Date: Fri, 24 Mar 2017 08:30:32 -0400
From: Stephen Frost <sfrost@snowman.net>
To: Peter Eisentraut <peter.eisentraut@2ndquadrant.com>
Cc: Dave Page <dpage@pgadmin.org>, Robert Haas <robertmhaas@gmail.com>,
	PostgreSQL Hackers <pgsql-hackers@postgresql.org>
Subject: Re: Monitoring roles patch
Message-ID: <20170324123031.GD9812@tamriel.snowman.net>
References: 
 <CA+OCxoyRdsc1xyLfF9s698gUGyPXBs4CvJ+0Gwo8U65NmYJ7pw@mail.gmail.com>
 <CA+TgmobveXzVPytFOO3AkmsM+Y=YEG+UXcCvgwAt+SgYj85OCA@mail.gmail.com>
 <CA+OCxox9c9-1=bXxA6-gr-iWZbD5zdHYMz=cpC034RKB7zX40Q@mail.gmail.com>
 <c99cde7f-0aa7-ebaa-b9f4-ee75522554a4@2ndquadrant.com>
 <20170322131730.GD9812@tamriel.snowman.net>
 <d3e2e808-50fd-daca-fc07-8863930cae7d@2ndquadrant.com>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
	protocol="application/pgp-signature"; boundary="J1E9f+EzJ8b33okL"
Content-Disposition: inline
In-Reply-To: <d3e2e808-50fd-daca-fc07-8863930cae7d@2ndquadrant.com>
User-Agent: Mutt/1.5.21 (2010-09-15)
Precedence: bulk
Sender: pgsql-hackers-owner@postgresql.org


--J1E9f+EzJ8b33okL
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

Peter,

* Peter Eisentraut (peter.eisentraut@2ndquadrant.com) wrote:
> On 3/22/17 09:17, Stephen Frost wrote:
> >> If we do it via GRANTs instead, then users can easily extend it.
> > The intent here is that users will *also* be able to do it via GRANTs if
> > they wish to.
>=20
> But why not do it with GRANTs in the first place then?

This is akin to asking why do we need GRANT ALL and ALTER DEFAULT PRIVs.

Would it be technically possible to make users jump through hoops every
time they set up a new system to create their own monitor role that
would then have the right set of privileges for *that* version of PG?
Yes, but it's not exactly friendly.  The whole idea here is that the
tool authors will be able to tell the users that they just need to GRANT
this one role, not a script of 20 GRANT statements, oh, and that it
won't break when doing upgrades.

If we make the users run all the statements individually then they'll
also have to get an updated script for the next version of PG too
because we will have added things that the tools will want access to.

Further, they'll have to make sure to install all the contrib modules
they want to use before running the GRANT script which is provided, or
deal with GRANT'ing the rights out after installing some extension.

With the approach that Dave and I are advocating, we can avoid all of
that.  Contrib modules can bake-in GRANTs to the appropriate roles,
upgrades can be handled smoothly even when we add new capabilities which
are appropriate, users have a simple and straight-forward way to set up
good monitoring, and tool authors will know what permissions are
available and can finally have a better answer than "well, just make the
monior user superuser if you want to avoid all these complexities."

Thanks!

Stephen

--J1E9f+EzJ8b33okL
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: Digital signature

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCgAGBQJY1RFnAAoJEO1sijiDR2RVUZcP/i91Pc/kHjEFlwsWgXhnRYwI
GfYNYKMYAOUHFsjq0FroBqWdbfIWBOxQIrPcrSxOdaEyKo/k6G0WF9O0UzjWrWk8
s8JRKZweWwn2+9+ZYYbhUOacnv2lBPz4WXU2wDu9v3p28VnduWk4AQC8zPjh0TqN
5rZGvhioCWYKpr4ZZwwsG5ccR5Cfz3Tle2c/P5XMFwYDIcWyh10iJjRU32UNZXKa
L9Mle8c0U8VMwWPcw8R7AiP76ygwYlJIIYgDP1lsb5pdUcmZvmpHcXscvDAWUjgB
zo3vBqOCbD1JYIGxsH17AyGjt3xCeRhO/SmddvmK5Vlr8V2jqz//PY/3c16abNEC
MJU7l9xd/E7s73kH3I7Gk39Zv4DyyBAWjvxabIVv89O0GVec04liKHtccI3NnIFz
lT2ON66zxa4MZVay3tef+KUn3Nm5qXKbZwkdQJV02ZiwLsvZc4u8k5PLbNIF2YJr
5CJJHY4uPU0q176sFEBTT0a8uafzzGCykmwmwvQotOph7rCPUmZyY5F8ic9k/V6a
2is+/VTRMlSptLKNU5hMRuUks1nTzU00B6Q7IcJHTXu4QLQFMqzg94GhMDic7+rp
ViYrIhoRgOzTkZ0Vx08bzSrSiCbPFP+CG00j4/qXmezbscu0CbvHVP0DXSw8AVm6
8tNuIEAaZsR7pWYO1brt
=YkAZ
-----END PGP SIGNATURE-----

--J1E9f+EzJ8b33okL--