660842 - Set up different PostgreSQL account for processors

Status: RESOLVED FIXED

(Data & BI Services Team :: DB: MySQL, task)

Description

[Laura Thomson :laura]

As above.  This is part of bug 629144.

Comment 1

[[:jberkus] Josh Berkus]

Completed with 1.7.8 push.

Comment 2

[K Lars Lohn [:lars] [:klohn]]

apparently, the new "monitor" user cannot insert into the private priority jobs table owned by the "processor" user.  

2011-06-02 23:03:06,939 ERROR - priorityLoopingThread - Caught Error:
<class 'psycopg2.ProgrammingError'>
2011-06-02 23:03:06,939 ERROR - priorityLoopingThread - permission
denied for relation priority_jobs_1158

The ability of the monitor to write to the private priority jobs table is pivotal to the communication between those two processes.  The processors themselves are responsible for creating there own private priority jobs tables.  Under the new system of each process having its own username, will the processors have to explicitly grant insert permission to the monitor?  Or is there a way for the monitor to automatically have this privilege?

Comment 3

[Matt Pressman [:mpressman]]

Since I am not sure of how locked down we want the 'monitor' user, I can go about this several ways. I can change the monitor to a superuser which will allow it access to all objects, I can explicitly give it permissions to objects that already exist or change the 'monitor' user to be a member of 'processor' table which will allow it access to all 'processor' objects

Any ideas?

Comment 4

[K Lars Lohn [:lars] [:klohn]]

the monitor should be allowed to access all "processor" objects.  Let's set it there and see how it goes.

Comment 5

[Matt Pressman [:mpressman]]

breakpad=# grant processor to monitor;
GRANT ROLE
breakpad=#

Comment 6

[K Lars Lohn [:lars] [:klohn]]

the permission errors are no longer happening in the logs.  I think we can call this fixed.

Comment 7

[[:jberkus] Josh Berkus]

Matt, can you add that grant statement to the 1.7.8 upgrade scripts, just so it's in SVN?

Thanks.