damccorm commented on code in PR #40534:
URL: https://github.com/apache/beam/pull/40534#discussion_r4259168918
##########
.test-infra/metrics/sync/github/sync.py:
##########
@@ -139,6 +139,42 @@ def initDbTablesIfNeeded():
if not bool(cursor.rowcount):
raise Exception(f"Failed to create table {GH_SYNC_METADATA_TABLE_NAME}")
+ cursor.execute("""
+ DO $$
+ BEGIN
+ REVOKE CREATE ON SCHEMA public FROM PUBLIC;
+ IF EXISTS (
+ SELECT FROM pg_catalog.pg_roles WHERE rolname = 'kubeproxyuser_ro')
+ THEN
+ REVOKE ALL ON SCHEMA public FROM kubeproxyuser_ro;
+ GRANT USAGE ON SCHEMA public TO kubeproxyuser_ro;
+ REVOKE ALL ON ALL TABLES IN SCHEMA public FROM PUBLIC,
kubeproxyuser_ro;
+ GRANT SELECT ON ALL TABLES IN SCHEMA public TO kubeproxyuser_ro;
+ ALTER DEFAULT PRIVILEGES IN SCHEMA public
+ REVOKE ALL ON TABLES FROM PUBLIC, kubeproxyuser_ro;
+ ALTER DEFAULT PRIVILEGES IN SCHEMA public
+ GRANT SELECT ON TABLES TO kubeproxyuser_ro;
+ BEGIN
+ REVOKE cloudsqlsuperuser FROM kubeproxyuser_ro;
+ EXCEPTION WHEN OTHERS THEN
+ NULL;
+ END;
+ BEGIN
+ ALTER ROLE kubeproxyuser_ro
+ NOCREATEDB NOCREATEROLE NOINHERIT NOREPLICATION;
+ EXCEPTION WHEN OTHERS THEN
Review Comment:
Sure, done. This was to make sure that the role exists, but we can just
check for existence instead
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
