zalando / spilo

Highly available elephant herd: HA PostgreSQL cluster using Docker
Apache License 2.0
1.55k stars 385 forks source link

Question: admin role membership is unclear #862

Closed mneverov closed 1 year ago

mneverov commented 1 year ago

I use postgres-operator+spilo+patroni. When I create a database with a default user the following users are created:

\du
     Role name     |                         Attributes                         |              Member of
-------------------+------------------------------------------------------------+-------------------------------------
 admin             | Create DB, Cannot login                                    | {cron_admin,myuser}
 cron_admin        | Cannot login                                               | {}
 myuser            | Create role, Create DB                                     | {}
 postgres          | Superuser, Create role, Create DB, Replication, Bypass RLS | {}
 robot_zmon        | Cannot login                                               | {}
 standby           | Replication                                                | {}

Question: why admin is a member of newly created users? I would expect be the other way around: newly created users are members of admin role so they inherit CREATEDB privilege. I don't get what benefits it gives to give membership of my user to admin , could you please clarify?

hughcapet commented 1 year ago

How do you create 'myuser' role?

mneverov commented 1 year ago

How do you create 'myuser' role?

@hughcapet thanks for the quick reply!

I create myuser via postgres-operator. I specify it as

postgresql.Spec.Users["myuser"] = acidv1.UserFlags{"LOGIN","CREATEROLE","CREATEDB"}

I do not grant the membership to admin explicitly.

hughcapet commented 1 year ago

then it is definitely not the right place to ask this question. Seems, you even know the link:)

mneverov commented 1 year ago

I mean admin is a role created by spilo. What is the idea behind it? What tasks it is supposed to do? Will ask about ownership in postgres-operator proj, thx.

hughcapet commented 1 year ago

it is granted to the real (human) users