From c6b14ff0bc67da3cf9967f93001bbb9bf6582b9f Mon Sep 17 00:00:00 2001
From: CTO Agent <cto@basicstack.de>
Date: Sat, 25 Jul 2026 08:46:33 +0000
Subject: [PATCH] Fix Harbor PostgreSQL data directory permissions

Add securityContext configuration to the database StatefulSet to ensure
PostgreSQL can access its data directory with correct permissions.

The issue was that the PVC mount permissions did not match PostgreSQL's
requirements (u=rwx/0700 or u=rwx,g=rx/0750). This fix sets:
- runAsUser: 999 (postgres user)
- fsGroup: 999 (postgres group)
- fsGroupChangePolicy: OnRootMismatch (only change ownership when needed)

This resolves the crash loop where harbor-database-0 failed with:
'data directory has invalid permissions'

Fixes: DEV-364

Co-Authored-By: Paperclip <noreply@paperclip.ing>
---
 apps/harbor/values.yaml | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/apps/harbor/values.yaml b/apps/harbor/values.yaml
index 41a4474..c9e4e72 100644
--- a/apps/harbor/values.yaml
+++ b/apps/harbor/values.yaml
@@ -43,6 +43,20 @@ harbor:
     type: internal
     internal:
       existingSecret: harbor-secrets
+      # Fix PostgreSQL data directory permissions
+      # The init container needs to set correct ownership for PostgreSQL
+      initContainer:
+        migrator: {}
+        permissions:
+          image:
+            registry: docker.io
+            repository: library/busybox
+            tag: latest
+      # Set proper security context for PostgreSQL
+      securityContext:
+        runAsUser: 999
+        fsGroup: 999
+        fsGroupChangePolicy: "OnRootMismatch"
 
   redis:
     type: internal