Skip to content

Commit dfd0dd9

Browse files
FxKuFelix Kunde
FxKu
and
Felix Kunde
authored
set search_path for default roles (zalando#1065)
* set search_path for default roles * deployment back to 1.5.0 Co-authored-by: Felix Kunde <felix.kunde@zalando.de>
1 parent 0508266 commit dfd0dd9

File tree

3 files changed

+53
-35
lines changed

3 files changed

+53
-35
lines changed

‎pkg/cluster/cluster.go

Lines changed: 26 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -959,32 +959,42 @@ func (c *Cluster) initPreparedDatabaseRoles() error {
959959
}
960960

961961
for preparedDbName, preparedDB := range c.Spec.PreparedDatabases {
962+
// get list of prepared schemas to set in search_path
963+
preparedSchemas := preparedDB.PreparedSchemas
964+
if len(preparedDB.PreparedSchemas) == 0 {
965+
preparedSchemas = map[string]acidv1.PreparedSchema{"data": {DefaultRoles: util.True()}}
966+
}
967+
968+
var searchPath strings.Builder
969+
searchPath.WriteString(constants.DefaultSearchPath)
970+
for preparedSchemaName := range preparedSchemas {
971+
searchPath.WriteString(", " + preparedSchemaName)
972+
}
973+
962974
// default roles per database
963-
if err := c.initDefaultRoles(defaultRoles, "admin", preparedDbName); err != nil {
975+
if err := c.initDefaultRoles(defaultRoles, "admin", preparedDbName, searchPath.String()); err != nil {
964976
return fmt.Errorf("could not initialize default roles for database %s: %v", preparedDbName, err)
965977
}
966978
if preparedDB.DefaultUsers {
967-
if err := c.initDefaultRoles(defaultUsers, "admin", preparedDbName); err != nil {
979+
if err := c.initDefaultRoles(defaultUsers, "admin", preparedDbName, searchPath.String()); err != nil {
968980
return fmt.Errorf("could not initialize default roles for database %s: %v", preparedDbName, err)
969981
}
970982
}
971983

972984
// default roles per database schema
973-
preparedSchemas := preparedDB.PreparedSchemas
974-
if len(preparedDB.PreparedSchemas) == 0 {
975-
preparedSchemas = map[string]acidv1.PreparedSchema{"data": {DefaultRoles: util.True()}}
976-
}
977985
for preparedSchemaName, preparedSchema := range preparedSchemas {
978986
if preparedSchema.DefaultRoles == nil || *preparedSchema.DefaultRoles {
979987
if err := c.initDefaultRoles(defaultRoles,
980988
preparedDbName+constants.OwnerRoleNameSuffix,
981-
preparedDbName+"_"+preparedSchemaName); err != nil {
989+
preparedDbName+"_"+preparedSchemaName,
990+
constants.DefaultSearchPath+", "+preparedSchemaName); err != nil {
982991
return fmt.Errorf("could not initialize default roles for database schema %s: %v", preparedSchemaName, err)
983992
}
984993
if preparedSchema.DefaultUsers {
985994
if err := c.initDefaultRoles(defaultUsers,
986995
preparedDbName+constants.OwnerRoleNameSuffix,
987-
preparedDbName+"_"+preparedSchemaName); err != nil {
996+
preparedDbName+"_"+preparedSchemaName,
997+
constants.DefaultSearchPath+", "+preparedSchemaName); err != nil {
988998
return fmt.Errorf("could not initialize default users for database schema %s: %v", preparedSchemaName, err)
989999
}
9901000
}
@@ -994,7 +1004,7 @@ func (c *Cluster) initPreparedDatabaseRoles() error {
9941004
return nil
9951005
}
9961006

997-
func (c *Cluster) initDefaultRoles(defaultRoles map[string]string, admin, prefix string) error {
1007+
func (c *Cluster) initDefaultRoles(defaultRoles map[string]string, admin, prefix string, searchPath string) error {
9981008

9991009
for defaultRole, inherits := range defaultRoles {
10001010

@@ -1018,12 +1028,13 @@ func (c *Cluster) initDefaultRoles(defaultRoles map[string]string, admin, prefix
10181028
}
10191029

