-
-
Notifications
You must be signed in to change notification settings - Fork 69
Implement Multi-database PostgresUser #250
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: master
Are you sure you want to change the base?
Conversation
Wow, nice work! I'll try to free some time this week to look into this |
I am not sure this will be liked by all organizations, same user, same password across multiple database clusters.. I am personally using range logic in my Helm chart and doing all that possible. |
This is not the same user across clusters, rather the ability to have one role that can access more than one database within the same postgres cluster. This is applicable when an application uses more than one database for whatever reason. An application using a primary database but reading data out of a data warehouse style DB, for instance. There is another common pattern that is used by several applications in homelab scenarios where the application uses one DB for application state persistence and another for logging. I couldn't tell you why, but this pattern is rather entrenched and unlikely to change for these projects that do it. This retains the old usage pattern still, albeit marked as deprecated. |
I agree it's not the best practice, we see the need for it in multiple issues. |
I would argue that the deprecation is the right direction to go. A concise API makes for easier maintainability long term and allows everybody to be on the same page about how the CR should be configured. Keeping two separate ways around to do the same thing so that ???(not clear on what is gained) adds complexity. The deprecation does not remove the ability to use, rather it marks the array pattern as the preferred pattern so that in future versions the API can be simplified. |
This means the operator should be able to authenticate to both DB instances? |
This is an initial implementation of a multi-database PostgresUser as mentioned in #201 and #92. As mentioned in the linked discussion the structure of the secret that is created needs to change as a result of this change. Currently the changes in this PR only use the first DB listed in the PostgresUser, resulting in a secret that looks like this:
This is the resulting secret from the following resources:
A review would be appreciated and I would like to have a discussion around how secrets should be structured when adding a PostgresUser with privileges to multiple databases.