fix(outline): declare the database owner role #707

Merged

binjovi-bot merged 1 commit from fix/outline-database-role into trunk 2026-09-13 13:14:34 +00:00

Conversation 0 Commits 1 Files changed 2 +38

sean commented 2026-09-13 13:12:56 +00:00

Owner

Copy link

Follow-up to #705, found by deploying it.

The failure

The outline Database CR came up APPLIED=false:

while creating database "outline": ERROR: role "outline" does not exist (SQLSTATE 42704)

CNPG will not create a database whose owner role is absent, and it reports
that only in the CR's own status — the Flux Kustomization went True and the
deploy verified, because a Database CR that never applies is not an unhealthy
resource.

The wider gap this exposed

No tenant owner role is declared anywhere in this repository.
tenantdatabase/argo.yaml says its role is "created by
cnpg-instance/arm-cluster.yaml managed.roles" — and that file had no managed
block at all, nor does the live cluster. app, argo, binjovi,
binjovi_staging, forgejo, hydra, kratos and n8n all exist in Postgres
and none is declared. They were created by the retired Crossplane composition or
by hand, and survive only because nothing has rebuilt this cluster since.

That bears on the north star directly: make rebuild with zero manual
intervention would not recreate them.

What this does, and what it deliberately does not

Adds spec.managed.roles with outline only.

• No passwordSecret, disablePassword unset. CNPG manages a role's
  password only when given one, so the password stays owned by the
  OpenBaoDatabaseStaticRole that rotates it. Two controllers writing the same
  field every reconcile is the failure being avoided.
• The other eight roles are NOT adopted here. CNPG reconciles the attributes
  of every role it is given, so listing a live role is a change to that role, not
  a no-op. That wants its own verified pass, not a side effect of onboarding a
  wiki. The reasoning is recorded in the manifest.

Guard

tests/outline.sh now reads the owner out of the Database CR and asserts a
matching managed role on postgres-arm — proved red without the fix. Two of its
own pipelines were also fixed after tests/no-sigpipe-readers.sh caught them
(| head -1 and | grep -Fqx, both early-exiting readers under pipefail).

108 guards green.

https://claude.ai/code/session_01JGe4pyhQ36AhgDfPJry4d3

Follow-up to #705, found by deploying it. ## The failure The `outline` Database CR came up `APPLIED=false`: ``` while creating database "outline": ERROR: role "outline" does not exist (SQLSTATE 42704) ``` CNPG will not create a database whose `owner` role is absent, and it reports that only in the CR's own status — the Flux Kustomization went `True` and the deploy verified, because a Database CR that never applies is not an unhealthy resource. ## The wider gap this exposed **No tenant owner role is declared anywhere in this repository.** `tenantdatabase/argo.yaml` says its role is "created by `cnpg-instance/arm-cluster.yaml managed.roles`" — and that file had no `managed` block at all, nor does the live cluster. `app`, `argo`, `binjovi`, `binjovi_staging`, `forgejo`, `hydra`, `kratos` and `n8n` all exist in Postgres and none is declared. They were created by the retired Crossplane composition or by hand, and survive only because nothing has rebuilt this cluster since. That bears on the north star directly: `make rebuild` with zero manual intervention would not recreate them. ## What this does, and what it deliberately does not Adds `spec.managed.roles` with `outline` only. - **No `passwordSecret`, `disablePassword` unset.** CNPG manages a role's password only when given one, so the password stays owned by the `OpenBaoDatabaseStaticRole` that rotates it. Two controllers writing the same field every reconcile is the failure being avoided. - **The other eight roles are NOT adopted here.** CNPG reconciles the attributes of every role it is given, so listing a live role is a change to that role, not a no-op. That wants its own verified pass, not a side effect of onboarding a wiki. The reasoning is recorded in the manifest. ## Guard `tests/outline.sh` now reads the owner out of the Database CR and asserts a matching managed role on `postgres-arm` — proved red without the fix. Two of its own pipelines were also fixed after `tests/no-sigpipe-readers.sh` caught them (`| head -1` and `| grep -Fqx`, both early-exiting readers under `pipefail`). 108 guards green. https://claude.ai/code/session_01JGe4pyhQ36AhgDfPJry4d3

sean added 1 commit 2026-09-13 13:12:57 +00:00

fix(outline): declare the database owner role ... dedaa96bd2

CNPG refuses to create a database whose owner role is absent. The
outline Database CR failed on deploy with

  ERROR: role "outline" does not exist (SQLSTATE 42704)

and sat APPLIED=false with the message only in its own status, where no
deploy looks. Declare the role on the cluster as a managed role.

NO passwordSecret, and disablePassword left unset: CNPG manages a role's
password only when it is given one, so the password stays owned by the
OpenBaoDatabaseStaticRole that rotates it. Two controllers writing the
same field on every reconcile is the failure this avoids.

THE OTHER EIGHT ROLES ARE STILL UNDECLARED, and that is a larger gap
than this one commit. app, argo, binjovi, binjovi_staging, forgejo,
hydra, kratos and n8n all exist in Postgres and none of them is declared
anywhere in this repository; tenantdatabase/argo.yaml says its role comes
from this file's managed.roles, and until now this file had no such
block. They were created by the retired Crossplane composition or by
hand, and `make rebuild` would not recreate them. Adopting them is a
separate, verified pass: CNPG reconciles the attributes of every role it
is given, so listing a live role changes that role.

tests/outline.sh now reads the owner from the Database CR and asserts a
matching managed role, so this cannot regress silently.

Claude-Session: https://claude.ai/code/session_01JGe4pyhQ36AhgDfPJry4d3

binjovi-bot merged commit dedaa96bd2 into trunk 2026-09-13 13:14:34 +00:00

binjovi-bot deleted branch fix/outline-database-role 2026-09-13 13:14:34 +00:00

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

sean/seanfarm!707

No description provided.