Allow for instances to be in read-only mode (for easier scaling)

I have a Metabase setup split in two classes of instances:

1. one Metabase instance where users log in and define questions/dashboards, and
2. another class of instances used for serving dashboards.

The first one is only exposed on a private network. The latter is public, constrained to only Metabase endpoints related to serving, and scalable (via Kubernetes). They share a Postgres database so that the instance class for serving can read queries defined in the private instance.

This setup works quite well with one caveat: I can't seem to get the public instances to use a read-only Postgres user. i.e. I first set up the Postgres user to have these permissions:

GRANT SELECT ON ALL tables IN SCHEMA public TO metabase_readonly;
GRANT SELECT ON ALL sequences IN SCHEMA public TO metabase_readonly;
GRANT USAGE ON SCHEMA public TO metabase_readonly;

But quickly ran into errors when Metabase tried to run migrations at app startup. So I added:

GRANT UPDATE, INSERT, select ON TABLE databasechangelog TO metabase_readonly;
GRANT UPDATE, INSERT, select ON TABLE metabase_database TO metabase_readonly;

But then when actually running queries I got more errors and had to give it more permissions:

--  UPDATE "query" SET "average_execution_time" = CAST(round(((0.9 * "average_execution_time") + 145.6), 0) AS integer) WHERE "query_hash" = ? was aborted: 
-- ERROR: permission denied for relation query Call getNextException to see other errors in the batch.
GRANT UPDATE, SELECT ON TABLE query TO metabase_readonly;

GRANT INSERT ON TABLE query_execution TO metabase_readonly;
GRANT ALL PRIVILEGES ON SEQUENCE query_execution_id_seq TO metabase_readonly;

At this point I stopped because this doesn't seem to be supported and so will be fragile.

Would you be interested in supporting this explicitly? I think the general idea of splitting up reads and writes, being able to scale them independently and secure them independently, would make the product more flexible.

Start by reviewing the startup migrations and runtime database writes described in the issue, including Liquibase's databasechangelog updates and query execution statistics. Define what read-only mode should disable or permit, then verify that serving instances can use a PostgreSQL role with SELECT-only access while still serving dashboards.