fix(postgresql): make schema optional and conditionally required in DefaultPrivileges

apis/cluster/postgresql/v1alpha1/default_privileges_types.go

@@ -38,6 +38,8 @@ type DefaultPrivilegesStatus struct {
 }
 
 // DefaultPrivilegesParameters defines the desired state of a Default Grant.
+// +kubebuilder:validation:XValidation:rule="!has(self.objectType) || self.objectType == 'schema' || has(self.schema)",message="schema is required when objectType is not schema"
+// +kubebuilder:validation:XValidation:rule="!has(self.objectType) || self.objectType != 'schema' || !has(self.schema)",message="schema must not be set when objectType is schema"
 type DefaultPrivilegesParameters struct {
 	// Privileges to be granted.
 	// See https://www.postgresql.org/docs/current/sql-grant.html for available privileges.
@@ -94,8 +96,9 @@ type DefaultPrivilegesParameters struct {
 	// +optional
 	DatabaseSelector *xpv1.Selector `json:"databaseSelector,omitempty"`
 
-	// Schema in which the default privileges are applied
-	// +required
+	// Schema in which the default privileges are applied.
+	// Not applicable when objectType is schema.
+	// +optional
 	Schema *string `json:"schema,omitempty"`
 }
 

apis/namespaced/postgresql/v1alpha1/default_privileges_types.go

@@ -39,6 +39,8 @@ type DefaultPrivilegesStatus struct {
 }
 
 // DefaultPrivilegesParameters defines the desired state of a Default Grant.
+// +kubebuilder:validation:XValidation:rule="!has(self.objectType) || self.objectType == 'schema' || has(self.schema)",message="schema is required when objectType is not schema"
+// +kubebuilder:validation:XValidation:rule="!has(self.objectType) || self.objectType != 'schema' || !has(self.schema)",message="schema must not be set when objectType is schema"
 type DefaultPrivilegesParameters struct {
 	// Privileges to be granted.
 	// See https://www.postgresql.org/docs/current/sql-grant.html for available privileges.
@@ -95,8 +97,9 @@ type DefaultPrivilegesParameters struct {
 	// +optional
 	DatabaseSelector *xpv1.NamespacedSelector `json:"databaseSelector,omitempty"`
 
-	// Schema in which the default privileges are applied
-	// +required
+	// Schema in which the default privileges are applied.
+	// Not applicable when objectType is schema.
+	// +optional
 	Schema *string `json:"schema,omitempty"`
 }
 

examples/cluster/postgresql/defaultprivileges.yaml

@@ -111,3 +111,107 @@ spec:
     schema: public
     databaseRef:
       name: example
+---
+# When owner-role creates new sequences, grant usage to writer-role
+apiVersion: postgresql.sql.crossplane.io/v1alpha1
+kind: DefaultPrivileges
+metadata:
+  name: writer-sequences
+spec:
+  forProvider:
+    objectType: sequence
+    roleRef:
+      name: writer-role
+    targetRole: owner-role
+    privileges:
+      - USAGE
+      - SELECT
+      - UPDATE
+    schema: public
+    databaseRef:
+      name: example
+---
+# When owner-role creates new sequences, grant read access to reader-role
+apiVersion: postgresql.sql.crossplane.io/v1alpha1
+kind: DefaultPrivileges
+metadata:
+  name: reader-sequences
+spec:
+  forProvider:
+    objectType: sequence
+    roleRef:
+      name: reader-role
+    targetRole: owner-role
+    privileges:
+      - USAGE
+      - SELECT
+    schema: public
+    databaseRef:
+      name: example
+---
+# When owner-role creates new types, grant usage to writer-role
+apiVersion: postgresql.sql.crossplane.io/v1alpha1
+kind: DefaultPrivileges
+metadata:
+  name: writer-types
+spec:
+  forProvider:
+    objectType: type
+    roleRef:
+      name: writer-role
+    targetRole: owner-role
+    privileges:
+      - USAGE
+    schema: public
+    databaseRef:
+      name: example
+---
+# When owner-role creates new types, grant usage to reader-role
+apiVersion: postgresql.sql.crossplane.io/v1alpha1
+kind: DefaultPrivileges
+metadata:
+  name: reader-types
+spec:
+  forProvider:
+    objectType: type
+    roleRef:
+      name: reader-role
+    targetRole: owner-role
+    privileges:
+      - USAGE
+    schema: public
+    databaseRef:
+      name: example
+---
+# When owner-role creates new schemas, grant usage to writer-role
+apiVersion: postgresql.sql.crossplane.io/v1alpha1
+kind: DefaultPrivileges
+metadata:
+  name: writer-schemas
+spec:
+  forProvider:
+    objectType: schema
+    roleRef:
+      name: writer-role
+    targetRole: owner-role
+    privileges:
+      - CREATE
+      - USAGE
+    databaseRef:
+      name: example
+---
+# When owner-role creates new schemas, grant usage to reader-role
+apiVersion: postgresql.sql.crossplane.io/v1alpha1
+kind: DefaultPrivileges
+metadata:
+  name: reader-schemas
+spec:
+  forProvider:
+    objectType: schema
+    roleRef:
+      name: reader-role
+    targetRole: owner-role
+    privileges:
+      - USAGE
+    databaseRef:
+      name: example

