Skip to content

Adds support for DefaultPrivileges in postgres#199

Merged
Duologic merged 22 commits intocrossplane-contrib:masterfrom
xocasdashdash:master
Feb 13, 2026
Merged

Adds support for DefaultPrivileges in postgres#199
Duologic merged 22 commits intocrossplane-contrib:masterfrom
xocasdashdash:master

Conversation

@xocasdashdash
Copy link
Contributor

@xocasdashdash xocasdashdash commented Oct 27, 2024

Description of your changes

Adds support to DefaultPrivileges for postgres.
Fixes #117

I have:

  • Read and followed Crossplane's contribution process.
  • Run make reviewable to ensure this PR is ready for review.

How has this code been tested

I've been trying to test this locally but i'm really struggling to deploy the provider to a local kind cluster
It's following the same pattern as the grants, we only care about the creation of the default privileges as the grant/revoke runs in a single transaction.

From xocasdashdash#1 by @fernandezcuesta

Locally with a kind cluster, running from the examples folder and verified with:

  SELECT                                                                                                                                                                                                                                 
      pg_get_userbyid(d.defaclrole) AS target_role,                                                                                                                                                                                        
      CASE d.defaclobjtype                                                                                                                                                                                                                 
          WHEN 'r' THEN 'table'                                                                                                                                                                                                            
          WHEN 'f' THEN 'function'                                                                                                                                                                                                         
          WHEN 'S' THEN 'sequence'                                                                                                                                                                                                         
          WHEN 'T' THEN 'type'
          WHEN 'n' THEN 'schema'
      END AS object_type,
      n.nspname AS schema,
      pg_get_userbyid((aclexplode(d.defaclacl)).grantee) AS grantee,
      (aclexplode(d.defaclacl)).privilege_type
  FROM pg_default_acl d
  LEFT JOIN pg_namespace n ON d.defaclnamespace = n.oid
  ORDER BY target_role, object_type, grantee;

@xocasdashdash xocasdashdash force-pushed the master branch 2 times, most recently from 271b438 to de33b05 Compare October 27, 2024 08:52
@xocasdashdash
Copy link
Contributor Author

Well i manage to get this deployed to kind but it involves

  • run a registry as a service inside the kind cluster
  • running make build
  • using crane to export the package as a docker image:
crane push _output/xpkg/linux_arm64/provider-sql-v0.9.0-19.g4d629ee.dirty.xpkg 0.0.0.0:5001/provider-sql-v0.9.0-19.g4d629ee:latest --insecure
  • pull the image locally:
docker pull 0.0.0.0:5001/provider-sql-v0.9.0-19.g4d629ee:latest
  • retag it matching the crane package:
docker tag 0.0.0.0:5001/provider-sql-v0.9.0-19.g4d629ee:latest registry.crossplane-system.svc.cluster.local:5001/provider-sql-v0.9.0-19.g4d629ee:latest
  • Load it with kind into the cluster:
kind --name local load docker-image registry.crossplane-system.svc.cluster.local:5001/provider-sql-v0.9.0-19.g4d629ee:latest

and then it "just works"

@ChrisJBurns
Copy link

ChrisJBurns commented Jan 28, 2025

Would really love this to be merged as we also need to alter default privs

@benjaminlefevre
Copy link

Hi, will be the PR one day merged? I also need default privileges.

@xocasdashdash
Copy link
Contributor Author

Hi, will be the PR one day merged? I also need default privileges.

I've started looking into this PR, there's been several changes in the apis used and I'm trying to get a fix in place but will take some time

fernandezcuesta added a commit to fernandezcuesta/provider-sql that referenced this pull request Feb 4, 2026
…+cluster

Signed-off-by: Jesús Fernández <7312236+fernandezcuesta@users.noreply.github.com>
fernandezcuesta added a commit to fernandezcuesta/provider-sql that referenced this pull request Feb 10, 2026
Signed-off-by: Jesús Fernández <7312236+fernandezcuesta@users.noreply.github.com>
fernandezcuesta added a commit to fernandezcuesta/provider-sql that referenced this pull request Feb 10, 2026
Signed-off-by: Jesús Fernández <7312236+fernandezcuesta@users.noreply.github.com>
xocasdashdash and others added 17 commits February 11, 2026 21:54
Signed-off-by: Joaquín Fernández Campo <xocasdashdash@users.noreply.github.com>
Signed-off-by: Joaquín Fernández Campo <xocasdashdash@users.noreply.github.com>
…oller

Signed-off-by: Joaquín Fernández Campo <xocasdashdash@users.noreply.github.com>
Signed-off-by: Joaquín Fernández Campo <xocasdashdash@users.noreply.github.com>
Signed-off-by: Joaquín Fernández Campo <xocasdashdash@users.noreply.github.com>
Signed-off-by: Joaquín Fernández Campo <xocasdashdash@users.noreply.github.com>
Signed-off-by: Joaquín Fernández Campo <xocasdashdash@users.noreply.github.com>
Signed-off-by: Joaquín Fernández Campo <xocasdashdash@users.noreply.github.com>
Signed-off-by: Joaquín Fernández Campo <xocasdashdash@users.noreply.github.com>
…ources we can add default privileges

Signed-off-by: Joaquín Fernández Campo <xocasdashdash@users.noreply.github.com>
Signed-off-by: Joaquín Fernández Campo <xocasdashdash@users.noreply.github.com>
Signed-off-by: Joaquín Fernández Campo <xocasdashdash@users.noreply.github.com>
Signed-off-by: Joaquín Fernández Campo <xocasdashdash@users.noreply.github.com>
Signed-off-by: Joaquín Fernández Campo <xocasdashdash@users.noreply.github.com>
Signed-off-by: Joaquín Fernández Campo <xocasdashdash@users.noreply.github.com>
Signed-off-by: Joaquín Fernández Campo <xocasdashdash@users.noreply.github.com>
Signed-off-by: Joaquín Fernández Campo <xocasdashdash@users.noreply.github.com>
Signed-off-by: Joaquín Fernández Campo <xocasdashdash@users.noreply.github.com>
fernandezcuesta and others added 2 commits February 12, 2026 00:00
Signed-off-by: Jesús Fernández <7312236+fernandezcuesta@users.noreply.github.com>
fix: adapt for v2, fix default privileges and add examples and tests
fernandezcuesta and others added 2 commits February 12, 2026 13:23
Signed-off-by: Jesús Fernández <7312236+fernandezcuesta@users.noreply.github.com>
Copy link
Member

@Duologic Duologic left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I've scanned through the code, didn't see anything obviously wrong. I don't know too much about Postgres/DefaultPrivileges myself to deeply verify that this is correct. I'm happy to merge it when CI is green.

@Duologic Duologic merged commit 0559e8b into crossplane-contrib:master Feb 13, 2026
7 of 8 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Support DefaultPrivileges

5 participants