Amar3tto commented on code in PR #40534:
URL: https://github.com/apache/beam/pull/40534#discussion_r4258613194
##########
.test-infra/metrics/sync/github/sync.py:
##########
@@ -139,6 +139,42 @@ def initDbTablesIfNeeded():
if not bool(cursor.rowcount):
raise Exception(f"Failed to create table {GH_SYNC_METADATA_TABLE_NAME}")
+ cursor.execute("""
+ DO $$
+ BEGIN
+ REVOKE CREATE ON SCHEMA public FROM PUBLIC;
+ IF EXISTS (
+ SELECT FROM pg_catalog.pg_roles WHERE rolname = 'kubeproxyuser_ro')
+ THEN
+ REVOKE ALL ON SCHEMA public FROM kubeproxyuser_ro;
+ GRANT USAGE ON SCHEMA public TO kubeproxyuser_ro;
+ REVOKE ALL ON ALL TABLES IN SCHEMA public FROM PUBLIC,
kubeproxyuser_ro;
+ GRANT SELECT ON ALL TABLES IN SCHEMA public TO kubeproxyuser_ro;
+ ALTER DEFAULT PRIVILEGES IN SCHEMA public
+ REVOKE ALL ON TABLES FROM PUBLIC, kubeproxyuser_ro;
+ ALTER DEFAULT PRIVILEGES IN SCHEMA public
+ GRANT SELECT ON TABLES TO kubeproxyuser_ro;
+ BEGIN
+ REVOKE cloudsqlsuperuser FROM kubeproxyuser_ro;
+ EXCEPTION WHEN OTHERS THEN
+ NULL;
+ END;
+ BEGIN
+ ALTER ROLE kubeproxyuser_ro
+ NOCREATEDB NOCREATEROLE NOINHERIT NOREPLICATION;
+ EXCEPTION WHEN OTHERS THEN
Review Comment:
Could we avoid silently swallowing exceptions here? If the role update
fails, initialization will still succeed, potentially leaving the read-only
role with elevated privileges. Unexpected permission errors should be surfaced
rather than ignored.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
