citusdata / citusdata/citus

Use current user for the object propagation

Open
#5,139 3 comments 0 reactions 0 assignees View on GitHub
technical debt
Dominant language
C
Stars
12.8k
Forks
794
Avg merge
2d 14h
Merged PRs (30d)
31

Description

With the recent changes, we made metadata syncing to use the current user instead of superuser. Now, the last major operation that uses superuser is the object propagation. If we can make object propagation to use current user, Citus can do more things fully transactional. Plus, it’d remove one of the hard-to-follow tech debts in the code.

And, I was wondering what would it take to achieve that. I changed the code to use the current user (aware of the fact that we don’t have many non-super user tests). And, it seems we don’t need much to do in order to support regular user object propagation. See the changes: https://github.com/citusdata/citus-enterprise/compare/current_user_ensure_dep

However, I think from the users perspective, two things would change (e.g., in a sense breaking change and divergent user experience from Postgres)

- Users need to GRANT CREATE ON DATABASE TO ROLE (and Citus needs to propagate this)
- Users need to own all the dependencies that their objects depend. For example, if a table owned by a regular user is created inside a schema owned by a super user, the `create_distributed_table` operation would fail. Not sure how common this scenario is.

From Citus perspective, the above items makes a lot. From Postgres perspective, the above items sound unusual as you do not need this.

I think we might consider guiding users with proper error messages to adjust the ownerships properly, and a GUC to switch back to the current behavior if needed.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.