(maint) Add read-only user. #330
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,59 @@ | ||
| # Private class. Grant read permissions to $database_read_only_username by default, for new tables created by | ||
| # $database_username. | ||
| define puppetdb::database::default_read_grant( | ||
| String $database_name, | ||
| String $schema, | ||
| String $database_username, | ||
| String $database_read_only_username, | ||
| ) { | ||
| postgresql_psql {"grant default select permission for ${database_read_only_username}": | ||
| db => $database_name, | ||
| command => "ALTER DEFAULT PRIVILEGES | ||
| FOR USER \"${database_username}\" | ||
| IN SCHEMA \"${schema}\" | ||
| GRANT SELECT ON TABLES | ||
| TO \"${database_read_only_username}\"", | ||
| unless => "SELECT | ||
| ns.nspname, | ||
| acl.defaclobjtype, | ||
| acl.defaclacl | ||
| FROM pg_default_acl acl | ||
| JOIN pg_namespace ns ON acl.defaclnamespace=ns.oid | ||
| WHERE acl.defaclacl::text ~ '.*\\\\\"${database_read_only_username}\\\\\"=r/${database_username}\\\".*' | ||
| AND nspname = '${schema}'", | ||
| } | ||
|
|
||
| postgresql_psql {"grant default usage permission for ${database_read_only_username}": | ||
| db => $database_name, | ||
| command => "ALTER DEFAULT PRIVILEGES | ||
| FOR USER \"${database_username}\" | ||
| IN SCHEMA \"${schema}\" | ||
| GRANT USAGE ON SEQUENCES | ||
| TO \"${database_read_only_username}\"", | ||
| unless => "SELECT | ||
| ns.nspname, | ||
| acl.defaclobjtype, | ||
| acl.defaclacl | ||
| FROM pg_default_acl acl | ||
| JOIN pg_namespace ns ON acl.defaclnamespace=ns.oid | ||
| WHERE acl.defaclacl::text ~ '.*\\\\\"${database_read_only_username}\\\\\"=U/${database_username}\\\".*' | ||
| AND nspname = '${schema}'", | ||
| } | ||
|
|
||
| postgresql_psql {"grant default execute permission for ${database_read_only_username}": | ||
| db => $database_name, | ||
| command => "ALTER DEFAULT PRIVILEGES | ||
| FOR USER \"${database_username}\" | ||
| IN SCHEMA \"${schema}\" | ||
| GRANT EXECUTE ON FUNCTIONS | ||
| TO \"${database_read_only_username}\"", | ||
| unless => "SELECT | ||
| ns.nspname, | ||
| acl.defaclobjtype, | ||
| acl.defaclacl | ||
| FROM pg_default_acl acl | ||
| JOIN pg_namespace ns ON acl.defaclnamespace=ns.oid | ||
| WHERE acl.defaclacl::text ~ '.*\\\\\"${database_read_only_username}\\\\\"=X/${database_username}\\\".*' | ||
| AND nspname = '${schema}'", | ||
| } | ||
| } |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,34 @@ | ||
| # Private class for configuring the pg_ident.conf and pg_hba.conf files | ||
| define puppetdb::database::postgresql_ssl_rules ( | ||
| String $database_name, | ||
| String $database_username, | ||
| String $puppetdb_server, | ||
| ) { | ||
| $identity_map_key = "${database_name}-${database_username}-map" | ||
|
|
||
| postgresql::server::pg_hba_rule { "Allow certificate mapped connections to ${database_name} as ${database_username} (ipv4)": | ||
| type => 'hostssl', | ||
| database => $database_name, | ||
| user => $database_username, | ||
| address => '0.0.0.0/0', | ||
| auth_method => 'cert', | ||
| order => 0, | ||
| auth_option => "map=${identity_map_key} clientcert=1" | ||
| } | ||
|
|
||
| postgresql::server::pg_hba_rule { "Allow certificate mapped connections to ${database_name} as ${database_username} (ipv6)": | ||
| type => 'hostssl', | ||
| database => $database_name, | ||
| user => $database_username, | ||
| address => '::0/0', | ||
| auth_method => 'cert', | ||
| order => 0, | ||
| auth_option => "map=${identity_map_key} clientcert=1" | ||
| } | ||
|
|
||
| postgresql::server::pg_ident_rule { "Map the SSL certificate of the server as a ${database_username} user": | ||
| map_name => $identity_map_key, | ||
| system_username => $puppetdb_server, | ||
| database_username => $database_username, | ||
| } | ||
| } |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,50 @@ | ||
| # Private class. Grant read-only permissions to $database_read_only_username for all objects in $schema of | ||
| # $database_name | ||
| define puppetdb::database::read_grant ( | ||
| String $database_name, | ||
