add user retention

pkg/cluster/cluster.go

@@ -1001,6 +1001,7 @@ func (c *Cluster) initSystemUsers() {
 		Origin:    spec.RoleOriginSystem,
 		Name:      c.OpConfig.ReplicationUsername,
 		Namespace: c.Namespace,
+		Flags:     []string{constants.RoleFlagLogin},
 		Password:  util.RandomPassword(constants.PasswordLength),
 	}
 

pkg/cluster/database.go

@@ -14,34 +14,11 @@ import (
 	"github.com/zalando/postgres-operator/pkg/spec"
 	"github.com/zalando/postgres-operator/pkg/util/constants"
 	"github.com/zalando/postgres-operator/pkg/util/retryutil"
+	"github.com/zalando/postgres-operator/pkg/util/users"
 )
 
 const (
-	getUserSQL = `WITH dbowners AS (
-		SELECT DISTINCT pg_catalog.pg_get_userbyid(datdba) AS owner
-		  FROM pg_database
-		 WHERE datname NOT IN ('postgres', 'template0', 'template1')
-	  ), roles AS (
-		SELECT a.rolname, COALESCE(a.rolpassword, '') AS rolpassword, a.rolsuper, a.rolinherit,
-			   a.rolcreaterole, a.rolcreatedb, a.rolcanlogin, s.setconfig,
-			   ARRAY(SELECT b.rolname
-					   FROM pg_catalog.pg_auth_members m
-					   JOIN pg_catalog.pg_authid b ON (m.roleid = b.oid)
-					  WHERE m.member = a.oid) as memberof
-		  FROM pg_catalog.pg_authid a
-		  LEFT JOIN pg_catalog.pg_db_role_setting s ON (a.oid = s.setrole AND s.setdatabase = 0::oid)
-		 WHERE a.rolname = ANY($1)
-		 ORDER BY 1
-	  )
-	  SELECT r.rolname, r.rolpassword, r.rolsuper, r.rolinherit,
-			 r.rolcreaterole, r.rolcreatedb, r.rolcanlogin, r.setconfig,
-			 r.memberof,
-			 o.owner IS NOT NULL OR r.rolname LIKE '%_owner' AS is_owner
-		FROM roles r
-		LEFT JOIN dbowners o ON o.owner = r.rolname OR o.owner = ANY (r.memberof)
-	   ORDER BY 1;`
-
-	/*`SELECT a.rolname, COALESCE(a.rolpassword, ''), a.rolsuper, a.rolinherit,
+	getUserSQL = `SELECT a.rolname, COALESCE(a.rolpassword, ''), a.rolsuper, a.rolinherit,
 	       a.rolcreaterole, a.rolcreatedb, a.rolcanlogin, s.setconfig,
 	       ARRAY(SELECT b.rolname
 	             FROM pg_catalog.pg_auth_members m
@@ -49,7 +26,13 @@ const (
 	            WHERE m.member = a.oid) as memberof
 	FROM pg_catalog.pg_authid a LEFT JOIN pg_db_role_setting s ON (a.oid = s.setrole AND s.setdatabase = 0::oid)
 	WHERE a.rolname = ANY($1)
-	ORDER BY 1;`*/
+	ORDER BY 1;`
+
+	getUsersForRetention = `SELECT r.rolname, right(r.rolname, 6) AS roldatesuffix
+	        FROM pg_roles r
+	        JOIN unnest($1::text[]) AS u(name) ON r.rolname LIKE u.name || '%'
+			AND right(r.rolname, 6) ~ '^[0-9\.]+$'
+			ORDER BY 1;`
 
