Default privileges do not synced for preparedDatabases

[baznikin]

Please, answer some short questions which should help us to understand your problem / question better?

• Which image of the operator are you using? registry.opensource.zalan.do/acid/postgres-operator:v1.8.2
• Where do you run it - cloud or metal? Kubernetes or OpenShift? DigitalOcean K8S
• Are you running Postgres Operator in production? yes
• Type of issue? Bug report

There is long living databases, created with ancient versions of operator. We migrate them to preparedDatabases and try to use defaultUsers. However, there is no default privileges defined and DB_reader_user can't read anything. If we create new preparedDatabase then default privileges are created.

I suppose call to execAlterGlobalDefaultPrivileges shoud be added to syncPreparedDatabases function.

[FxKu]

Default privileges should get set for db and schema owners, but it will only take effect for newly created tables, not for existing ones. This would require extra GRANTs to these newly created default users. This is how Postgres works.

The operator could do the grants. I once created a PR that could do it, although the intention there is to set privileges for extension objects.