examples/namespaced/postgresql/defaultprivileges.yaml

@@ -135,3 +135,131 @@ spec:
   providerConfigRef:
     kind: ProviderConfig
     name: default
+---
+# When owner-role creates new sequences, grant usage to writer-role
+apiVersion: postgresql.sql.m.crossplane.io/v1alpha1
+kind: DefaultPrivileges
+metadata:
+  name: writer-sequences
+  namespace: default
+spec:
+  forProvider:
+    objectType: sequence
+    roleRef:
+      name: writer-role
+    targetRole: owner-role
+    privileges:
+      - USAGE
+      - SELECT
+      - UPDATE
+    schema: public
+    databaseRef:
+      name: example
+  providerConfigRef:
+    kind: ProviderConfig
+    name: default
+---
+# When owner-role creates new sequences, grant read access to reader-role
+apiVersion: postgresql.sql.m.crossplane.io/v1alpha1
+kind: DefaultPrivileges
+metadata:
+  name: reader-sequences
+  namespace: default
+spec:
+  forProvider:
+    objectType: sequence
+    roleRef:
+      name: reader-role
+    targetRole: owner-role
+    privileges:
+      - USAGE
+      - SELECT
+    schema: public
+    databaseRef:
+      name: example
+  providerConfigRef:
+    kind: ProviderConfig
+    name: default
+---
+# When owner-role creates new types, grant usage to writer-role
+apiVersion: postgresql.sql.m.crossplane.io/v1alpha1
+kind: DefaultPrivileges
+metadata:
+  name: writer-types
+  namespace: default
+spec:
+  forProvider:
+    objectType: type
+    roleRef:
+      name: writer-role
+    targetRole: owner-role
+    privileges:
+      - USAGE
+    schema: public
+    databaseRef:
+      name: example
+  providerConfigRef:
+    kind: ProviderConfig
+    name: default
+---
+# When owner-role creates new types, grant usage to reader-role
+apiVersion: postgresql.sql.m.crossplane.io/v1alpha1
+kind: DefaultPrivileges
+metadata:
+  name: reader-types
+  namespace: default
+spec:
+  forProvider:
+    objectType: type
+    roleRef:
+      name: reader-role
+    targetRole: owner-role
+    privileges:
+      - USAGE
+    schema: public
+    databaseRef:
+      name: example
+  providerConfigRef:
+    kind: ProviderConfig
+    name: default
+---
+# When owner-role creates new schemas, grant usage to writer-role
+apiVersion: postgresql.sql.m.crossplane.io/v1alpha1
+kind: DefaultPrivileges
+metadata:
+  name: writer-schemas
+  namespace: default
+spec:
+  forProvider:
+    objectType: schema
+    roleRef:
+      name: writer-role
+    targetRole: owner-role
+    privileges:
+      - CREATE
+      - USAGE
+    databaseRef:
+      name: example
+  providerConfigRef:
+    kind: ProviderConfig
+    name: default
+---
+# When owner-role creates new schemas, grant usage to reader-role
+apiVersion: postgresql.sql.m.crossplane.io/v1alpha1
+kind: DefaultPrivileges
+metadata:
+  name: reader-schemas
+  namespace: default
+spec:
+  forProvider:
+    objectType: schema
+    roleRef:
+      name: reader-role
+    targetRole: owner-role
+    privileges:
+      - USAGE
+    databaseRef:
+      name: example
+  providerConfigRef:
+    kind: ProviderConfig
+    name: default

