CrunchyData / postgres-operator

Production PostgreSQL for Kubernetes, from high availability Postgres clusters to full-scale database-as-a-service.
https://access.crunchydata.com/documentation/postgres-operator/v5/
Apache License 2.0
3.96k stars 594 forks source link

Feature Request: create a superuser per default #3736

Open mzwettler2 opened 1 year ago

mzwettler2 commented 1 year ago
When you create a Postgres cluster with PGO and do not specify any additional users or databases, PGO will do the following:
° Create a database that matches the name of the Postgres cluster.
° Create an unprivileged Postgres user with the name of the cluster. This user has access to the database created in the previous step.
° Create a Secret with the login credentials and connection details for the Postgres user in relation to the database.

https://access.crunchydata.com/documentation/postgres-operator/5.3.0/architecture/user-management/

Only an unprivileged user is created by default. A superuser is usually also required. I would appreciate it if you would also create a superuser by default. Otherwise you have to specify the full spec.users clause to also get a superuser.

In other words, I want to get this by default when I do not specify the spec.users clause: ° Create a database that matches the name of the Postgres cluster. ° Create an unprivileged Postgres user with the name of the cluster. This user has access to the database created in the previous step. ° Create a superuser (eg. \<name of the cluster>_admin)

dsessler7 commented 1 year ago

@mzwettler2, I will add a feature request to the backlog. However, I'm curious if you could provide details on your use case that make adding to the spec.users undesirable.

I will also note that the postgres superuser is created by default, you just need to add it to the spec to gain access to a Secret that contains its credentials:

https://access.crunchydata.com/documentation/postgres-operator/latest/tutorials/basic-setup/user-management#managing-the-postgres-user

mzwettler2 commented 1 year ago

@dsessler7

I'm not saying it wouldn't be desirable to add users to spec.users. I'm just saying it would be super convenient and comfortable to get all required users by default without adding anything.