 	getDatabasesSQL = `SELECT datname, pg_get_userbyid(datdba) AS owner FROM pg_database;`
 	getSchemasSQL   = `SELECT n.nspname AS dbschema FROM pg_catalog.pg_namespace n
@@ -222,10 +205,10 @@ func (c *Cluster) readPgUsersFromDatabase(userNames []string) (users spec.PgUser
 			rolname, rolpassword                                          string
 			rolsuper, rolinherit, rolcreaterole, rolcreatedb, rolcanlogin bool
 			roloptions, memberof                                          []string
-			rolowner, roldeleted                                          bool
+			roldeleted                                                    bool
 		)
 		err := rows.Scan(&rolname, &rolpassword, &rolsuper, &rolinherit,
-			&rolcreaterole, &rolcreatedb, &rolcanlogin, pq.Array(&roloptions), pq.Array(&memberof), &rolowner)
+			&rolcreaterole, &rolcreatedb, &rolcanlogin, pq.Array(&roloptions), pq.Array(&memberof))
 		if err != nil {
 			return nil, fmt.Errorf("error when processing user rows: %v", err)
 		}
@@ -245,12 +228,70 @@ func (c *Cluster) readPgUsersFromDatabase(userNames []string) (users spec.PgUser
 			roldeleted = true
 		}
 
-		users[rolname] = spec.PgUser{Name: rolname, Password: rolpassword, Flags: flags, MemberOf: memberof, Parameters: parameters, IsDbOwner: rolowner, Deleted: roldeleted}
+		users[rolname] = spec.PgUser{Name: rolname, Password: rolpassword, Flags: flags, MemberOf: memberof, Parameters: parameters, Deleted: roldeleted}
 	}
 
 	return users, nil
 }
 
+func findUsersFromRotation(rotatedUsers []string, db *sql.DB) (map[string]string, error) {
+	extraUsers := make(map[string]string, 0)
+	rows, err := db.Query(getUsersForRetention, pq.Array(rotatedUsers))
+	if err != nil {
+		return nil, fmt.Errorf("query failed: %v", err)
+	}
+	defer func() {
+		if err2 := rows.Close(); err2 != nil {
+			err = fmt.Errorf("error when closing query cursor: %v", err2)
+		}
+	}()
+
+	for rows.Next() {
+		var (
+			rolname, roldatesuffix string
+		)
+		err := rows.Scan(&rolname, &roldatesuffix)
+		if err != nil {
+			return nil, fmt.Errorf("error when processing rows of deprecated users: %v", err)
+		}
+		extraUsers[rolname] = roldatesuffix
+	}
+
+	return extraUsers, nil
+}
+
+func (c *Cluster) cleanupRotatedUsers(rotatedUsers []string, db *sql.DB) error {
+	c.setProcessName("checking for rotated users to remove from the database due to configured retention")
+	extraUsers, err := findUsersFromRotation(rotatedUsers, db)
+	if err != nil {
+		return fmt.Errorf("error when querying for deprecated users from password rotation: %v", err)
+	}
+
+	for rotatedUser, dateSuffix := range extraUsers {
+		// make sure user retention policy aligns with rotation interval
+		retenionDays := c.OpConfig.PasswordRotationUserRetention
+		if retenionDays < 2*c.OpConfig.PasswordRotationInterval {
+			retenionDays = 2 * c.OpConfig.PasswordRotationInterval
+			c.logger.Warnf("user retention days too few compared to rotation interval %d - setting it to %d", c.OpConfig.PasswordRotationInterval, retenionDays)
+		}
+		retentionDate := time.Now().AddDate(0, 0, int(retenionDays)*-1)
+		userCreationDate, err := time.Parse("060102", dateSuffix)
+		if err != nil {
+			c.logger.Errorf("could not parse creation date suffix of user %q: %v", rotatedUser, err)
+			continue
+		}
+		if retentionDate.After(userCreationDate) {
+			c.logger.Infof("dropping user %q due to configured days in password_rotation_user_retention", rotatedUser)
+			if err = users.DropPgUser(rotatedUser, db); err != nil {
+				c.logger.Errorf("could not drop role %q: %v", rotatedUser, err)
+				continue
+			}
+		}
+	}
+
+	return nil
+}
+
 // getDatabases returns the map of current databases with owners
 // The caller is responsible for opening and closing the database connection
 func (c *Cluster) getDatabases() (dbs map[string]string, err error) {

