RHINENG-26546: run backfill job as admin user

Author: TenSt

conf/workspace_backfill.env

@@ -1,7 +1,4 @@
 LOG_LEVEL=info
 
-DB_USER=admin
-DB_PASSWD=passwd
-
 # Local Docker only: 1000 rows per job run (re-run job until complete). Production uses 50000 via WORKSPACE_BACKFILL_CONFIG.
 POD_CONFIG=update_users;update_db_config;wait_for_db=empty;use_testing_db;workspace_backfill_batch_size=1000;workspace_backfill_max_rows_per_run=1000

deploy/clowdapp.yaml

@@ -538,9 +538,6 @@ objects:
         - {name: LOG_LEVEL, value: '${LOG_LEVEL_JOBS}'}
         - {name: GIN_MODE, value: '${GIN_MODE}'}
         - {name: DB_DEBUG, value: '${DB_DEBUG_JOBS}'}
-        - {name: DB_USER, value: vmaas_sync}
-        - {name: DB_PASSWD, valueFrom: {secretKeyRef: {name: patchman-engine-database-passwords,
-                                                      key: vmaas-sync-database-password}}}
         - {name: PROMETHEUS_PUSHGATEWAY,value: '${PROMETHEUS_PUSHGATEWAY}'}
         - {name: POD_CONFIG, value: '${WORKSPACE_BACKFILL_CONFIG}'}
 

dev/workspace_backfill.md

@@ -118,6 +118,10 @@ docker compose -f docker-compose.workspace-backfill.yml run --rm \
   workspace-backfill ./scripts/workspace_backfill_e2e.sh
 ```
 
+## Database user
+
+The job connects as the **admin** user (`core.ConfigureAdminApp()`), same credentials as migrations (`database.adminUsername` / `adminPassword` from Clowder). That is required for `SET LOCAL session_replication_role = replica` and matches local testing via `cdappconfig.json`.
+
 ## Production
 
-CronJob `workspace-backfill` in [`deploy/clowdapp.yaml`](../deploy/clowdapp.yaml) uses `WORKSPACE_BACKFILL_CONFIG` with `workspace_backfill_max_rows_per_run=50000` (suspended by default). Run on a schedule until pending rows are gone.
+CronJob `workspace-backfill` in [`deploy/clowdapp.yaml`](../deploy/clowdapp.yaml) uses `WORKSPACE_BACKFILL_CONFIG` with `workspace_backfill_max_rows_per_run=50000` (suspended by default). Run on a schedule until pending rows are gone. Admin DB credentials are provided by the platform (Clowder), not component secrets.

tasks/workspace_backfill/workspace_backfill.go

@@ -57,7 +57,8 @@ workspace_id IS NULL
   AND NOT (` + validWorkspacesJSONPredicate + `)`
 
 func configure() {
-	core.ConfigureApp()
+	// Admin DB user (same as migrations): UPDATE on partitions and session_replication_role = replica.
+	core.ConfigureAdminApp()
 }
 
 // RunWorkspaceBackfill runs the batched workspace_id / workspace_name backfill job.