You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
|`path`|`string`| The absolute path inside the operator Pod to the file containing the admin credentials. | Yes |
37
37
38
-
39
38
#### File format
40
39
41
40
The file must contain JSON with the following fields:
@@ -66,6 +65,21 @@ The value of `adminSecretFileRef.path` is the `mountPath` plus the name of the f
66
65
67
66
See [Using a file reference](#using-a-file-reference-adminsecretfileref) in the examples for a complete setup with each volume source.
68
67
68
+
## Admin privileges
69
+
70
+
The admin role does not need to be a superuser. This makes the operator usable with managed services such as AWS RDS, Amazon Aurora, Google Cloud SQL, or Azure Database for PostgreSQL, where no superuser is available.
71
+
72
+
| Custom Resource | Required privilege of the admin role |
|`Schema`, `Grant`, `DefaultPrivilege`| Ownership of, or the matching privileges on, the target objects |
78
+
79
+
The master user of the managed services above has `LOGIN`, `CREATEDB`, and `CREATEROLE`. See [Role](role.md#non-superuser-admins) for the limits that apply to a non-superuser admin.
80
+
81
+
The operator reads role state from the public view `pg_roles`. It does not read `pg_authid` or `pg_shadow`, which these services deny.
|`clusterRef`|`ResourceRef`| Reference to the `ClusterConnection` to use. | Yes | Yes |
10
+
|`name`|`string`| The name of the role to create in the database. | Yes | No |
11
+
|`comment`|`string`| A comment to add to the role. | No | Yes |
12
+
|`passwordSecretRef`|`ResourceRef`| Reference to a secret containing the password for the role to make it a LOGIN role. | No | Yes |
13
+
|`passwordEncryption`|`string`| How the password is sent to PostgreSQL: `scram-sha-256` (default) or `server`. | No | Yes |
14
+
|`flags`|`RoleFlags`| Flags and attributes for the role. | No | Yes |
14
15
15
16
### ResourceRef (`clusterRef` and `passwordSecretRef`)
16
17
@@ -45,6 +46,44 @@ The operator uses the presence of the `passwordSecretRef` field to determine if
45
46
-**Login Role (User)**: If `passwordSecretRef` is specified, the role is created with the `LOGIN` attribute. It uses the password from the referenced secret.
46
47
-**No-Login Role (Group)**: If `passwordSecretRef` is omitted, the role is created with the `NOLOGIN` attribute. This is useful for creating roles that serve as groups for permissions.
47
48
49
+
### Password handling
50
+
51
+
The operator does not read the password hash from `pg_authid`.
52
+
That catalog is readable by superusers only, and managed PostgreSQL services of cloud providers, such as AWS RDS, Google Cloud SQL, or Azure Database for PostgreSQL, revoke it from every role, including the master user.
53
+
54
+
Instead, the operator stores a keyed fingerprint of the password it applied last in `status.passwordFingerprint`.
55
+
On each reconcile it compares the referenced Secret against that fingerprint. When they differ, the operator runs `ALTER ROLE ... PASSWORD`.
56
+
57
+
The fingerprint is an `HMAC-SHA256`. Its key is random and private to the operator.
58
+
The operator generates the key once and stores it in a Secret named `postgresql-operator-password-fingerprint-key` in its own namespace. A reader of the `Role` status learns nothing about the password without that key.
59
+
The Secret name is set by the configuration property `postgresql-operator.password-fingerprint.secret-name`, for example through the environment variable `POSTGRESQL_OPERATOR_PASSWORD_FINGERPRINT_SECRET_NAME`.
60
+
61
+
**Consequences:**
62
+
63
+
- The Secret is the source of truth. A password change made directly in PostgreSQL is not detected.
64
+
- If the key Secret is lost, the operator generates a new key and re-applies every `Role` password once.
65
+
- After the upgrade to the version that introduced the fingerprint, every existing `Role` gets one password update, because its status has no fingerprint yet.
|`scram-sha-256`|**Default**. The operator computes the `SCRAM-SHA-256` verifier itself and sends only the verifier. The cleartext password never reaches the server, its statement log, or extensions such as `pgaudit`. |
72
+
|`server`| The operator sends the cleartext password. The server hashes it according to its `password_encryption` setting. Use this for clients that only support MD5 authentication. |
73
+
74
+
If the Secret already contains an `MD5` or `SCRAM-SHA-256` verifier, the operator forwards it unchanged in both modes.
75
+
76
+
**Note:**
77
+
A pre-hashed password bypasses server-side password policies. The `credcheck` extension rejects it unless `credcheck.encrypted_password_allowed` is on. For example a Cloud SQL password policy does not apply to hashed passwords. Set `passwordEncryption: server` when such a policy must apply.
78
+
79
+
### Non-superuser admins
80
+
81
+
The admin role of the `ClusterConnection` does not need to be a superuser. `CREATEROLE` is sufficient for `Role` resources.
82
+
See [ClusterConnection](cluster-connection.md#admin-privileges) for the full list of privileges. The following limits apply when the admin is not a superuser:
83
+
84
+
- The flags `superuser`, `replication`, and `bypassrls` cannot be set. PostgreSQL rejects them, and the `Role` status shows the error.
85
+
- On PostgreSQL 16 and later, the admin can only alter roles on which it holds `ADMIN OPTION`. Roles created by the operator qualify. Roles created by another user do not, unless that user grants the admin `ADMIN OPTION`.
0 commit comments