pkg/cluster/sync.go

@@ -627,6 +627,7 @@ func (c *Cluster) syncSecrets() error {
 	c.setProcessName("syncing secrets")
 	secrets := c.generateUserSecrets()
 	rotationUsers := make(spec.PgUserMap)
+	retentionUsers := make([]string, 0)
 
 	for secretUsername, secretSpec := range secrets {
 		if secret, err = c.KubeClient.Secrets(secretSpec.Namespace).Create(context.TODO(), secretSpec, metav1.CreateOptions{}); err == nil {
@@ -672,7 +673,8 @@ func (c *Cluster) syncSecrets() error {
 			}
 
 			// if password rotation is enabled update password and username if rotation interval has been passed
-			if c.OpConfig.EnablePasswordRotation && pwdUser.Origin != spec.RoleOriginInfrastructure && !pwdUser.IsDbOwner { // || c.Spec.InPlacePasswordRotation[secretUsername] {
+			if (c.OpConfig.EnablePasswordRotation && pwdUser.Origin != spec.RoleOriginInfrastructure && !pwdUser.IsDbOwner) ||
+				util.SliceContains(c.Spec.UsersWithSecretRotation, secretUsername) || util.SliceContains(c.Spec.UsersWithInPlaceSecretRotation, secretUsername) {
 				currentTime := time.Now()
 
 				// initialize password rotation setting first rotation date
@@ -688,13 +690,14 @@ func (c *Cluster) syncSecrets() error {
 				}
 
 				if currentTime.After(nextRotationDate) {
-					//if !c.Spec.InPlacePasswordRotation[secretUsername] {
-					newRotationUsername := pwdUser.Name + "_" + currentTime.Format("060102")
-					pwdUser.MemberOf = []string{pwdUser.Name}
-					pwdUser.Name = newRotationUsername
-					rotationUsers[newRotationUsername] = pwdUser
-					secret.Data["username"] = []byte(newRotationUsername)
-					//}
+					if !util.SliceContains(c.Spec.UsersWithInPlaceSecretRotation, secretUsername) {
+						retentionUsers = append(retentionUsers, pwdUser.Name)
+						newRotationUsername := pwdUser.Name + currentTime.Format("060102")
+						pwdUser.MemberOf = []string{pwdUser.Name}
+						pwdUser.Name = newRotationUsername
+						rotationUsers[newRotationUsername] = pwdUser
+						secret.Data["username"] = []byte(newRotationUsername)
+					}
 					secret.Data["password"] = []byte(util.RandomPassword(constants.PasswordLength))
 
 					_, nextRotationDateStr = c.getNextRotationDate(nextRotationDate)
@@ -722,14 +725,13 @@ func (c *Cluster) syncSecrets() error {
 		}
 		pgSyncRequests := c.userSyncStrategy.ProduceSyncRequests(spec.PgUserMap{}, rotationUsers)
 		if err = c.userSyncStrategy.ExecuteSyncRequests(pgSyncRequests, c.pgDb); err != nil {
-			return fmt.Errorf("error executing sync statements: %v", err)
+			return fmt.Errorf("error creating database roles for password rotation: %v", err)
 		}
-		if err2 := c.closeDbConn(); err2 != nil {
-			if err == nil {
-				return fmt.Errorf("could not close database connection: %v", err2)
-			} else {
-				return fmt.Errorf("could not close database connection: %v (prior error: %v)", err2, err)
-			}
+		if err = c.cleanupRotatedUsers(retentionUsers, c.pgDb); err != nil {
+			return fmt.Errorf("error creating database roles for password rotation: %v", err)
+		}
+		if err := c.closeDbConn(); err != nil {
+			c.logger.Errorf("could not close database connection during secret rotation: %v", err)
 		}
 	}