Skip to content

Commit 646bde8

Browse files
soedirgosteve-chavez
soedirgo
and
steve-chavez
authored
fix: grant Vault privs to service_role (#1539)
* fix: grant Vault privs to service_role * adjust tests according to the fix * chore: bump versions * fix: missing Vault privileges for postgres * fix: also privs in the migration * test: schema snapshots changed Trailing whitespace were somehow added in #1562; probably different handling between dbmate and pg_dump --------- Co-authored-by: steve-chavez <[email protected]>
1 parent 1ffe2e3 commit 646bde8

File tree

5 files changed

+29
-9
lines changed

5 files changed

+29
-9
lines changed

‎ansible/files/postgresql_extension_custom_scripts/supabase_vault/after-create.sql

+6-1
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,8 @@
11
grant usage on schema vault to postgres with grant option;
2-
grant select, delete on vault.secrets, vault.decrypted_secrets to postgres with grant option;
2+
grant select, delete, truncate, references on vault.secrets, vault.decrypted_secrets to postgres with grant option;
33
grant execute on function vault.create_secret, vault.update_secret, vault._crypto_aead_det_decrypt to postgres with grant option;
4+
5+
-- service_role used to be able to manage secrets in Vault <=0.2.8 because it had privileges to pgsodium functions
6+
grant usage on schema vault to service_role;
7+
grant select, delete on vault.secrets, vault.decrypted_secrets to service_role;
8+
grant execute on function vault.create_secret, vault.update_secret, vault._crypto_aead_det_decrypt to service_role;

‎ansible/vars.yml

+3-3
Original file line numberDiff line numberDiff line change
@@ -9,9 +9,9 @@ postgres_major:
99

1010
# Full version strings for each major version
1111
postgres_release:
12-
postgresorioledb-17: "17.0.1.069-orioledb"
13-
postgres17: "17.4.1.019"
14-
postgres15: "15.8.1.076"
12+
postgresorioledb-17: "17.0.1.070-orioledb"
13+
postgres17: "17.4.1.020"
14+
postgres15: "15.8.1.077"
1515

1616
# Non Postgres Extensions
1717
pgbouncer_release: "1.19.0"

‎migrations/db/migrations/20221207154255_create_pgsodium_and_vault.sql

+6-3
Original file line numberDiff line numberDiff line change
@@ -10,9 +10,12 @@ BEGIN
1010

1111
-- for some reason extension custom scripts aren't run during AMI build, so
1212
-- we manually run it here
13-
GRANT USAGE ON SCHEMA vault TO postgres WITH GRANT OPTION;
14-
GRANT SELECT, DELETE ON vault.secrets, vault.decrypted_secrets TO postgres WITH GRANT OPTION;
15-
GRANT EXECUTE ON FUNCTION vault.create_secret, vault.update_secret, vault._crypto_aead_det_decrypt TO postgres WITH GRANT OPTION;
13+
grant usage on schema vault to postgres with grant option;
14+
grant select, delete, truncate, references on vault.secrets, vault.decrypted_secrets to postgres with grant option;
15+
grant execute on function vault.create_secret, vault.update_secret, vault._crypto_aead_det_decrypt to postgres with grant option;
16+
grant usage on schema vault to service_role;
17+
grant select, delete on vault.secrets, vault.decrypted_secrets to service_role;
18+
grant execute on function vault.create_secret, vault.update_secret, vault._crypto_aead_det_decrypt to service_role;
1619
ELSE
1720
pgsodium_exists = (
1821
select count(*) = 1

‎nix/tests/expected/roles.out

+2-1
Original file line numberDiff line numberDiff line change
@@ -575,6 +575,7 @@ order by schema_order, schema_name, privilege_type, grantee, default_for;
575575
topology | USAGE | supabase_admin | supabase_admin
576576
vault | CREATE | supabase_admin | supabase_admin
577577
vault | USAGE | postgres | supabase_admin
578+
vault | USAGE | service_role | supabase_admin
578579
vault | USAGE | supabase_admin | supabase_admin
579-
(390 rows)
580+
(391 rows)
580581

‎nix/tests/expected/vault.out

+12-1
Original file line numberDiff line numberDiff line change
@@ -28,13 +28,19 @@ ORDER BY object_name, grantee, privilege_type;
2828
schema | object_name | grantee | privilege_type
2929
--------+---------------------------+----------------+----------------
3030
vault | _crypto_aead_det_decrypt | postgres | EXECUTE
31+
vault | _crypto_aead_det_decrypt | service_role | EXECUTE
3132
vault | _crypto_aead_det_decrypt | supabase_admin | EXECUTE
3233
vault | _crypto_aead_det_encrypt | supabase_admin | EXECUTE
3334
vault | _crypto_aead_det_noncegen | supabase_admin | EXECUTE
3435
vault | create_secret | postgres | EXECUTE
36+
vault | create_secret | service_role | EXECUTE
3537
vault | create_secret | supabase_admin | EXECUTE
3638
vault | decrypted_secrets | postgres | DELETE
39+
vault | decrypted_secrets | postgres | REFERENCES
3740
vault | decrypted_secrets | postgres | SELECT
41+
vault | decrypted_secrets | postgres | TRUNCATE
42+
vault | decrypted_secrets | service_role | DELETE
43+
vault | decrypted_secrets | service_role | SELECT
3844
vault | decrypted_secrets | supabase_admin | DELETE
3945
vault | decrypted_secrets | supabase_admin | INSERT
4046
vault | decrypted_secrets | supabase_admin | REFERENCES
@@ -43,7 +49,11 @@ ORDER BY object_name, grantee, privilege_type;
4349
vault | decrypted_secrets | supabase_admin | TRUNCATE
4450
vault | decrypted_secrets | supabase_admin | UPDATE
4551
vault | secrets | postgres | DELETE
52+
vault | secrets | postgres | REFERENCES
4653
vault | secrets | postgres | SELECT
54+
vault | secrets | postgres | TRUNCATE
55+
vault | secrets | service_role | DELETE
56+
vault | secrets | service_role | SELECT
4757
vault | secrets | supabase_admin | DELETE
4858
vault | secrets | supabase_admin | INSERT
4959
vault | secrets | supabase_admin | REFERENCES
@@ -52,8 +62,9 @@ ORDER BY object_name, grantee, privilege_type;
5262
vault | secrets | supabase_admin | TRUNCATE
5363
vault | secrets | supabase_admin | UPDATE
5464
vault | update_secret | postgres | EXECUTE
65+
vault | update_secret | service_role | EXECUTE
5566
vault | update_secret | supabase_admin | EXECUTE
56-
(26 rows)
67+
(37 rows)
5768

5869
-- vault indexes with owners
5970
SELECT

0 commit comments

Comments
 (0)