public_git
/
postgres-operator
mirror of https://github.com/zalando/postgres-operator.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

add DefaultUsers flag

This commit is contained in:
Felix Kunde 2019-10-02 14:30:37 +02:00
parent 31fd352fbd
commit 18da6e552d
4 changed files with 23 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
manifests/complete-postgres-manifest.yaml
View File

@ -24,11 +24,12 @@ spec:
databases:
foo: zalando
preparedDatabases:
ab_db:
bar:
schemas:
data: {}
history:
defaultRoles: false
defaultRoles: true
defaultUsers: false
# Expert section

4
pkg/apis/acid.zalan.do/v1/postgresql_type.go
View File

@ -76,15 +76,15 @@ type PostgresqlList struct {
Items []Postgresql `json:"items"`
}
// PreparedDatabase describes elements to be bootstrapped (schemas, prod-prefix)
// PreparedDatabase describes elements to be bootstrapped
type PreparedDatabase struct {
PreparedSchemas map[string]PreparedSchema `json:"schemas,omitempty"`
Prod bool `json:"prod,omitempty"`
}
// PreparedSchema describes elements to be bootstrapped in the schema
type PreparedSchema struct {
DefaultRoles *bool `json:"defaultRoles,omitempty" defaults:"true"`
DefaultUsers bool `json:"defaultUsers,omitempty" defaults:"false"`
}
// MaintenanceWindow describes the time window when the operator is allowed to do maintenance on a cluster.

20
pkg/cluster/cluster.go
View File

@ -786,9 +786,15 @@ func (c *Cluster) initPreparedDatabaseRoles() error {
c.Spec.PreparedDatabases = preparedDatabases
}
defaultRoles := map[string]string{"_owner": "", "_reader": "", "_writer": "_reader"}
defaultUsers := map[string]string{"_owner_user": "_owner", "_reader_user": "_reader", "_writer_user": "_writer"}
for preparedDbName, preparedDB := range preparedDatabases {
// default roles per database
if err := c.initDefaultRoles("admin", preparedDbName); err != nil {
if err := c.initDefaultRoles(defaultRoles, "admin", preparedDbName); err != nil {
return fmt.Errorf("could not initialize default roles for database %s: %v", preparedDbName, err)
}
if err := c.initDefaultRoles(defaultUsers, "admin", preparedDbName); err != nil {
return fmt.Errorf("could not initialize default roles for database %s: %v", preparedDbName, err)
}
@ -799,19 +805,21 @@ func (c *Cluster) initPreparedDatabaseRoles() error {
}
for preparedSchemaName, preparedSchema := range preparedSchemas {
if preparedSchema.DefaultRoles == nil || *preparedSchema.DefaultRoles {
if err := c.initDefaultRoles(preparedDbName+"_owner", preparedDbName+"_"+preparedSchemaName); err != nil {
if err := c.initDefaultRoles(defaultRoles, preparedDbName+"_owner", preparedDbName+"_"+preparedSchemaName); err != nil {
return fmt.Errorf("could not initialize default roles for database schema %s: %v", preparedSchemaName, err)
}
if preparedSchema.DefaultUsers {
if err := c.initDefaultRoles(defaultUsers, preparedDbName+"_owner", preparedDbName+"_"+preparedSchemaName); err != nil {
return fmt.Errorf("could not initialize default users for database schema %s: %v", preparedSchemaName, err)
}
}
}
}
}
return nil
}
func (c *Cluster) initDefaultRoles(admin, prefix string) error {
defaultRoles := map[string]string{
"_owner": "", "_reader": "", "_writer": "_reader",
"_owner_user": "_owner", "_reader_user": "_reader", "_writer_user": "_writer"}
func (c *Cluster) initDefaultRoles(defaultRoles map[string]string, admin, prefix string) error {
for defaultRole, inherits := range defaultRoles {

6
pkg/cluster/database.go
View File

@ -297,9 +297,11 @@ func (c *Cluster) execCreateDatabaseSchema(datname, schemaName, dbOwner, schemaO
}
// set default privileges for schema
c.execAlterSchemaDefaultPrivileges(schemaName, dbOwner, datname+"_"+schemaName)
c.execAlterSchemaDefaultPrivileges(schemaName, schemaOwner, datname)
c.execAlterSchemaDefaultPrivileges(schemaName, schemaOwner, datname+"_"+schemaName)
if schemaOwner != dbOwner {
c.execAlterSchemaDefaultPrivileges(schemaName, dbOwner, datname+"_"+schemaName)
c.execAlterSchemaDefaultPrivileges(schemaName, schemaOwner, datname+"_"+schemaName)
}
return nil
}