Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

First try with role reset #427

Merged
merged 5 commits into from
May 5, 2023
Merged

Conversation

atanner27
Copy link
Contributor

@atanner27 atanner27 commented May 5, 2023

After pgcat runs a query on a server connection, it runs discard all on that connection to prevent any session state from leaking to other queries and breaking them. This will clear the implicitly set roles.

This PR proposes issuing a second query that will RESET the role post discard.

There may be better options to do this without an additional query and roundtrip.

Sql example:
postgres=> \conninfo
postgres=> SELECT SESSION_USER, CURRENT_USER;
session_user | current_user
--------------+--------------
migrator | migrations
(1 row)

postgres=> DISCARD ALL;
DISCARD ALL
postgres=> SELECT SESSION_USER, CURRENT_USER;
session_user | current_user
--------------+--------------
migrator | migrator
(1 row)

postgres=> RESET ROLE;
RESET
postgres=> SELECT SESSION_USER, CURRENT_USER;
session_user | current_user
--------------+--------------
migrator | migrations
(1 row)

src/server.rs Outdated Show resolved Hide resolved
src/server.rs Outdated Show resolved Hide resolved
conn.close
end

expect(processes.primary.count_query("RESET ROLE;")).to eq(10)
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

can we ALTER ROLE sharding_user ROLE TO <new role> to simulate the same error we saw in production?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Curious about the error, if you're willing to share. I'm not too familiar with RESET USER.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@levkk we had 2 users in the DB, lets call them A and B.

We had run ALTER ROLE A SET ROLE B, which has the effect of running SET ROLE B after you open a connection with username A. We had configured pgbouncer and pgcat to both connect with username A.

When we run create table on pgbouncer, it was owned by B due to this config.

When we run create table on pgcat, a previous query had run DISCARD ALL in the pgcat server connection, and then the table was owned by A. We found that we could run RESET ROLE to fix it back to SET ROLE b after a DISCARD ALL was run.

Our permissions were all configured with assuming B owns the tables, so when we started creating tables with A as the owner after switching to pgcat, we had some errors.

src/server.rs Outdated Show resolved Hide resolved
tests/ruby/misc_spec.rb Outdated Show resolved Hide resolved
atanner27 and others added 2 commits May 5, 2023 17:48
Co-authored-by: Lev Kokotov <[email protected]>
@atanner27 atanner27 changed the title First try with role rest First try with role reset May 5, 2023
@atanner27 atanner27 marked this pull request as ready for review May 5, 2023 21:51
Copy link
Contributor

@levkk levkk left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you sir!

@levkk levkk merged commit 159eb89 into postgresml:main May 5, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants