Gabriel Radureau
c0d5f2e144
The Dolibarr before-start step `chart/scripts/update_ownership.sql` (embedded
into a ConfigMap by `chart/templates/scripts-config.yaml`) hardcoded the
Postgres owner role `erp_role`. It reassigns ownership of all public-schema
objects to that role after install. For any non-prod environment the owner
role differs — by the multi-env elision rule (ADR-0002/0003) it is snake-case
`<app>_role` for prod and `<app>_<env>_role` for non-prod, so the sandbox owner
role is `erp_sandbox_role`. With the literal `erp_role`, installing Dolibarr in
`erp-sandbox` would reassign sandbox tables to prod's `erp_role`, which (a)
breaks the sandbox runtime (its dynamic DB creds are a member of
`erp_sandbox_role`, not `erp_role`) and (b) breaks the ADR-0003 reset
(`DROP OWNED BY erp_sandbox_role`).
Fix: make the owner role env-aware via a new chart value `db.ownerRole`.
- values.yaml: default `ownerRole: erp_role` (prod).
- values-sandbox.yaml: override `ownerRole: erp_sandbox_role`.
- update_ownership.sql: all `'erp_role'` literals → `'{{ .Values.db.ownerRole }}'`.
- scripts-config.yaml: render that one SQL file through `tpl` so the value is
substituted (the other script has no template vars and stays on `.Files.Get`).
The SQL's `$$`, `%I`, `format(...)`, `RAISE NOTICE` are not Go-template syntax,
so `tpl` only substitutes the added `{{ .Values.db.ownerRole }}`.
Verified: the prod ConfigMap render (values.yaml only) is byte-identical to
origin/main (empty diff, still `erp_role`); the sandbox render
(-f values.yaml -f values-sandbox.yaml) now contains `erp_sandbox_role` and no
bare `erp_role`; `helm lint` passes (no worse than origin/main).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
41 lines
1.5 KiB
YAML
41 lines
1.5 KiB
YAML
# Sandbox overlay — to be combined with values.yaml:
|
|
# helm install erp-sandbox chart/ -f chart/values.yaml -f chart/values-sandbox.yaml \
|
|
# --namespace erp-sandbox --create-namespace
|
|
#
|
|
# Activates Phase D of the multi-env evolution (cf. PR thread). Prerequisites:
|
|
# - factory/postgres/iac/terraform.tfvars: erp has envs = ["prod", "sandbox"]
|
|
# - tools/hashicorp-vault/iac/modules/app_roles: env parameter applied
|
|
# - arcodange-org/erp/iac/main.tf: for_each over local.envs (Phase D commit)
|
|
# - ArgoCD: Application "erp-sandbox" registered (Phase E)
|
|
#
|
|
# Derived names follow the elision rule: env=sandbox → suffix "-sandbox".
|
|
|
|
env: sandbox
|
|
instance: erp-sandbox
|
|
host: erp-sandbox.arcodange.lab
|
|
|
|
db:
|
|
name: erp-sandbox
|
|
ownerRole: erp_sandbox_role
|
|
|
|
vault:
|
|
k8sRole: erp-sandbox
|
|
dynamicPath: creds/erp-sandbox
|
|
staticPath: erp-sandbox/config
|
|
|
|
# Ingress annotations + hosts — override to point at the sandbox FQDN
|
|
ingress:
|
|
enabled: true
|
|
annotations:
|
|
traefik.ingress.kubernetes.io/router.entrypoints: websecure
|
|
traefik.ingress.kubernetes.io/router.tls: "true"
|
|
traefik.ingress.kubernetes.io/router.tls.certresolver: letsencrypt
|
|
traefik.ingress.kubernetes.io/router.tls.domains.0.main: arcodange.lab
|
|
traefik.ingress.kubernetes.io/router.tls.domains.0.sans: erp-sandbox.arcodange.lab
|
|
traefik.ingress.kubernetes.io/router.middlewares: localIp@file
|
|
hosts:
|
|
- host: erp-sandbox.arcodange.lab
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|