package/crds/postgresql.sql.crossplane.io_defaultprivileges.yaml

@@ -267,7 +267,9 @@ spec:
                         type: object
                     type: object
                   schema:
-                    description: Schema in which the default privileges are applied
+                    description: |-
+                      Schema in which the default privileges are applied.
+                      Not applicable when objectType is schema.
                     type: string
                   targetRole:
                     description: |-
@@ -287,9 +289,15 @@ spec:
                     type: string
                 required:
                 - objectType
-                - schema
                 - targetRole
                 type: object
+                x-kubernetes-validations:
+                - message: schema is required when objectType is not schema
+                  rule: '!has(self.objectType) || self.objectType == ''schema'' ||
+                    has(self.schema)'
+                - message: schema must not be set when objectType is schema
+                  rule: '!has(self.objectType) || self.objectType != ''schema'' ||
+                    !has(self.schema)'
               managementPolicies:
                 default:
                 - '*'

package/crds/postgresql.sql.m.crossplane.io_defaultprivileges.yaml

@@ -265,7 +265,9 @@ spec:
                         type: object
                     type: object
                   schema:
-                    description: Schema in which the default privileges are applied
+                    description: |-
+                      Schema in which the default privileges are applied.
+                      Not applicable when objectType is schema.
                     type: string
                   targetRole:
                     description: |-
@@ -285,9 +287,15 @@ spec:
                     type: string
                 required:
                 - objectType
-                - schema
                 - targetRole
                 type: object
+                x-kubernetes-validations:
+                - message: schema is required when objectType is not schema
+                  rule: '!has(self.objectType) || self.objectType == ''schema'' ||
+                    has(self.schema)'
+                - message: schema must not be set when objectType is schema
+                  rule: '!has(self.objectType) || self.objectType != ''schema'' ||
+                    !has(self.schema)'
               managementPolicies:
                 default:
                 - '*'

pkg/controller/cluster/postgresql/default_privileges/reconciler.go

@@ -56,6 +56,8 @@ const (
 	errNoRole                  = "role not passed or could not be resolved"
 	errNoTargetRole            = "target role not passed or could not be resolved"
 	errNoObjectType            = "object type not passed"
+	errNoSchema                = "schema is required when objectType is not schema"
+	errSchemaWithSchemaType    = "schema must not be set when objectType is schema"
 
 	maxConcurrency = 5
 )
@@ -175,24 +177,23 @@ func withOption(option *v1alpha1.GrantOption) string {
 }
 
 func inSchema(params *v1alpha1.DefaultPrivilegesParameters) string {
-	if params.Schema != nil {
+	// PostgreSQL does not allow IN SCHEMA with ON SCHEMAS.
+	if params.Schema != nil && (params.ObjectType == nil || *params.ObjectType != "schema") {
 		return fmt.Sprintf("IN SCHEMA %s", pq.QuoteIdentifier(*params.Schema))
 	}
 	return ""
 }
 
 func createDefaultPrivilegesQuery(gp v1alpha1.DefaultPrivilegesParameters, q *xsql.Query) {
-
 	roleName := pq.QuoteIdentifier(*gp.Role)
-
 	targetRoleName := pq.QuoteIdentifier(*gp.TargetRole)
 
 	query := strings.TrimSpace(fmt.Sprintf(
 		"ALTER DEFAULT PRIVILEGES FOR ROLE %s %s GRANT %s ON %sS TO %s %s",
 		targetRoleName,
 		inSchema(&gp),
 		strings.Join(gp.Privileges.ToStringSlice(), ","),
-		*gp.ObjectType,
+		strings.ToUpper(*gp.ObjectType),
 		roleName,
 		withOption(gp.WithOption),
 	))
@@ -208,7 +209,7 @@ func deleteDefaultPrivilegesQuery(gp v1alpha1.DefaultPrivilegesParameters, q *xs
 		"ALTER DEFAULT PRIVILEGES FOR ROLE %s %s REVOKE ALL ON %sS FROM %s",
 		targetRoleName,
 		inSchema(&gp),
-		*gp.ObjectType,
+		strings.ToUpper(*gp.ObjectType),
 		roleName,
 	))
 
@@ -250,6 +251,14 @@ func (c *external) Observe(ctx context.Context, mg *v1alpha1.DefaultPrivileges)
 		return managed.ExternalObservation{}, errors.New(errNoObjectType)
 	}
 
+	if *mg.Spec.ForProvider.ObjectType != "schema" && mg.Spec.ForProvider.Schema == nil {
+		return managed.ExternalObservation{}, errors.New(errNoSchema)
+	}
+
+	if *mg.Spec.ForProvider.ObjectType == "schema" && mg.Spec.ForProvider.Schema != nil {
+		return managed.ExternalObservation{}, errors.New(errSchemaWithSchemaType)
+	}
+
 	gp := mg.Spec.ForProvider
 	var query xsql.Query
 	selectDefaultPrivilegesQuery(gp, &query)