Skip to content

Commit 3ebcebb

Browse files
[DPE-7556] Add catalog/database level roles and mark chamed_dba_role as done (#975)
* Add catalog/database level roles and mark chamed_dba_role as done * Remove charm_instance_admin user
1 parent 7cc1507 commit 3ebcebb

File tree

1 file changed

+13
-2
lines changed

1 file changed

+13
-2
lines changed

docs/explanation/roles.md

Lines changed: 13 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -41,8 +41,7 @@ Charmed PostgreSQL 16 introduces the following instance level predefined roles:
4141
* charmed_read (inherit from pg_read_all_data)
4242
* charmed_dml (inherit from pg_write_all_data)
4343
* charmed_backup (inherit from pg_checkpoint)
44-
* charmed_dba (WIP)
45-
* charmed_instance_admin (WIP)
44+
* charmed_dba (allowed to escalate to any other user, including the superuser `operator`)
4645

4746
```text
4847
test123=> SELECT * FROM pg_roles;
@@ -56,6 +55,18 @@ test123=> SELECT * FROM pg_roles;
5655
...
5756
```
5857

58+
Charmed PostgreSQL 16 also introduces catalog/database level roles, with permissions tied to each database that's created. Example for a database named `test`:
59+
60+
```text
61+
test123=> SELECT * FROM pg_roles where rolname like 'test_%';;
62+
rolname | rolsuper | rolinherit | rolcreaterole | rolcreatedb | rolcanlogin | rolreplication | rolconnlimit | rolpassword | rolvaliduntil | rolbypassrls | rolconfig | oid
63+
----------------------------+----------+------------+---------------+-------------+-------------+----------------+--------------+-------------+---------------+--------------+-----------+-------
64+
test_owner | f | t | f | f | f | f | -1 | ******** | | f | | 16479
65+
test_admin | f | f | f | f | f | f | -1 | ******** | | f | | 16480
66+
```
67+
68+
The `*_admin` role is assigned to each relation user (explained in the next section) with access to the specific database. When that user connects to the database, it's auto-escalated to the `*_owner` user, which will own every object inside the database, simplifying the permissions to perform operations on those objects when a new user requests access to that same database.
69+
5970
<!--TODO: are the next two sections also relevant for 16?-->
6071
### Relation specific roles
6172

0 commit comments

Comments
 (0)