Allow writer user to create tables in schema

[mfuhrmeisterDM]

why

In postgres 15 they change the behaviour of the public schema. Now only the owner can create tables in this schema. And the user is in charge to configure the permissions.

proposed change

Grant the writer user to also create tables in a schema.

usage

add the public schema explicitly to the list of schemas to create, to force the schema privileges to be applied.

[pcallewaert]

👋 We tested this PR out as we are migrating to PG15, but we noticed this was only a part of the solution. We also had to call the new function for the public schema in the db creation logic when the ownership is transferred to the new owner, and also for the writer group.

@mfuhrmeisterDM are you still working on this? If not, I can try to work on this.

[mfuhrmeisterDM]

@pcallewaert I updated the PR like requested. I must say I almost forgot this PR, thanks for the reminder.

[mfuhrmeisterDM]

👋 We tested this PR out as we are migrating to PG15, but we noticed this was only a part of the solution. We also had to call the new function for the public schema in the db creation logic when the ownership is transferred to the new owner, and also for the writer group.

Can you explain a bit more what you mean, because in our case this worked fine.

[pcallewaert]

👋 We tested this PR out as we are migrating to PG15, but we noticed this was only a part of the solution. We also had to call the new function for the public schema in the db creation logic when the ownership is transferred to the new owner, and also for the writer group.

Can you explain a bit more what you mean, because in our case this worked fine.

Of course. We are using a very basic Postgres resource:

apiVersion: db.movetokube.com/v1alpha1
kind: Postgres
metadata:
  name: postgresdb
spec:
  database: example-db
  dropOnDelete: true
  extensions:
    - fuzzystrmatch

We don't have schemas defined as we just use the public schema, and we use the owner permissions for our user.
The code changes here are made in the for loop for each schema. So we never hit the new code as this is an empty array.
In our patched version we re-used your method on L180 during the database creation logic, but specific for the public schema for the owner group.

[mfuhrmeisterDM]

Of course. We are using a very basic Postgres resource:

apiVersion: db.movetokube.com/v1alpha1
kind: Postgres
metadata:
  name: postgresdb
spec:
  database: example-db
  dropOnDelete: true
  extensions:
    - fuzzystrmatch

We don't have schemas defined as we just use the public schema, and we use the owner permissions for our user. The code changes here are made in the for loop for each schema. So we never hit the new code as this is an empty array. In our patched version we re-used your method on L180 during the database creation logic, but specific for the public schema for the owner group.

Got it, I will address this.
Edit: I double checked our code and we had the same problem. But we instead just added the public schema to the list of schemes. Is this also an option to you? (@pcallewaert )

[pcallewaert]

Of course. We are using a very basic Postgres resource:

apiVersion: db.movetokube.com/v1alpha1
kind: Postgres
metadata:
  name: postgresdb
spec:
  database: example-db
  dropOnDelete: true
  extensions:
    - fuzzystrmatch

We don't have schemas defined as we just use the public schema, and we use the owner permissions for our user. The code changes here are made in the for loop for each schema. So we never hit the new code as this is an empty array. In our patched version we re-used your method on L180 during the database creation logic, but specific for the public schema for the owner group.

Got it, I will address this. Edit: I double checked our code and we had the same problem. But we instead just added the public schema to the list of schemes. Is this also an option to you? (@pcallewaert )

If it works it is certainly an option 😄 I'll have to test it out, I'm hoping to do it this week.

[mfuhrmeisterDM]

@hitman99 can you please have a look?

[hitman99]

Nice work, will check this out tomorrow. If there's no problems this will be merged and released as well

[pcallewaert]

👋 I've finally found time to test it out, and the PR should indeed work for the writer user specific. But for the OWNER privilege it is missing a bit.
During the CreateDB we should also give the owner group the permissions to create in the database. Even as owner, you don't have the permissions to create without the explicit GRANT.
https://github.com/pcallewaert/postgres-operator/blob/pc/test-pg15-fix/pkg/postgres/database.go#L45-L53

[mfuhrmeisterDM]

👋 I've finally found time to test it out, and the PR should indeed work for the writer user specific. But for the OWNER privilege it is missing a bit. During the CreateDB we should also give the owner group the permissions to create in the database. Even as owner, you don't have the permissions to create without the explicit GRANT. https://github.com/pcallewaert/postgres-operator/blob/pc/test-pg15-fix/pkg/postgres/database.go#L45-L53

incorporated this

[hitman99]

Hey @mfuhrmeisterDM woud you mind merging master or rebasing on master? I approve the changes but would like to base it on master. Once that's done I'll merge & release it