feat: migrate users to the correct role group during reconcile

Author: tkcontiant

internal/controller/postgresuser_controller.go

@@ -114,7 +114,9 @@ func (r *PostgresUserReconciler) Reconcile(ctx context.Context, req ctrl.Request
 	}
 
 	// Creation logic
-	var role, login string
+	var (
+		role, login string
+	)
 	password, err := utils.GetSecureRandomString(15)
 
 	if err != nil {
@@ -171,6 +173,59 @@ func (r *PostgresUserReconciler) Reconcile(ctx context.Context, req ctrl.Request
 		login = instance.Status.PostgresLogin
 	}
 
+	// Reconcile logic for changes in group membership
+	// This is only applicable if user role is already created
+	// and privileges are changed in spec
+	if instance.Status.PostgresRole != "" {
+
+		// We need to get the Postgres CR to get the group role name
+		database, err := r.getPostgresCR(ctx, instance)
+		if err != nil {
+			return r.requeue(ctx, instance, errors.NewInternalError(err))
+		}
+
+		// Determine desired group role
+		var desiredGroup string
+		switch instance.Spec.Privileges {
+		case "READ":
+			desiredGroup = database.Status.Roles.Reader
+		case "WRITE":
+			desiredGroup = database.Status.Roles.Writer
+		default:
+			desiredGroup = database.Status.Roles.Owner
+		}
+
+		currentGroup := instance.Status.PostgresGroup
+		if desiredGroup != "" && currentGroup != desiredGroup {
+
+			// Remove the old group membership if present
+			if currentGroup != "" {
+				err = r.pg.RevokeRole(currentGroup, role)
+				if err != nil {
+					return r.requeue(ctx, instance, errors.NewInternalError(err))
+				}
+			}
+
+			// Grant the new group role
+			err = r.pg.GrantRole(desiredGroup, role)
+			if err != nil {
+				return r.requeue(ctx, instance, errors.NewInternalError(err))
+			}
+
+			// Ensure objects created by the user are owned by the new group
+			err = r.pg.AlterDefaultLoginRole(role, desiredGroup)
+			if err != nil {
+				return r.requeue(ctx, instance, errors.NewInternalError(err))
+			}
+
+			instance.Status.PostgresGroup = desiredGroup
+			err = r.Status().Update(ctx, instance)
+			if err != nil {
+				return r.requeue(ctx, instance, err)
+			}
+		}
+	}
+
 	err = r.addFinalizer(ctx, reqLogger, instance)
 	if err != nil {
 		return r.requeue(ctx, instance, err)