Skip to content

Commit 3cb5706

Browse files
BastichouBastichou
committed
feat: add grant specs schema, objects, objectType
1 parent 33fb91c commit 3cb5706

File tree

6 files changed

+253
-17
lines changed

6 files changed

+253
-17
lines changed

‎.gitignore‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,3 +8,4 @@
88
.work
99
_output
1010
__debug_bin
11+
.tool-versions

‎apis/postgresql/v1alpha1/grant_types.go‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -47,6 +47,7 @@ type GrantPrivileges []GrantPrivilege
4747
// happen internally inside postgresql when making grants. When we query the
4848
// privileges back, we need to look for the expanded set.
4949
// https://www.postgresql.org/docs/15/ddl-priv.html
50+
// TODO: Grand ALL ON SCHEMA should be expanded to GRANT USAGE, CREATE ON SCHEMA
5051
var grantReplacements = map[GrantPrivilege]GrantPrivileges{
5152
"ALL": {"CREATE", "TEMPORARY", "CONNECT"},
5253
"ALL PRIVILEGES": {"CREATE", "TEMPORARY", "CONNECT"},
@@ -141,6 +142,20 @@ type GrantParameters struct {
141142
// +optional
142143
DatabaseSelector *xpv1.Selector `json:"databaseSelector,omitempty"`
143144

145+
// Schema this grant is for.
146+
// +optional
147+
Schema *string `json:"schema,omitempty"`
148+
149+
// SchemaRef references the schema object this grant it for.
150+
// +immutable
151+
// +optional
152+
SchemaRef *xpv1.Reference `json:"schemaRef,omitempty"`
153+
154+
// SchemaSelector selects a reference to a Schema this grant is for.
155+
// +immutable
156+
// +optional
157+
SchemaSelector *xpv1.Selector `json:"schemaSelector,omitempty"`
158+
144159
// MemberOf is the Role that this grant makes Role a member of.
145160
// +optional
146161
MemberOf *string `json:"memberOf,omitempty"`
@@ -158,6 +173,22 @@ type GrantParameters struct {
158173
// RevokePublicOnDb apply the statement "REVOKE ALL ON DATABASE %s FROM PUBLIC" to make database unreachable from public
159174
// +optional
160175
RevokePublicOnDb *bool `json:"revokePublicOnDb,omitempty" default:"false"`
176+
177+
// ObjectType is the PostgreSQL object type to grant the privileges on.
178+
// +kubebuilder:validation:Enum=database;schema;table;sequence;function;procedure;routine;foreign_data_wrapper;foreign_server;column
179+
ObjectType string `json:"objectType" default:"database"`
180+
181+
// Objects are the objects upon which to grant the privileges.
182+
// An empty list (the default) means to grant permissions on all objects of the specified type.
183+
// You cannot specify this option if the objectType is database or schema.
184+
// When objectType is column, only one value is allowed.
185+
// +optional
186+
Objects []string `json:"objects,omitempty"`
187+
188+
// The columns upon which to grant the privileges.
189+
// Required when object_type is column. You cannot specify this option if the object_type is not column
190+
// +optional
191+
Columns []string `json:"columns,omitempty"`
161192
}
162193

163194
// A GrantStatus represents the observed state of a Grant.
@@ -212,6 +243,20 @@ func (mg *Grant) ResolveReferences(ctx context.Context, c client.Reader) error {
212243
mg.Spec.ForProvider.Database = reference.ToPtrValue(rsp.ResolvedValue)
213244
mg.Spec.ForProvider.DatabaseRef = rsp.ResolvedReference
214245

246+
// Resolve spec.forProvider.schema
247+
rsp, err = r.Resolve(ctx, reference.ResolutionRequest{
248+
CurrentValue: reference.FromPtrValue(mg.Spec.ForProvider.Schema),
249+
Reference: mg.Spec.ForProvider.SchemaRef,
250+
Selector: mg.Spec.ForProvider.SchemaSelector,
251+
To: reference.To{Managed: &Schema{}, List: &SchemaList{}},
252+
Extract: reference.ExternalName(),
253+
})
254+
if err != nil {
255+
return errors.Wrap(err, "spec.forProvider.schema")
256+
}
257+
mg.Spec.ForProvider.Schema = reference.ToPtrValue(rsp.ResolvedValue)
258+
mg.Spec.ForProvider.SchemaRef = rsp.ResolvedReference
259+
215260
// Resolve spec.forProvider.role
216261
rsp, err = r.Resolve(ctx, reference.ResolutionRequest{
217262
CurrentValue: reference.FromPtrValue(mg.Spec.ForProvider.Role),

