pod.
|
|
--
|
|
-- This schema is the audit-sink target table. The audit-sink Integration
|
|
-- (audit-sink-integration.yaml) expects these exact columns.
|
|
|
|
DROP TABLE IF EXISTS scoble_policy_audit CASCADE;
|
|
CREATE TABLE scoble_policy_audit (
|
|
id BIGSERIAL PRIMARY KEY,
|
|
timestamp TIMESTAMPTZ NOT NULL,
|
|
agent_id TEXT NOT NULL,
|
|
kamelet_ref TEXT NOT NULL,
|
|
decision TEXT NOT NULL CHECK (decision IN ('allow', 'deny', 'needs_l1', 'pending', 'escalated')),
|
|
reasons JSONB NOT NULL DEFAULT '[]'::jsonb,
|
|
rule_id TEXT,
|
|
request_id TEXT NOT NULL,
|
|
created_at TIMESTAMPTZ NOT NULL DEFAULT now()
|
|
);
|
|
CREATE INDEX scoble_policy_audit_agent_time ON scoble_policy_audit (agent_id, timestamp DESC);
|
|
CREATE INDEX scoble_policy_audit_decision_time ON scoble_policy_audit (decision, timestamp DESC) WHERE decision = 'deny';
|
|
CREATE UNIQUE INDEX scoble_policy_audit_request_id ON scoble_policy_audit (request_id);
|
|
GRANT SELECT, INSERT ON scoble_policy_audit TO scoble_audit_writer;
|
|
GRANT USAGE, SELECT ON SEQUENCE scoble_policy_audit_id_seq TO scoble_audit_writer;
|