From fef71f7c3e1b96b5a68ca1d3056b0624cca893b8 Mon Sep 17 00:00:00 2001
From: "j.w.jonkers" <joris.jonkers@nedap.com>
Date: Thu, 11 Jun 2026 21:43:36 +0200
Subject: [PATCH] fix: reconcile the assistant->agents postgres rename on
 existing volumes

The agents subsystem rename left the init script creating agents_db /
agents_user, but init-databases.sh only runs on a fresh PGDATA. On the
live Frankfurt volume the database and role were still named assistant_db
and assistant_user, so agents-api could not reach jdbc:.../agents_db and
postgres itself crash-looped once secret/platform/postgres gained the
agents.* keys the deployment template now references.

A one-shot reconcile Job renames the role and database in place,
preserving all data, resets the role password from secret/platform/postgres,
and falls back to creating the objects when neither name exists (fresh
cluster). It is idempotent: a second run is a no-op.
---
 .../apps/data/postgres/agents-rename-job.yaml | 100 ++++++++++++++++++
 .../apps/data/postgres/kustomization.yaml     |   1 +
 2 files changed, 101 insertions(+)
 create mode 100644 platform/cluster/flux/apps/data/postgres/agents-rename-job.yaml

diff --git a/platform/cluster/flux/apps/data/postgres/agents-rename-job.yaml b/platform/cluster/flux/apps/data/postgres/agents-rename-job.yaml
new file mode 100644
index 00000000..39f9bd49
--- /dev/null
+++ b/platform/cluster/flux/apps/data/postgres/agents-rename-job.yaml
@@ -0,0 +1,100 @@
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: postgres-agents-rename
+  namespace: data-system
+  # The assistant subsystem was renamed to agents. The init script only
+  # runs on a fresh PGDATA, so the live volume still carries the old
+  # assistant_db / assistant_user objects. This one-shot reconcile renames
+  # them in place (preserving all data) so agents-api can reach agents_db
+  # as agents_user. Idempotent: re-running after the rename is a no-op, and
+  # on a fresh cluster (where init already created agents_db) it does
+  # nothing. The force annotation makes Flux recreate the Job whenever the
+  # spec hash drifts.
+  annotations:
+    kustomize.toolkit.fluxcd.io/force: enabled
+spec:
+  backoffLimit: 3
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: postgres-agents-rename
+      annotations:
+        vault.hashicorp.com/agent-inject: 'true'
+        vault.hashicorp.com/agent-inject-token: 'true'
+        vault.hashicorp.com/agent-pre-populate-only: 'true'
+        vault.hashicorp.com/role: postgres
+        vault.hashicorp.com/agent-inject-secret-postgres.env: secret/data/platform/postgres
+        vault.hashicorp.com/agent-inject-template-postgres.env: |
+          POSTGRES_USER={{ with secret "secret/data/platform/postgres" }}{{ index .Data.data "postgres.user" }}{{ end }}
+          POSTGRES_PASSWORD={{ with secret "secret/data/platform/postgres" }}{{ index .Data.data "postgres.password" }}{{ end }}
+          AGENTS_DB_USER={{ with secret "secret/data/platform/postgres" }}{{ index .Data.data "agents.user" }}{{ end }}
+          AGENTS_DB_PASSWORD={{ with secret "secret/data/platform/postgres" }}{{ index .Data.data "agents.password" }}{{ end }}
+    spec:
+      restartPolicy: OnFailure
+      serviceAccountName: postgres
+      nodeSelector:
+        personal-stack/site: frankfurt
+      containers:
+        - name: reconcile
+          image: postgres:17-alpine
+          imagePullPolicy: IfNotPresent
+          command:
+            - /bin/sh
+            - -ec
+            - |
+              set -a
+              . /vault/secrets/postgres.env
+              set +a
+
+              export PGPASSWORD="${POSTGRES_PASSWORD}"
+
+              # Role + database live at the cluster level, so connect to the
+              # default postgres database. ALTER DATABASE ... RENAME cannot run
+              # against the current database or with open connections to the
+              # target, neither of which applies here (the renamer is on
+              # postgres and the assistant stack is gone).
+              psql -v ON_ERROR_STOP=1 \
+                --host=postgres.data-system.svc.cluster.local \
+                --username="${POSTGRES_USER}" \
+                --dbname=postgres <<EOSQL
+              DO \$\$
+              BEGIN
+                IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'assistant_user')
+                   AND NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = '${AGENTS_DB_USER}') THEN
+                  ALTER ROLE assistant_user RENAME TO ${AGENTS_DB_USER};
+                END IF;
+                IF NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = '${AGENTS_DB_USER}') THEN
+                  CREATE ROLE ${AGENTS_DB_USER} LOGIN;
+                END IF;
+              END
+              \$\$;
+
+              -- Re-set the password from Vault. A md5-hashed password is
+              -- invalidated by RENAME (the salt embeds the old role name);
+              -- scram is not, but setting it unconditionally is harmless and
+              -- guarantees the live role matches secret/platform/postgres.
+              ALTER ROLE ${AGENTS_DB_USER} WITH LOGIN PASSWORD '${AGENTS_DB_PASSWORD}';
+
+              SELECT format('ALTER DATABASE %I RENAME TO %I', 'assistant_db', 'agents_db')
+              WHERE EXISTS (SELECT 1 FROM pg_database WHERE datname = 'assistant_db')
+                AND NOT EXISTS (SELECT 1 FROM pg_database WHERE datname = 'agents_db')
+              \gexec
+
+              SELECT format('CREATE DATABASE %I OWNER %I', 'agents_db', '${AGENTS_DB_USER}')
+              WHERE NOT EXISTS (SELECT 1 FROM pg_database WHERE datname = 'agents_db')
+              \gexec
+
+              GRANT ALL PRIVILEGES ON DATABASE agents_db TO ${AGENTS_DB_USER};
+              ALTER DATABASE agents_db OWNER TO ${AGENTS_DB_USER};
+              EOSQL
+
+              psql -v ON_ERROR_STOP=1 \
+                --host=postgres.data-system.svc.cluster.local \
+                --username="${POSTGRES_USER}" \
+                --dbname=agents_db <<EOSQL
+              ALTER SCHEMA public OWNER TO ${AGENTS_DB_USER};
+              GRANT ALL ON SCHEMA public TO ${AGENTS_DB_USER};
+              EOSQL
+
+              echo "==> agents_db / ${AGENTS_DB_USER} reconciled."
diff --git a/platform/cluster/flux/apps/data/postgres/kustomization.yaml b/platform/cluster/flux/apps/data/postgres/kustomization.yaml
index 00877714..6f4173bf 100644
--- a/platform/cluster/flux/apps/data/postgres/kustomization.yaml
+++ b/platform/cluster/flux/apps/data/postgres/kustomization.yaml
@@ -6,4 +6,5 @@ resources:
   - config-configmap.yaml
   - deployment.yaml
   - wolfmanager-reconcile-job.yaml
+  - agents-rename-job.yaml
   - servicemonitor.yaml