| String $schema, | ||
| String $database_read_only_username, | ||
| ) { | ||
| postgresql_psql { "grant select permission for ${database_read_only_username}": | ||
| db => $database_name, | ||
| command => "GRANT SELECT | ||
| ON ALL TABLES IN SCHEMA \"${schema}\" | ||
| TO \"${database_read_only_username}\"", | ||
| unless => "SELECT * FROM ( | ||
| SELECT COUNT(*) | ||
| FROM pg_tables | ||
| WHERE schemaname='public' | ||
| AND has_table_privilege('${database_read_only_username}', schemaname || '.' || tablename, 'SELECT')=false | ||
| ) x | ||
| WHERE x.count=0", | ||
| } | ||
|
|
||
| postgresql_psql { "grant usage permission for ${database_read_only_username}": | ||
| db => $database_name, | ||
| command => "GRANT USAGE | ||
| ON ALL SEQUENCES IN SCHEMA \"${schema}\" | ||
| TO \"${database_read_only_username}\"", | ||
| unless => "SELECT * FROM ( | ||
| SELECT COUNT(*) | ||
| FROM information_schema.sequences | ||
| WHERE sequence_schema='public' | ||
| AND has_sequence_privilege('${database_read_only_username}', sequence_schema || '.' || sequence_name, 'USAGE')=false | ||
| ) x | ||
| WHERE x.count=0", | ||
| } | ||
|
|
||
| postgresql_psql { "grant execution permission for ${database_read_only_username}": | ||
| db => $database_name, | ||
| command => "GRANT EXECUTE | ||
| ON ALL FUNCTIONS IN SCHEMA \"${schema}\" | ||
| TO \"${database_read_only_username}\"", | ||
| unless => "SELECT * FROM ( | ||
| SELECT COUNT(*) | ||
| FROM pg_catalog.pg_proc p | ||
| LEFT JOIN pg_catalog.pg_namespace n ON n.oid = p.pronamespace | ||
| WHERE n.nspname='public' | ||
| AND has_function_privilege('${database_read_only_username}', p.oid, 'EXECUTE')=false | ||
| ) x | ||
| WHERE x.count=0", | ||
| } | ||
| } |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,44 @@ | ||
| # Private class | ||
| # A define type to manage the creation of a read-only postgres users. | ||
| # In particular, it manages the necessary grants to enable such a user | ||
| # to have read-only access to any existing objects as well as changes | ||
| # the default access privileges so read-only access is maintained when | ||
| # new objects are created by the $database_owner | ||
| # | ||
| # @param database_read_only_username [String] The name of the postgres read only user. | ||
| # @param database [String] The name of the database to grant access to. | ||
| # @param database_owner [String] The user which owns the database (i.e. the migration user | ||
| # for the database). | ||
| # @param password_hash [String] The value of $_database_password in app_database. | ||
|
|
||
| define puppetdb::database::read_only_user ( | ||
| String $read_database_username, | ||
| String $database_name, | ||
| String $database_owner, | ||
| Variant[String, Boolean] $password_hash = false, | ||
| ) { | ||
| postgresql::server::role { $read_database_username: | ||
| password_hash => $password_hash, | ||
| } | ||
|
|
||
| -> postgresql::server::database_grant { "${database_name} grant connection permission to ${read_database_username}": | ||
| privilege => 'CONNECT', | ||
| db => $database_name, | ||
| role => $read_database_username, | ||
| } | ||
|
|
||
| -> puppetdb::database::default_read_grant { | ||
| "${database_name} grant read permission on new objects from ${database_owner} to ${read_database_username}": | ||
| database_username => $database_owner, | ||
| database_read_only_username => $read_database_username, | ||
| database_name => $database_name, | ||
| schema => 'public', | ||
| } | ||
|
|
||
| -> puppetdb::database::read_grant { | ||
| "${database_name} grant read-only permission on existing objects to ${read_database_username}": | ||
| database_read_only_username => $read_database_username, | ||
| database_name => $database_name, | ||
| schema => 'public', | ||
| } | ||
| } |
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Does this always default to
puppetdb-read? Ifmanagedis set to false will it still default topuppetdb-reador will it default todatabase_username?There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This always defaults to puppetdb-read