public_git/postgres-operator
1
0
Fork 0
mirror of https://github.com/zalando/postgres-operator.git synced 2026-10-06 22:31:24 +02:00
Code Issues Projects Releases Wiki Activity

deny LOGIN from deprecated roles

Browse Source
This commit is contained in:
Felix Kunde
2021-05-12 11:53:14 +02:00
parent e75f5b5240
commit 869502e721
3 changed files with 42 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/util/users/users.go
+14 -1
View File
@@ -9,6 +9,7 @@ import (
"github.com/zalando/postgres-operator/pkg/spec"
"github.com/zalando/postgres-operator/pkg/util"
"github.com/zalando/postgres-operator/pkg/util/constants"
)
const (
@@ -75,9 +76,21 @@ func (strategy DefaultUserSyncStrategy) ProduceSyncRequests(dbUsers spec.PgUserM
}
// No existing roles are deleted or stripped of role membership/flags
// but they will be renamed acting as a simple login blocker
// but team roles will be renamed and denied from LOGIN
for name, dbUser := range dbUsers {
if _, exists := newUsers[name]; !exists {
// toggle LOGIN flag based on role deprecation
userFlags := make([]string, len(dbUser.Flags))
userFlags = append(userFlags, dbUser.Flags...)
if dbUser.Deprecated {
util.StringSliceReplaceElement(&dbUser.Flags, constants.RoleFlagNoLogin, constants.RoleFlagLogin)
} else {
util.StringSliceReplaceElement(&dbUser.Flags, constants.RoleFlagLogin, constants.RoleFlagNoLogin)
}
if !util.IsEqualIgnoreOrder(userFlags, dbUser.Flags) {
reqs = append(reqs, spec.PgSyncUserRequest{Kind: spec.PGsyncUserAlter, User: dbUser})
}
reqs = append(reqs, spec.PgSyncUserRequest{Kind: spec.PGSyncUserRename, User: dbUser})
}
}