You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
|`WATCH_NAMESPACE`| Namespace to watch. Empty string = all namespaces.| (all namespaces) |
73
+
|`POSTGRES_INSTANCE`| Operator identity for multi-instance deployments. | (empty)|
74
+
|`KEEP_SECRET_NAME`| Use user-provided secret names instead of auto-generated ones. | disabled|
74
75
75
76
> **Note:**
76
77
> If enabling `KEEP_SECRET_NAME`, ensure there are no secret name conflicts in your namespace to avoid reconcile loops.
77
78
79
+
## Dedicated Operator Role
80
+
81
+
The operator connects to PostgreSQL using the credentials configured via the `POSTGRES_*` environment variables / Secret (see below). In many setups these credentials are the _server admin_ or _master user_.
82
+
83
+
You can also run the operator using a **dedicated operator login role** (recommended for production), for better separation of duties and easier auditing/rotation.
84
+
85
+
### What privileges are required?
86
+
87
+
This operator manages databases and roles, and also runs some operations inside the created databases. Your operator login role must be able to:
88
+
89
+
- Create databases and set database owners (`CREATE DATABASE`, `ALTER DATABASE ... OWNER TO ...`)
90
+
- Grant database-level privileges (the operator runs `GRANT CREATE ON DATABASE ...`)
91
+
- Create roles/users and manage role membership (`CREATE ROLE`, `DROP ROLE`, `GRANT <role> TO <grantee>`, `REVOKE ...`)
- Grant privileges / alter default privileges within schemas
96
+
97
+
The operator also grants each created role to itself, so it can later revoke privileges, reassign ownership, and drop roles cleanly.
98
+
99
+
### Example: creating an operator role
100
+
101
+
The exact SQL depends on how your PostgreSQL instance is managed. In plain PostgreSQL (self-hosted), you can often do something like:
102
+
103
+
```sql
104
+
-- Create a dedicated login for the Kubernetes operator
105
+
CREATE ROLE pgoperator WITH
106
+
PASSWORD 'YourSecurePassword123!'
107
+
LOGIN
108
+
CREATEDB
109
+
CREATEROLE;
110
+
```
111
+
112
+
For managed services, you typically create `ext_postgres_operator` while connected as the platform-provided admin and grant only the capabilities supported by that platform.
113
+
114
+
### Cloud provider notes
115
+
116
+
Because this is an _external / managed PostgreSQL_ operator, the feasibility of least-privilege depends on your provider.
117
+
118
+
-**AWS RDS (PostgreSQL)**
119
+
- The initial “master user” is a member of the `rds_superuser` role.
120
+
- A dedicated operator role is usually possible: create a login role with `CREATEDB`/`CREATEROLE`, then grant it any extra permissions you need for extensions/schemas.
- Cloud SQL does not expose true `SUPERUSER`. The default `postgres` user is a member of `cloudsqlsuperuser` and has `CREATEROLE` and `CREATEDB`.
125
+
- You can create other users/roles with reduced privileges (for example, an operator role with `CREATEROLE`/`CREATEDB`), but some operations (notably certain extensions) may require `cloudsqlsuperuser`.
-**Azure Database for PostgreSQL Flexible Server**
129
+
- The server admin user is a member of `azure_pg_admin` and has `CREATEDB` and `CREATEROLE`; the `azuresu` superuser role is reserved for Microsoft.
130
+
- A dedicated operator role is supported: create a user with `CREATEDB`/`CREATEROLE`, optionally add it to `azure_pg_admin` if you need additional capabilities.
@@ -191,22 +250,22 @@ This creates a user role `username-<hash>` and grants role `test-db-group`, `tes
191
250
Two `Postgres` referencing the same database can exist in more than one namespace. The last CR referencing a database will drop the group role and transfer database ownership to the role used by the operator.
192
251
Every PostgresUser has a generated Kubernetes secret attached to it, which contains the following data (i.e.):
193
252
194
-
| Key | Comment |
195
-
|----------------------|---------------------|
196
-
| `DATABASE_NAME` | Name of the database, same as in `Postgres` CR, copied for convenience |
197
-
| `HOST` | PostgreSQL server host (including port number) |
198
-
| `URI_ARGS` | URI Args, same as in `Postgres` CR, copied for convenience |
199
-
| `PASSWORD` | Autogenerated password for user |
200
-
| `ROLE` | Autogenerated role with login enabled (user) |
201
-
| `LOGIN` | Same as `ROLE`. In case `POSTGRES_CLOUD_PROVIDER` is set to "Azure", `LOGIN` it will be set to `{role}@{serverName}`, serverName is extracted from `POSTGRES_USER` from operator's config. |
202
-
| `POSTGRES_URL` | Connection string for Posgres, could be used for Go applications |
| `DATABASE_NAME` | Name of the database, same as in `Postgres` CR, copied for convenience |
256
+
| `HOST` | PostgreSQL server host (including port number) |
257
+
| `URI_ARGS` | URI Args, same as in `Postgres` CR, copied for convenience |
258
+
| `PASSWORD` | Autogenerated password for user |
259
+
| `ROLE` | Autogenerated role with login enabled (user) |
260
+
| `LOGIN` | Same as `ROLE`. In case `POSTGRES_CLOUD_PROVIDER` is set to "Azure", `LOGIN` it will be set to `{role}@{serverName}`, serverName is extracted from `POSTGRES_USER` from operator's config. |
261
+
| `POSTGRES_URL` | Connection string for Posgres, could be used for Go applications |
0 commit comments