Jira (PDB-4809) Corrective change every puppet run "GRANT CONNECT ON DATABASE "pe-puppetdb" TO "pe-puppetdb"' (corrective)"

[Elaine McCloskey (Jira)]

Title: Message Title

Elaine McCloskey created an issue   PuppetDB / PDB-4809 Corrective change every puppet run "GRANT CONNECT ON DATABASE "pe-puppetdb" TO "pe-puppetdb"' (corrective)" Issue Type: Bug Assignee: Unassigned Created: 2020/07/09 3:50 AM Priority: Normal Reporter: Elaine McCloskey Puppet Version: 2019.8 Puppet Server Version: OS Name/Version: RHEL 7 Desired Behavior: The change occurs once and applies the correct configuration Actual Behavior: Every Puppet run a corrective change occurs: Notice: /Stage[main]/Puppet_enterprise::Profile::Database/Puppet_enterprise::App_database[puppetdb]/Puppet_enterprise::Pg::Migrator_user[pe-puppetdb-migrator]/Puppet_enterprise::Psql[SET ROLE pe-puppetdb-migrator; GRANT pe-puppetdb - CONNECT - pe-puppetdb]/Pe_postgresql_psql[SET ROLE pe-puppetdb-migrator; GRANT pe-puppetdb - CONNECT - pe-puppetdb]/command: command changed to 'SET ROLE "pe-puppetdb-migrator"; GRANT CONNECT ON DATABASE "pe-puppetdb" TO "pe-puppetdb"' (corrective) This seems to be occurring as the below isn't returning the expected output here: pe-postgres=# SELECT datacl FROM pg_catalog.pg_database WHERE datname = 'pe-puppetdb'; datacl -------------------------------------------------------------- {"=T/\"pe-puppetdb\"","\"pe-puppetdb\"=CTc/\"pe-puppetdb\""} (1 row) Output from my working test 2019.8:   pe-postgres=# SELECT datacl FROM pg_catalog.pg_database WHERE datname = 'pe-puppetdb';                                                                                             datacl                                                                                             ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- {"\"pe-postgres\"=CTc/\"pe-postgres\"","=T/\"pe-postgres\"","\"pe-puppetdb\"=CT/\"pe-postgres\"","\"pe-puppetdb-migrator\"=c*/\"pe-postgres\"","\"pe-puppetdb\"=c/\"pe-puppetdb-migrator\""}   Another difference is the customers pe-postgres user is missing the Bypass RLS attribute, we tested removing this but didn't see the same behaviour as the customer. Looking for some next steps for the customer.   Add Comment   This message was sent by Atlassian Jira (v8.5.2#805002-sha1:a66f935) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/puppet-bugs/JIRA.365371.1594291829000.103735.1594291860065%40Atlassian.JIRA.