unkin/argocd-apps
2
0
Fork 0
Code Issues 2 Pull Requests 2 Actions Packages Projects Releases Wiki Activity

feat: add PuppetDB read-only database user and pooler #69

Merged
unkinben merged 1 commits from benvin/puppetdb-read-database into main 2026-03-21 23:31:01 +11:00
Conversation 0 Commits 1 Files Changed 7
+106
unkinben commented 2026-03-21 23:24:21 +11:00
Owner
Copy Link
Copy Source

PuppetDB requires a separate read-only database user for its read pool.
Without it, it refuses to use the write user for read queries and all
/pdb/query/v4 calls fail with a 500.

  • Add puppetdb_read role via CNPG managed.roles with password sourced
    from a new postgres-read-credentials Vault secret
  • Grant CONNECT, USAGE, SELECT and default privileges to puppetdb_read
    via postInitApplicationSQL (must also be run manually on existing cluster)
  • Add puppet-postgres-pooler-ro Pooler (type: ro) routing to replicas
  • Add puppetdb-read-database-conf ConfigMap with read-database.conf
    mounted into /etc/puppetlabs/puppetdb/conf.d/ in the PuppetDB deployment
  • Wire OPENVOXDB_READ_POSTGRES_* env vars from the new secret

💘 Generated with Crush

Assisted-by: Claude Sonnet 4.6 via Crush crush@charm.land

PuppetDB requires a separate read-only database user for its read pool. Without it, it refuses to use the write user for read queries and all /pdb/query/v4 calls fail with a 500. - Add puppetdb_read role via CNPG managed.roles with password sourced from a new postgres-read-credentials Vault secret - Grant CONNECT, USAGE, SELECT and default privileges to puppetdb_read via postInitApplicationSQL (must also be run manually on existing cluster) - Add puppet-postgres-pooler-ro Pooler (type: ro) routing to replicas - Add puppetdb-read-database-conf ConfigMap with read-database.conf mounted into /etc/puppetlabs/puppetdb/conf.d/ in the PuppetDB deployment - Wire OPENVOXDB_READ_POSTGRES_* env vars from the new secret 💘 Generated with Crush Assisted-by: Claude Sonnet 4.6 via Crush <crush@charm.land>
unkinben added 1 commit 2026-03-21 23:24:21 +11:00
feat: add PuppetDB read-only database user and pooler
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
ci/woodpecker/pr/kubeconform Pipeline was successful
Details
02051136e9 
PuppetDB requires a separate read-only database user for its read pool.
Without it, it refuses to use the write user for read queries and all
/pdb/query/v4 calls fail with a 500.

- Add puppetdb_read role via CNPG managed.roles with password sourced
  from a new postgres-read-credentials Vault secret
- Grant CONNECT, USAGE, SELECT and default privileges to puppetdb_read
  via postInitApplicationSQL (must also be run manually on existing cluster)
- Add puppet-postgres-pooler-ro Pooler (type: ro) routing to replicas
- Add puppetdb-read-database-conf ConfigMap with read-database.conf
  mounted into /etc/puppetlabs/puppetdb/conf.d/ in the PuppetDB deployment
- Wire OPENVOXDB_READ_POSTGRES_* env vars from the new secret

💘 Generated with Crush

Assisted-by: Claude Sonnet 4.6 via Crush <crush@charm.land>
unkinben merged commit 2a96d9e948 into main 2026-03-21 23:31:01 +11:00
unkinben deleted branch benvin/puppetdb-read-database 2026-03-21 23:31:02 +11:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
benvin (BenVincent) unkinben (Ben Vincent)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: unkin/argocd-apps#69
Delete Branch "benvin/puppetdb-read-database"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?