citusdata / citusdata/citus

shards prune for tenant_id=current_user

Open
#6,712 0 comments 1 reaction 0 assignees View on GitHub
RLS
Dominant language
C
Stars
12.8k
Forks
794
Avg merge
2d 14h
Merged PRs (30d)
31

Description

I'm testing Citus to scale a multi-tenant application that has about 1000 tenants.
Actually I'm using a single node postgresql, using RLS + partitions by tenant.

The problem that I found in Citus is that shards prune doesn't work for: "where tenant_id=current_user", it only work if you compare to a literal: "where tenant_id='tenant00001'".

Currently RLS policies for each table are:

```
CREATE POLICY tenant_isolation_policy
ON public.table_a
AS PERMISSIVE
FOR ALL
TO public
USING ((tenant_id = current_user));
```

If I do explain analyze for a simple select, I found that shards pruning is not working:
```
" Task Count: 32"
" Tuple data received from nodes: 14 kB"
" Tasks Shown: One of 32"
```

But if I write the policy as:
```
CREATE POLICY tenant_isolation_policy
ON public.table_a
AS PERMISSIVE
FOR ALL
TO public
USING ((tenant_id = 'tenant00001'));
```

It do shard pruning:
```
" Task Count: 1"
" Tuple data received from nodes: 14 kB"
" Tasks Shown: All"
```

As a reference, using RLS + partitions by tenant, partition prune works all the time.

I have no way to rewrite application to add tenant_id as a literal in each query, is there any other solution?
Could this be improved in a future version?

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.