mirror of
https://github.com/cozystack/cozystack.git
synced 2026-10-30 16:47:20 +09:00
Alexey Artamonov
2b5877eff9
users[].password is gone from the chart, its schema and the API type. Every application-user password is generated into <release>-credentials and kept across reconciles by lookup, so an upgraded release keeps the password it already has and a password left in values is ignored. The init-job mounts that Secret and applies each password with ALTER ROLE and a psql variable, so no password is rendered into the init-script Secret that Helm keeps in release history. While bootstrap is enabled the Secret is marked credentials-pending, and NOTES say the generated passwords apply once the init-job runs. Names reach superuser SQL and the init-script shell, so render-time guards reject a username, database or extension name outside [-._a-zA-Z0-9] or past the length PostgreSQL silently truncates: 63 bytes for a role or extension, 54 for a database, whose <db>_readonly role would otherwise truncate and fail the next run. A username over 63 bytes that the credentials Secret already carries still upgrades. users.postgres, the CNPG superuser, is rejected in every bootstrap state. Changing a database's key in values drops the database, so the reject message and the README give the rename that keeps the data: a platform administrator renames it and its roles as the CNPG superuser before the key changes. The init-job cannot hang its Helm hook: the readiness wait ends on elapsed time below activeDeadlineSeconds and the Job never retries, so a purged restore target fails with a diagnostic. The delete-users pass reads managed users from pg_shdescription instead of parsing the version-dependent \du+ layout, which on PostgreSQL 16 and later matched nothing and left a removed user able to log in; it compares names as CREATE ROLE stores them and reassigns a removed user's objects in every database before dropping it. A database without roles renders, and extension names are quoted for hyphenated names and folded to lowercase so they resolve as they did unquoted. A value that carries its own surrounding quotes, the only way a hyphenated extension rendered before, has that pair removed and keeps its case, so such a release still upgrades. The README reads a password with jq, since jsonpath splits a dotted key. Signed-off-by: Alexey Artamonov <aleksei.artamonov@aenix.io>
17 lines
748 B
Smarty
17 lines
748 B
Smarty
{{/*
|
|
The name CREATE EXTENSION resolves for a databases.<db>.extensions entry, before
|
|
it is quoted. Charts that rendered the value unquoted made a hyphenated extension
|
|
reachable only by writing its quotes into the value ('"uuid-ossp"'), so one
|
|
surrounding pair is the identifier's own quoting: it is removed and, as a quoted
|
|
identifier, keeps its case. An unquoted name is folded to lowercase, the way
|
|
PostgreSQL resolved it unquoted (PostGIS to postgis). The charset guard in
|
|
init-script.yaml checks this result, so a quote inside the pair still fails it.
|
|
*/}}
|
|
{{- define "postgres.extensionName" -}}
|
|
{{- if regexMatch "^\".+\"$" . -}}
|
|
{{- trimSuffix "\"" (trimPrefix "\"" .) -}}
|
|
{{- else -}}
|
|
{{- lower . -}}
|
|
{{- end -}}
|
|
{{- end -}}
|