‎apis/postgresql/v1alpha1/zz_generated.deepcopy.go‎

Lines changed: 25 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎build‎

‎package/crds/postgresql.sql.crossplane.io_grants.yaml‎

Lines changed: 112 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -83,6 +83,13 @@ spec:
8383
description: GrantParameters define the desired state of a PostgreSQL
8484
grant instance.
8585
properties:
86+
columns:
87+
description: |-
88+
The columns upon which to grant the privileges.
89+
Required when object_type is column. You cannot specify this option if the object_type is not column
90+
items:
91+
type: string
92+
type: array
8693
database:
8794
description: Database this grant is for.
8895
type: string
@@ -242,6 +249,30 @@ spec:
242249
type: string
243250
type: object
244251
type: object
252+
objectType:
253+
description: ObjectType is the PostgreSQL object type to grant
254+
the privileges on.
255+
enum:
256+
- database
257+
- schema
258+
- table
259+
- sequence
260+
- function
261+
- procedure
262+
- routine
263+
- foreign_data_wrapper
264+
- foreign_server
265+
- column
266+
type: string
267+
objects:
268+
description: |-
269+
Objects are the objects upon which to grant the privileges.
270+
An empty list (the default) means to grant permissions on all objects of the specified type.
271+
You cannot specify this option if the objectType is database or schema.
272+
When objectType is column, only one value is allowed.
273+
items:
274+
type: string
275+
type: array
245276
privileges:
246277
description: |-
247278
Privileges to be granted.
@@ -336,6 +367,85 @@ spec:
336367
type: string
337368
type: object
338369
type: object
370+
schema:
371+
description: Schema this grant is for.
372+
type: string
373+
schemaRef:
374+
description: SchemaRef references the schema object this grant
375+
it for.
376+
properties:
377+
name:
378+
description: Name of the referenced object.
379+
type: string
380+
policy:
381+
description: Policies for referencing.
382+
properties:
383+
resolution:
384+
default: Required
385+
description: |-
386+
Resolution specifies whether resolution of this reference is required.
387+
The default is 'Required', which means the reconcile will fail if the
388+
reference cannot be resolved. 'Optional' means this reference will be
389+
a no-op if it cannot be resolved.
390+
enum:
391+
- Required
392+
- Optional
393+
type: string
394+
resolve:
395+
description: |-
396+
Resolve specifies when this reference should be resolved. The default
397+
is 'IfNotPresent', which will attempt to resolve the reference only when
398+
the corresponding field is not present. Use 'Always' to resolve the
399+
reference on every reconcile.
400+
enum:
401+
- Always
402+
- IfNotPresent
403+
type: string
404+
type: object
405+
required:
406+
- name
407+
type: object
408+
schemaSelector:
409+
description: SchemaSelector selects a reference to a Schema this
410+
grant is for.
411+
properties:
412+
matchControllerRef:
413+
description: |-
414+
MatchControllerRef ensures an object with the same controller reference
415+
as the selecting object is selected.
416+
type: boolean
417+
matchLabels:
418+
additionalProperties:
419+
type: string
420+
description: MatchLabels ensures an object with matching labels
421+
is selected.
422+
type: object
423+
policy:
424+
description: Policies for selection.
425+
properties:
426+
resolution:
427+
default: Required
428+
description: |-
429+
Resolution specifies whether resolution of this reference is required.
430+
The default is 'Required', which means the reconcile will fail if the
431+
reference cannot be resolved. 'Optional' means this reference will be
432+
a no-op if it cannot be resolved.
433+
enum:
434+
- Required
435+
- Optional
436+
type: string
437+
resolve:
438+
description: |-
439+
Resolve specifies when this reference should be resolved. The default
440+
is 'IfNotPresent', which will attempt to resolve the reference only when
441+
the corresponding field is not present. Use 'Always' to resolve the
442+
reference on every reconcile.
443+
enum:
444+
- Always
445+
- IfNotPresent
446+
type: string
447+
type: object
448+
type: object
339449
withOption:
340450
description: |-
341451
WithOption allows an option to be set on the grant.
@@ -345,6 +455,8 @@ spec:
345455
- ADMIN
346456
- GRANT
347457
type: string
458+
required:
459+
- objectType
348460
type: object
349461
managementPolicies:
350462
default:

0 commit comments

Comments
 (0)