Skip to content

postgresql_grant: in-place updates when objects change (table/sequence)#614

Open
nicks wants to merge 1 commit intocyrilgdn:mainfrom
nicks:nicks/objects
Open

postgresql_grant: in-place updates when objects change (table/sequence)#614
nicks wants to merge 1 commit intocyrilgdn:mainfrom
nicks:nicks/objects

Conversation

@nicks
Copy link

@nicks nicks commented Jan 22, 2026

Before this PR, when the 'objects' field changed,
the grant resource was recreated.

This has some downsides:

  • If the create fails, the existing grant is lost
  • There is a brief moment during the update where the role has no privileges.

To support a transactional update in-place, the read function needs to be able to correctly read the state of existing objects and detect partial update failures.

I only made this change for tables and sequences. Other object types will still do re-create.

Fixes #208

Before this PR, when the 'objects' field changed,
the grant resource was recreated.

This has some downsides:
- If the create fails, the existing grant is lost
- There is a brief moment during the update where the role has no privileges.

To support a transactional update in-place, the read function needs to be
able to correctly read the state of existing objects and detect partial
update failures.

I only made this change for tables and sequences. Other
object types will still do re-create.

Fixes cyrilgdn#208

Signed-off-by: Nick Santos <nick.santos@docker.com>
@raghavan-arvind
Copy link

@cyrilgdn Any chance you're able to take a look here? 🙏 This would help our usecases as well

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Granting / revoking privileges on tables through "objects" is not atomic

2 participants