feat(ba-pre-prod): sherlock-holmes postgres role - SPHER-6914

[ireneusz-zagan]

Reference

https://aleph-alpha.atlassian.net/browse/SPHER-6914

Purpose

Sherlock-holmes on ba-pre-prod requires a postgres role.

Detailed description

Adds a sherlock role to clusterPharia.roles in helm/qs-postgresql-cluster/values.yaml. Mirrors the existing pharia_data / mlflow role definitions in the same cluster.

Risk classification

• Low - isolated and easily reversible; no security or data-handling impact
• Medium - touches shared components or user-facing behaviour; contained blast radius
• High - security/data-handling, schema/data migrations, infrastructure, or wide blast radius
  Impact areas (tick all that apply):
• Security / authentication / authorization
• Data handling / privacy
• Availability / performance
• Public API or other breaking change
• None of the above

Testing

helm template

Change monitoring

Confirm the sherlock role exists on the pharia postgres cluster.

Rollback

Revert this PR. Drop the role manually.

Manual changes

The referenced secret qs-postgresql-cluster-access-sherlock (keys username=sherlock, password) must exist in the cluster namespace before the role can log in. Not created by this PR.

[anastasiosstathopoulos-ai]

Hi @ireneusz-zagan some comments:

• As you already mentioned please ensure secret is there BEFORE merging to main. It will make cluster unhealthy.
• AFTER merging please ensure the sherlock user exists in DB and the sherlock database actually becomes Ready

Some useful info from AI:
Extensions and “only this user can connect to this database” are applied by a different chart (qs-postgresql-db). This PR does not upgrade that. You may need a follow-up Helm upgrade of that chart so extensions and isolation actually run for Sherlock.