MIME-Version: 1.0
References: <CA+TgmoYwTFTQR0+qe+_asEvv2wqQL+0JCyexgVy2Ct31+rCb7w@mail.gmail.com>
 <20230116223728.GA2714038@nathanxps13>
In-Reply-To: <20230116223728.GA2714038@nathanxps13>
From: Robert Haas <robertmhaas@gmail.com>
Date: Mon, 16 Jan 2023 21:06:10 -0500
Message-ID: <CA+TgmoYmO+D3yB_eCpDewGLOcWMbZnKO7Rg2uh60bcmdJiXVHQ@mail.gmail.com>
Subject: Re: almost-super-user problems that we haven't fixed yet
To: Nathan Bossart <nathandbossart@gmail.com>
Cc: "pgsql-hackers@postgresql.org" <pgsql-hackers@postgresql.org>
Content-Type: text/plain; charset="UTF-8"
Archived-At: <https://www.postgresql.org/message-id/CA%2BTgmoYmO%2BD3yB_eCpDewGLOcWMbZnKO7Rg2uh60bcmdJiXVHQ%40mail.gmail.com>
Precedence: bulk

On Mon, Jan 16, 2023 at 5:37 PM Nathan Bossart <nathandbossart@gmail.com> wrote:
> On Mon, Jan 16, 2023 at 02:29:56PM -0500, Robert Haas wrote:
> > 4. You can reserve a small number of connections for the superuser
> > with superuser_reserved_connections, but there's no way to do a
> > similar thing for any other user. As mentioned above, a CREATEROLE
> > user could set connection limits for every created role such that the
> > sum of those limits is less than max_connections by some margin, but
> > that restricts each of those roles individually, not all of them in
> > the aggregate. Maybe we could address this by inventing a new GUC
> > reserved_connections and a predefined role
> > pg_use_reserved_connections.
>
> I've written something like this before, and I'd be happy to put together a
> patch if there is interest.

Cool. I had been thinking of coding it up myself, but you doing it works, too.

-- 
Robert Haas
EDB: http://www.enterprisedb.com