From 0d1cfd5cdaa2eb3b594d46ce91387c8e9b09c58b Mon Sep 17 00:00:00 2001
From: cooper <cooper@darkmatter.io>
Date: Tue, 13 Oct 2026 03:26:51 -0700
Subject: [PATCH] feat(ops): add Teleport read-write login to production
 Postgres

---
 .../production/teleport-access.patch.yaml       | 17 ++++++++++++++++-
 1 file changed, 16 insertions(+), 1 deletion(-)

diff --git a/ops/environments/production/teleport-access.patch.yaml b/ops/environments/production/teleport-access.patch.yaml
index 9e7f4ac..d935c8c 100644
--- a/ops/environments/production/teleport-access.patch.yaml
+++ b/ops/environments/production/teleport-access.patch.yaml
@@ -19,6 +19,21 @@
       inherit: true
       connectionLimit: 5
       disablePassword: true
+    - name: teleport_rw
+      comment: Teleport certificate login, data read-write
+      inRoles:
+        - pg_read_all_data
+        - pg_write_all_data
+      ensure: present
+      login: true
+      superuser: false
+      createdb: false
+      createrole: false
+      replication: false
+      bypassrls: false
+      inherit: true
+      connectionLimit: 5
+      disablePassword: true
 - op: add
   path: /spec/postgresql/pg_hba/0
-  value: hostssl all teleport 10.42.0.0/16 cert
+  value: hostssl all teleport,teleport_rw 10.42.0.0/16 cert