[Bug]: postgres_privileges.present with object_name `ALL` is never idempotent
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 15.7k
- Forks
- 5.6k
- Avg merge
- 2d 44m
- Merged PRs (30d)
- 80
Description
What happened?
postgres_privileges.present accepts object_name: ALL for tables and sequences and correctly generates GRANT ... ON ALL TABLES/SEQUENCES IN SCHEMA.
However, has_privileges() passes "ALL" to privileges_list(). _make_privileges_list_query() then searches for relname = 'ALL', so the existing grants are never found. Consequently, every subsequent state run reports a change and executes the grant again.
Reproduction:
reader-all-tables:
postgres_privileges.present:
- name: reader
- object_type: table
- object_name: ALL
- privileges:
- SELECT
- prepend: public
- maintenance_db: application
Expected: the second run is clean.
Actual: every run reports SELECT as granted again.
This affects Salt 3006 and remains present in the current master/3009 implementation.
This may root back to https://github.com/saltstack/salt/issues/36279
Type of salt install
Official rpm
Major version
3006.x
What supported OS are you seeing the problem on? Can select multiple. (If bug appears on an unsupported OS, please open a GitHub Discussion instead)
oraclelinux-8
salt --versions-report output
Salt Version:
Salt: 3006.27
Python Version:
Python: 3.11.15 (main, Jun 29 2026, 22:21:49) [GCC 11.2.0]
Dependency Versions:
cffi: 2.0.0
cherrypy: 18.10.0
cryptography: 47.0.0
dateutil: 2.9.0.post0
docker-py: 7.2.0
gitdb: 4.0.12
gitpython: 3.1.50
Jinja2: 3.1.6
libgit2: Not Installed
looseversion: 1.3.0
M2Crypto: Not Installed
Mako: Not Installed
msgpack: 1.1.2
msgpack-pure: Not Installed
mysql-python: Not Installed
packaging: 24.0
pycparser: 3.00
pycrypto: Not Installed
pycryptodome: 3.23.0
pygit2: Not Installed
python-gnupg: 0.5.6
PyYAML: 6.0.3
PyZMQ: 27.1.0
relenv: 0.22.16
smmap: 5.0.2
timelib: 0.3.0
Tornado: 6.5.5
ZMQ: 4.3.5
Salt Extensions:
saltext.prometheus: 2.2.0
saltext.vault: 1.8.0
System Versions:
dist: oracle 8.10
locale: utf-8
machine: x86_64
release: 4.18.0-553.162.1.el8_10.x86_64
system: Linux
version: Oracle Linux Server 8.10
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start at the postgres_privileges.present entry point and trace has_privileges(), privileges_list(), and _make_privileges_list_query() for object_name ALL. Reproduce the Salt state twice against PostgreSQL and inspect the generated privilege lookup. Done means the second run detects the existing grant and regression coverage verifies idempotence for tables and sequences.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- postgresql, python
- Domain
- databases
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 68/100