elifesciences / elife-xpub

eLife is an open-access journal and technology provider that publishes promising research in the life and biomedical sciences. This is their implementation of a submission and peer review system based on Coko PubSweet and xPub.
https://elifesciences.org/
MIT License
32 stars 5 forks source link

Review environments broken by lack of support for pgcrypto extension #1226

Closed giorgiosironi closed 5 years ago

giorgiosironi commented 5 years ago

Dependency of the pg-boss NPM package, a queuing system based on Postgres and introduced by Pubsweet at some point.

Can reproduce on review environments:

$ kubectl exec -it elife-xpub--pr-1223-postgresql-0 bash                                                                                       
I have no name!@elife-xpub--pr-1223-postgresql-0:/$ PGUSER=test PSPASSWORD=pw psql
psql (10.5)
Type "help" for help.

test=> CREATE EXTENSION IF NOT EXISTS pgcrypto;
ERROR:  permission denied to create extension "pgcrypto"
HINT:  Must be superuser to create this extension.

Options:

  1. give the test user more permissions (to be understood how)
  2. switch from the bitnami production-oriented postgres image to the default postgres one (somewhat easy, but may create other unknown problems)
  3. move the setup of this in another process using another user (too complicated)

Before going down into any of these holes, I want to check what RDS does because it also has a slightly limited user. RDS seems ok with it:

elifexpubend2end=> CREATE EXTENSION IF NOT EXISTS pgcrypto;
NOTICE:  extension "pgcrypto" already exists, skipping
CREATE EXTENSION```

Hence I'll open a PR for changing the postgres image we use in review environments, see if that works - let's not use a more locked down user in ci than we do in prod.

giorgiosironi commented 5 years ago

Option 2 not viable, the bitnami image is locked in due to the chart using POSTGRESQL_* environment variables (and who knows what else, e.g. paths like /bitnami/...)

Option 3 is complicated, so let's try option 1 if we can first.

giorgiosironi commented 5 years ago

Option 1 redux, is to remove the custom user altogether and use the default postgres one which has all the permissions we need.

giorgiosironi commented 5 years ago

Re-building https://github.com/elifesciences/elife-xpub/pull/1223 review environment to verify the fix.

giorgiosironi commented 5 years ago

http://35.172.178.78:30750/ is now working again.