feat: Update operator k8s role

Author: tkcontiant

charts/ext-postgres-operator/templates/clusterrole.yaml

@@ -11,6 +11,14 @@ rules:
       - secrets
     verbs:
       - "*"
+  - apiGroups:
+      - ""
+    resources:
+      - events
+    verbs:
+      - create
+      - patch
+      - update
   - apiGroups:
       - coordination.k8s.io
     resources:

charts/ext-postgres-operator/templates/role.yaml

@@ -18,7 +18,15 @@ rules:
     resources:
       - pods
     verbs:
-      - "get"
+      - get
+  - apiGroups:
+      - ""
+    resources:
+      - events
+    verbs:
+      - create
+      - patch
+      - update
   - apiGroups:
       - coordination.k8s.io
     resources:
@@ -32,9 +40,9 @@ rules:
       - patch
       - delete
   - apiGroups:
-      - "apps"
+      - apps
     resources:
       - replicasets
       - deployments
     verbs:
-      - "get"
+      - get

internal/controller/postgres_controller.go

@@ -170,7 +170,7 @@ func (r *PostgresReconciler) Reconcile(ctx context.Context, req ctrl.Request) (c
 	}
 
 	desiredOwner := instance.Spec.MasterRole
-	// handle owner rename if was previously set by instance.Spec.MasterRole then was removed
+	// reconcile instance.Spec.MasterRole if it was changed
 	if desiredOwner == "" {
 		desiredOwner = fmt.Sprintf("%s-group", instance.Spec.Database)
 	}
@@ -184,6 +184,14 @@ func (r *PostgresReconciler) Reconcile(ctx context.Context, req ctrl.Request) (c
 		instance.Status.Roles.Owner = desiredOwner
 	}
 
+	// reconcile the desired owner of the database
+	if instance.Status.Roles.Owner != "" {
+		err = r.pg.AlterDatabaseOwner(instance.Spec.Database, instance.Status.Roles.Owner)
+		if err != nil {
+			return requeue(errors.NewInternalError(err))
+		}
+	}
+
 	// create extensions
 	for _, extension := range instance.Spec.Extensions {
 		// Check if extension is already added. Skip if already is added.
@@ -208,7 +216,7 @@ func (r *PostgresReconciler) Reconcile(ctx context.Context, req ctrl.Request) (c
 		writerPrivs         = "SELECT,INSERT,DELETE,UPDATE"
 		writerSequencePrivs = "USAGE,SELECT"
 		writerFunctionPrivs = "EXECUTE"
-		ownerPrivs          = "ALL,MAINTAIN"
+		ownerPrivs          = "ALL"
 		ownerFunctionPrivs  = "ALL"
 		ownerSequencePrivs  = "ALL"
 	)

internal/controller/postgresuser_controller.go

@@ -224,6 +224,9 @@ func (r *PostgresUserReconciler) Reconcile(ctx context.Context, req ctrl.Request
 				return r.requeue(ctx, instance, err)
 			}
 		}
+	} else {
+		role = instance.Status.PostgresRole
+		login = instance.Status.PostgresLogin
 	}
 
 	err = r.addFinalizer(ctx, reqLogger, instance)

pkg/postgres/aws.go

@@ -78,3 +78,7 @@ func (c *awspg) DropRole(role, newOwner, database string, logger logr.Logger) er
 
 	return c.pg.DropRole(role, newOwner, database, logger)
 }
+
+func (c *awspg) AlterDatabaseOwner(dbName, owner string) error {
+	return c.pg.AlterDatabaseOwner(dbName, owner)
+}

pkg/postgres/azure.go

@@ -48,3 +48,7 @@ func (azpg *azurepg) DropRole(role, newOwner, database string, logger logr.Logge
 	// Delegate to parent implementation to perform the actual drop
 	return azpg.pg.DropRole(role, newOwner, database, logger)
 }
+
+func (azpg *azurepg) AlterDatabaseOwner(dbName, owner string) error {
+	return azpg.pg.AlterDatabaseOwner(dbName, owner)
+}

pkg/postgres/database.go

@@ -48,6 +48,15 @@ func (c *pg) CreateDB(dbname, role string) error {
 	return nil
 }
 
+// reconcile the desired owner of the database
+func (c *pg) AlterDatabaseOwner(dbname, owner string) error {
+	_, err := c.db.Exec(fmt.Sprintf(ALTER_DB_OWNER, dbname, owner))
+	if err != nil {
+		return err
+	}
+	return nil
+}
+
 func (c *pg) CreateSchema(db, role, schema string, logger logr.Logger) error {
 	tmpDb, err := GetConnection(c.user, c.pass, c.host, db, c.args, logger)
 	if err != nil {

pkg/postgres/gcp.go

@@ -83,3 +83,7 @@ func (c *gcppg) DropRole(role, newOwner, database string, logger logr.Logger) er
 	}
 	return nil
 }
+
+func (c *gcppg) AlterDatabaseOwner(dbName, owner string) error {
+	return c.pg.AlterDatabaseOwner(dbName, owner)
+}

pkg/postgres/postgres.go

@@ -18,6 +18,7 @@ type PG interface {
 	CreateUserRole(role, password string) (string, error)
 	UpdatePassword(role, password string) error
 	GrantRole(role, grantee string) error
+	AlterDatabaseOwner(dbName, owner string) error
 	SetSchemaPrivileges(schemaPrivileges PostgresSchemaPrivileges, logger logr.Logger) error
 	RevokeRole(role, revoked string) error
 	AlterDefaultLoginRole(role, setRole string) error