diff --git a/pkg/postgres/aws.go b/pkg/postgres/aws.go index 2c7ba41f..61e73235 100644 --- a/pkg/postgres/aws.go +++ b/pkg/postgres/aws.go @@ -29,6 +29,31 @@ func (c *awspg) AlterDefaultLoginRole(role, setRole string) error { return c.pg.AlterDefaultLoginRole(role, setRole) } +func (c *awspg) CreateDB(dbname, role string) error { + // Have to add the master role to the group role before we can transfer the database owner + err := c.GrantRole(role, c.user) + if err != nil { + return err + } + + return c.pg.CreateDB(dbname, role) +} + +func (c *awspg) CreateUserRole(role, password string) (string, error) { + returnedRole, err := c.pg.CreateUserRole(role, password) + if err != nil { + return "", err + } + // On AWS RDS the postgres user isn't really superuser so he doesn't have permissions + // to ALTER DEFAULT PRIVILEGES FOR ROLE unless he belongs to the role + err = c.GrantRole(role, c.user) + if err != nil { + return "", err + } + + return returnedRole, nil +} + func (c *awspg) DropRole(role, newOwner, database string, logger logr.Logger) error { // On AWS RDS the postgres user isn't really superuser so he doesn't have permissions // to REASSIGN OWNED BY unless he belongs to both roles diff --git a/pkg/postgres/database.go b/pkg/postgres/database.go index eaf9add7..649e3513 100644 --- a/pkg/postgres/database.go +++ b/pkg/postgres/database.go @@ -9,10 +9,9 @@ import ( const ( CREATE_DB = `CREATE DATABASE "%s"` - CREATE_SCHEMA = `CREATE SCHEMA IF NOT EXISTS "%s"` + CREATE_SCHEMA = `CREATE SCHEMA IF NOT EXISTS "%s" AUTHORIZATION "%s"` CREATE_EXTENSION = `CREATE EXTENSION IF NOT EXISTS "%s"` ALTER_DB_OWNER = `ALTER DATABASE "%s" OWNER TO "%s"` - ALTER_SCHEMA_OWNER = `ALTER SCHEMA "%s" OWNER TO "%s"` DROP_DATABASE = `DROP DATABASE "%s"` GRANT_USAGE_SCHEMA = `GRANT USAGE ON SCHEMA "%s" TO "%s"` GRANT_ALL_TABLES = `GRANT %s ON ALL TABLES IN SCHEMA "%s" TO "%s"` @@ -51,19 +50,10 @@ func (c *pg) CreateSchema(db, role, schema string, logger logr.Logger) error { } defer tmpDb.Close() - _, err = tmpDb.Exec(fmt.Sprintf(CREATE_SCHEMA, schema)) + _, err = tmpDb.Exec(fmt.Sprintf(CREATE_SCHEMA, schema, role)) if err != nil { return err } - - // Set the schema owner in a separate step, because AWS RDS breaks if - // you try to create a schema and set the owner in a single command. - // See: https://github.com/movetokube/postgres-operator/issues/91 - _, err = tmpDb.Exec(fmt.Sprintf(ALTER_SCHEMA_OWNER, schema, role)) - if err != nil { - return err - } - return nil }