Update Playbook docs for Butler registry permissions #195
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
hsinfang
approved these changes
Sep 11, 2024
| Some tables also need DELETE (d), but we are still confirming which ones. | ||
|
|
||
| We need SELECT (r) and USAGE (U) permissions for the sequence ``collection_seq_collection_id``, but *not* for ``dataset_calibs_*_seq_id``, ``dataset_type_seq_id``, or ``dimension_graph_key_seq_id``. | ||
| We expect that most future sequences will only be touched by repository maintenance and not by pipeline runs or data transfers. | ||
|
|
||
| If any tables are missing permissions, run: |
There was a problem hiding this comment.
On Slack @ktlim mentioned that these were manually applied
GRANT SELECT,INSERT,UPDATE ON ALL TABLES IN SCHEMA embargo, embargo_old TO latiss_prompt, lsstcomcamsim_prompt;
Should we just advise to grant on all tables, not selected tables?
There was a problem hiding this comment.
I'd rather keep some human judgment in the mix -- I've seen too many people interpret "run this"-type instructions as something to obey without question. That's why I said to run \dp and see what's there.
Our previous permissions required delete permission on all tables (which we generally don't need), and permissions for all sequences (most of which we don't use).
SQL is whitespace-agnostic, so there's no reason to make it unreadable.
kfindeisen
force-pushed
the
u/kfindeisen/permissions-fix-2
branch
from
e2ea358
to
7f708b8
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR changes the expected registry permissions to be more minimalist; we only need delete permission for a handful of tables, and usage permission for a single sequence. Requesting only the permissions that we truly need should minimize friction with the DBAs as we move into Simonyi commissioning.