comms: ensure synapse admin flag; ariadne vault role

services/comms/oneoffs/synapse-admin-ensure-job.yaml

@@ -185,6 +185,10 @@ spec:
                           cols = get_cols(cur)
                           if "admin" not in cols:
                               raise RuntimeError("users.admin column missing")
+                          cur.execute(
+                              "UPDATE users SET admin = TRUE WHERE name = %s",
+                              (user_id,),
+                          )
                           cur.execute(
                               """
                               SELECT token FROM access_tokens

services/maintenance/ariadne-deployment.yaml

@@ -18,7 +18,7 @@ spec:
         prometheus.io/scrape: "true"
         prometheus.io/port: "8080"
         prometheus.io/path: "/metrics"
-        maintenance.bstein.dev/restart-rev: "20260207-1"
+        maintenance.bstein.dev/restart-rev: "20260207-2"
         vault.hashicorp.com/agent-inject: "true"
         vault.hashicorp.com/role: "maintenance"
         vault.hashicorp.com/agent-inject-secret-ariadne-env.sh: "kv/data/atlas/maintenance/ariadne-db"
@@ -151,6 +151,8 @@ spec:
               value: "10"
             - name: ARIADNE_RUN_MIGRATIONS
               value: "false"
+            - name: VAULT_K8S_ROLE
+              value: maintenance
             - name: PORTAL_ADMIN_USERS
               value: bstein
             - name: PORTAL_ADMIN_GROUPS