fix(grants): experimental fix for cross-namespace role revocation

[mahlunar]

Problem

When the same PostgreSQL username has PostgreSQLUser resources in multiple namespaces that share a host, each namespace reconciles independently and revokes roles granted by the others. The result is intermittent access loss — whichever namespace reconciled last wins.

Root cause: SyncUser computes accesses from the current namespace only, then passes those to rolesDiff, which revokes any _read/_readwrite role not in that list.

The bug is reproduced (and documented) in:

• pkg/postgres/cross_namespace_revoke_test.go — proves rolesDiff revokes cross-namespace roles
• pkg/grants/cross_namespace_revoke_test.go — proves groupAccesses produces disjoint role sets per namespace

Approach

Before calling setRolesOnHosts, merge database schemas from all other PostgreSQLUser resources with the same spec.name (but different namespace) that target the same host. This expands the expected role set seen by rolesDiff to include all namespaces — so nothing gets revoked.

Constraint: only merge for hosts the current namespace already connects to. No new connections are opened.

Changes

• pkg/kube/kube.go — PostgreSQLUsers: cluster-wide user listing
• pkg/grants/grants.go — AllUsers: drop namespace param (always cluster-wide)
• pkg/grants/sync.go — mergeSiblingAccesses + call from SyncUser
• cmd/main.go — wire AllUsers
• Test fixtures anonymised (no real hostnames, usernames, or database names)
• TestCrossNamespaceRevocation_MergeFixPreventsRevocation verifies the fix

Discussion points

• Should a failed AllUsers listing block the reconciliation rather than proceeding silently?
• The controller needs cluster-wide list RBAC on postgresqlusers — RBAC manifests not updated yet
• Performance: every SyncUser call now issues an extra cluster-wide list; acceptable?

🤖 Generated with Claude Code