- Add build-pgvector-image.yml GH Actions workflow for GCR
- Set imageName to gcr.io/devops-lab-cluster/postgres-pgvector:15.2-0.8.0
- Image change only (CNPG rule: no config changes in same update)
- Remove imageName (was never applied, live cluster uses default CNPG image)
- Remove maintenance_work_mem (live cluster has no custom parameters)
- Set postgresql: {} to match live state
- Keep memory role superuser: true (the only needed change)
Fixes CNPG admission webhook: 'Can't change image name and configuration at the same time'
CNPG version on cluster does not support .spec.sql on Database CR.
The rag-init-job.yaml already handles RAG schema initialization separately.
Unblocks Flux dry-run for agent-memory-rag.
- Add allowedExtensions: ['*'] so roles can CREATE EXTENSION
- Grant superuser to 'memory' role (was createdb/createrole, insufficient)
- Needed for mem0 plugin pgvector backend on agent_memory DB
Unblocks kanban task t_3d94b392
Previous secrets encrypted apiVersion, kind, metadata.name, metadata.namespace
and type fields. Recreated with --encrypted-regex targeting only stringData
section. New random passwords generated for all three roles.
