mirror of
https://github.com/neondatabase/neon.git
synced 2026-05-18 21:50:37 +00:00
dd7fff655a
## Problem Currently `neon_superuser` is hardcoded in many places. It makes it harder to reuse the same code in different envs. ## Summary of changes Parametrize `neon_superuser` in `compute_ctl` via `--privileged-role-name` and in `neon` extensions via `neon.privileged_role_name`, so it's now possible to use different 'superuser' role names if needed. Everything still defaults to `neon_superuser`, so no control plane code changes are needed and I intentionally do not touch regression and migrations tests. Postgres PRs: - https://github.com/neondatabase/postgres/pull/674 - https://github.com/neondatabase/postgres/pull/675 - https://github.com/neondatabase/postgres/pull/676 - https://github.com/neondatabase/postgres/pull/677 Cloud PR: - https://github.com/neondatabase/cloud/pull/31138
32 lines
1.3 KiB
SQL
32 lines
1.3 KiB
SQL
-- On December 8th, 2023, an engineering escalation (INC-110) was opened after
|
|
-- it was found that BYPASSRLS was being applied to all roles.
|
|
--
|
|
-- PR that introduced the issue: https://github.com/neondatabase/neon/pull/5657
|
|
-- Subsequent commit on main: https://github.com/neondatabase/neon/commit/ad99fa5f0393e2679e5323df653c508ffa0ac072
|
|
--
|
|
-- NOBYPASSRLS and INHERIT are the defaults for a Postgres role, but because it
|
|
-- isn't easy to know if a Postgres cluster is affected by the issue, we need to
|
|
-- keep the migration around for a long time, if not indefinitely, so any
|
|
-- cluster can be fixed.
|
|
--
|
|
-- Branching is the gift that keeps on giving...
|
|
|
|
DO $$
|
|
DECLARE
|
|
role_name text;
|
|
BEGIN
|
|
FOR role_name IN SELECT rolname FROM pg_roles WHERE pg_has_role(rolname, '{privileged_role_name}', 'member')
|
|
LOOP
|
|
RAISE NOTICE 'EXECUTING ALTER ROLE % INHERIT', quote_ident(role_name);
|
|
EXECUTE 'ALTER ROLE ' || quote_ident(role_name) || ' INHERIT';
|
|
END LOOP;
|
|
|
|
FOR role_name IN SELECT rolname FROM pg_roles
|
|
WHERE
|
|
NOT pg_has_role(rolname, '{privileged_role_name}', 'member') AND NOT starts_with(rolname, 'pg_')
|
|
LOOP
|
|
RAISE NOTICE 'EXECUTING ALTER ROLE % NOBYPASSRLS', quote_ident(role_name);
|
|
EXECUTE 'ALTER ROLE ' || quote_ident(role_name) || ' NOBYPASSRLS';
|
|
END LOOP;
|
|
END $$;
|