10201030
newRole := spec.PgUser{
1021-
Origin: spec.RoleOriginBootstrap,
1022-
Name: roleName,
1023-
Password: util.RandomPassword(constants.PasswordLength),
1024-
Flags: flags,
1025-
MemberOf: memberOf,
1026-
AdminRole: adminRole,
1031+
Origin: spec.RoleOriginBootstrap,
1032+
Name: roleName,
1033+
Password: util.RandomPassword(constants.PasswordLength),
1034+
Flags: flags,
1035+
MemberOf: memberOf,
1036+
Parameters: map[string]string{"search_path": searchPath},
1037+
AdminRole: adminRole,
10271038
}
10281039
if currentRole, present := c.pgUsers[roleName]; present {
10291040
c.pgUsers[roleName] = c.resolveNameConflict(&currentRole, &newRole)

‎pkg/util/constants/roles.go

Lines changed: 16 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -2,20 +2,21 @@ package constants
22

33
// Roles specific constants
44
const (
5-
PasswordLength = 64
6-
SuperuserKeyName = "superuser"
5+
PasswordLength = 64
6+
SuperuserKeyName = "superuser"
77
ConnectionPoolerUserKeyName = "pooler"
8-
ReplicationUserKeyName = "replication"
9-
RoleFlagSuperuser = "SUPERUSER"
10-
RoleFlagInherit = "INHERIT"
11-
RoleFlagLogin = "LOGIN"
12-
RoleFlagNoLogin = "NOLOGIN"
13-
RoleFlagCreateRole = "CREATEROLE"
14-
RoleFlagCreateDB = "CREATEDB"
15-
RoleFlagReplication = "REPLICATION"
16-
RoleFlagByPassRLS = "BYPASSRLS"
17-
OwnerRoleNameSuffix = "_owner"
18-
ReaderRoleNameSuffix = "_reader"
19-
WriterRoleNameSuffix = "_writer"
20-
UserRoleNameSuffix = "_user"
8+
ReplicationUserKeyName = "replication"
9+
RoleFlagSuperuser = "SUPERUSER"
10+
RoleFlagInherit = "INHERIT"
11+
RoleFlagLogin = "LOGIN"
12+
RoleFlagNoLogin = "NOLOGIN"
13+
RoleFlagCreateRole = "CREATEROLE"
14+
RoleFlagCreateDB = "CREATEDB"
15+
RoleFlagReplication = "REPLICATION"
16+
RoleFlagByPassRLS = "BYPASSRLS"
17+
OwnerRoleNameSuffix = "_owner"
18+
ReaderRoleNameSuffix = "_reader"
19+
WriterRoleNameSuffix = "_writer"
20+
UserRoleNameSuffix = "_user"
21+
DefaultSearchPath = "\"$user\""
2122
)

‎pkg/util/users/users.go

Lines changed: 11 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -114,14 +114,14 @@ func (strategy DefaultUserSyncStrategy) ExecuteSyncRequests(requests []spec.PgSy
114114

115115
return nil
116116
}
117-
func (strategy DefaultUserSyncStrategy) alterPgUserSet(user spec.PgUser, db *sql.DB) (err error) {
117+
118+
func (strategy DefaultUserSyncStrategy) alterPgUserSet(user spec.PgUser, db *sql.DB) error {
118119
queries := produceAlterRoleSetStmts(user)
119120
query := fmt.Sprintf(doBlockStmt, strings.Join(queries, ";"))
120-
if _, err = db.Exec(query); err != nil {
121-
err = fmt.Errorf("dB error: %v, query: %s", err, query)
122-
return
121+
if _, err := db.Exec(query); err != nil {
122+
return fmt.Errorf("dB error: %v, query: %s", err, query)
123123
}
124-
return
124+
return nil
125125
}
126126

127127
func (strategy DefaultUserSyncStrategy) createPgUser(user spec.PgUser, db *sql.DB) error {
@@ -149,6 +149,12 @@ func (strategy DefaultUserSyncStrategy) createPgUser(user spec.PgUser, db *sql.D
149149
return fmt.Errorf("dB error: %v, query: %s", err, query)
150150
}
151151

152+
if len(user.Parameters) > 0 {
153+
if err := strategy.alterPgUserSet(user, db); err != nil {
154+
return fmt.Errorf("incomplete setup for user %s: %v", user.Name, err)
155+
}
156+
}
157+
152158
return nil
153159
}
154160

0 commit comments

Comments
 (0)