You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/explanation/e-architecture.md
+4Lines changed: 4 additions & 0 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -75,6 +75,10 @@ The snap "charmed-postgresql" also ships list of tools used by charm:
75
75
76
76
The charm "[PostgreSQL Test App](https://charmhub.io/postgresql-test-app)" is a Canonical test application to validate the charm installation / functionality and perform the basic performance tests.
77
77
78
+
### GLAuth
79
+
80
+
GLAuth is a secure, easy-to-use and open-sourced LDAP server which provides capabilities to centrally manage accounts across infrastructures. The charm is only available for Kubernetes clouds, under the [GLAuth-K8s operator](https://charmhub.io/glauth-k8s) page, so a cross-controller relation is needed in order to integrate both charms.
81
+
78
82
### Grafana
79
83
80
84
Grafana is an open-source visualization tools that allows to query, visualize, alert on, and visualize metrics from mixed datasources in configurable dashboards for observability. This charms is shipped with its own Grafana dashboard and supports integration with the [Grafana Operator](https://charmhub.io/grafana-k8s) to simplify observability. Please follow [COS Monitoring](/t/10600) setup.
Copy file name to clipboardExpand all lines: docs/explanation/e-users.md
+11-4Lines changed: 11 additions & 4 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,9 +1,10 @@
1
1
# Charm Users explanations
2
2
3
-
There are two types of users in PostgreSQL:
3
+
There are three types of users in PostgreSQL:
4
4
* Internal users (used by charm operator)
5
-
* Relation/integration users (used by related applications)
5
+
* Relation users (used by related applications)
6
6
* Extra user roles (if default permissions are not enough)
7
+
* Identity users (used when LDAP is enabled)
7
8
8
9
<aname="internal-users"></a>
9
10
## Internal users explanations:
@@ -72,7 +73,7 @@ unit-postgresql-1:
72
73
**Note**: the action `set-password` must be executed on juju leader unit (to update peer relation data with new value).
73
74
74
75
<a name="relation-users"></a>
75
-
## Relation/integration users explanations:
76
+
## Relation users explanations:
76
77
77
78
The operator created a dedicated user for every application related/integrated with database. Those users are removed on the juju relation/integration removal request. However, DB data stays in place and can be reused on re-created relations (using new user credentials):
78
79
@@ -99,4 +100,10 @@ postgres=# \du
99
100
100
101
When an application charm requests a new user through the relation/integration it can specify that the user should have the `admin` role in the `extra-user-roles` field. The `admin` role enables the new user to read and write to all databases (for the `postgres` system database it can only read data) and also to create and delete non-system databases.
101
102
102
-
**Note**: `extra-user-roles` is supported by modern interface `postgresql_client` only and missing for legacy `pgsql` interface. Read more about the supported charm interfaces [here](/t/10251).
103
+
**Note**: `extra-user-roles` is supported by modern interface `postgresql_client` only and missing for legacy `pgsql` interface. Read more about the supported charm interfaces [here](/t/10251).
104
+
105
+
<a name="identity-users"></a>
106
+
## Identity users explanations:
107
+
The operator considers Identity users all those that are automatically created when the LDAP integration is enabled, or in other words, the [GLAuth](https://charmhub.io/glauth-k8s) charm is related/integrated.
108
+
109
+
When synchronized from the LDAP server, these users do not have any permissions by default, so the LDAP group they belonged to must be mapped to a PostgreSQL pre-defined authorization role by using the `ldap_map` configuration option.
0 commit comments