Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix broken major upgrade logic #70

Merged
merged 3 commits into from
Aug 14, 2023
Merged

Conversation

jpalermo
Copy link
Member

Fixes for #69

We now find the current postgres package that matches the major version they are upgrading from. If no package is found, exit with error.

I also removed a lot of the older postgres 9 upgrade logic since the postgres 9 packages are no longer included in the release. So instead we just fail early if we find a data directory, but no version file.

… that matches the major postgres version being upgraded from.

If no package dir exists, because they are making a large upgrade jump, print an error and exit.
@cf-gitbot
Copy link

We have created an issue in Pivotal Tracker to manage this:

https://www.pivotaltracker.com/story/show/185816260

The labels on this github issue will be updated when the story is started.

…ata directories exist,

print an error and exit.

We no longer have the postgres 9 packages to be able to upgrade from these versions. Users will
have to upgrade to an older first first.
- The changes from tust to peer and md5 are a better security posture, but they break a lot of existing use cases
  and should probably instead be gated behind some sort of configuration flag. Co-located bbr relies upon passwordless
  connection to the database as vcap user, but runs a root. Many of the acceptance tests also try using the vcap user
  but run as root via ssh and fail with the changes.
- Postgres 15 no longer grants users access to the public schema. This prevents generated users from being able to create
  tables. Update the create_databases function to grant access to the public schema for each role on each database.
@jpalermo
Copy link
Member Author

Found two additional problems when trying to run the acceptance tests.

The changes from trust to peer and md5 in the pg_hba.conf file are good security improvements, but break a lot of existing use cases. The biggest of which is probably a co-located bbr job which relies upon connecting as the vcap user to the database, but running as the root user. Might be a good opportunity to gate the peer and md5 changes behind a configuration option.

Also, postgres 15 removes default access to the public schema for databases. This prevents the generated non-superuser roles from creating tables in the public schema (which is generally where most people create tables). This changes grants access to the public schema on each database for all roles created.

@jpalermo jpalermo merged commit 36c3dfe into develop Aug 14, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
Development

Successfully merging this pull request may close these issues.

3 participants