Skip to content

Commit e3735f2

Browse files
y-trobinsoy-trobinso
authored
Merge pull request #7 from Yelp/y-trobinso_full_group_support
Provide postgres and redshift groups support (dbgroup.pp)
2 parents 4563a6f + 0e48fdd commit e3735f2

File tree

6 files changed

+187
-80
lines changed

6 files changed

+187
-80
lines changed

‎README.md‎

Lines changed: 37 additions & 37 deletions
Original file line numberDiff line numberDiff line change
@@ -322,10 +322,10 @@ The postgresql module comes with many options for configuring the server. While
322322
* [postgresql::server::database](#postgresqlserverdatabase)
323323
* [postgresql::server::database_grant](#postgresqlserverdatabase_grant)
324324
* [postgresql::server::db](#postgresqlserverdb)
325+
* [postgresql::server::dbgroup](#postgresqlserverdbgroup)
325326
* [postgresql::server::extension](#postgresqlserverextension)
326327
* [postgresql::server::grant](#postgresqlservergrant)
327328
* [postgresql::server::grant_role](#postgresqlservergrant_role)
328-
* [postgresql::server::group](#postgresqlservergroup)
329329
* [postgresql::server::pg_hba_rule](#postgresqlserverpg_hba_rule)
330330
* [postgresql::server::pg_ident_rule](#postgresqlserverpg_ident_rule)
331331
* [postgresql::server::recovery](#postgresqlserverrecovery)
@@ -1094,6 +1094,42 @@ Defaults value: `template0`.
10941094

10951095
User to create and assign access to the database upon creation. Mandatory.
10961096

1097+
#### postgresql::server::dbgroup
1098+
1099+
Creates a Postgres group.
1100+
1101+
##### `connect_settings`
1102+
Required.
1103+
1104+
Specifies a hash of environment variables used when connecting to a remote server.
1105+
1106+
Default value: `undef`, because groups only currently make sense in remotely-managed Redshift clusters.
1107+
1108+
##### `db`
1109+
Required.
1110+
1111+
Specifies which database psql will use to perform certain checks, such as what settings exist for the current group prior to applying changes.
1112+
1113+
##### `dialect`
1114+
Reserved for future use. Currently both the 'postgres' and 'redshift' dialects are identical in operation.
1115+
1116+
Default value: inherit from server settings.
1117+
1118+
##### `groupname`
1119+
Defines the name of the group to create.
1120+
1121+
Default value: the namevar.
1122+
1123+
##### `groupmembers`
1124+
Defines the users that are part of the current group, if any.
1125+
1126+
Default value: `undef`, which specifies an empty members list.
1127+
1128+
##### `port`
1129+
Optional port override for connecting to postgres when applying this group.
1130+
1131+
Default value: inherit from `$connect_settings` or `postgresql::server::port`
1132+
10971133
#### postgresql::server::database
10981134

10991135
Creates a database with no users and no permissions.
@@ -1300,42 +1336,6 @@ Specifies a hash of environment variables used when connecting to a remote serve
13001336

13011337
Default value: Connects to the local Postgres instance.
13021338

1303-
#### postgresql::server::group
1304-
1305-
Creates a Postgres group.
1306-
1307-
##### `connect_settings`
1308-
Required.
1309-
1310-
Specifies a hash of environment variables used when connecting to a remote server.
1311-
1312-
Default value: `undef`, because groups only currently make sense in remotely-managed Redshift clusters.
1313-
1314-
##### `db`
1315-
Required.
1316-
1317-
Specifies which database psql will use to perform certain checks, such as what settings exist for the current group prior to applying changes.
1318-
1319-
##### `dialect`
1320-
Reserved for future use. Currently both the 'postgres' and 'redshift' dialects are identical in operation.
1321-
1322-
Default value: inherit from server settings.
1323-
1324-
##### `groupname`
1325-
Defines the name of the group to create.
1326-
1327-
Default value: the namevar.
1328-
1329-
##### `groupmembers`
1330-
Defines the users that are part of the current group, if any.
1331-
1332-
Default value: `undef`, which specifies an empty members list.
1333-
1334-
##### `port`
1335-
Optional port override for connecting to postgres when applying this group.
1336-
1337-
Default value: inherit from `$connect_settings` or `postgresql::server::port`
1338-
13391339
#### postgresql::server::pg_hba_rule
13401340

13411341
Allows you to create an access rule for `pg_hba.conf`. For more details see the [usage example](#create-an-access-rule-for-pghba.conf) and the [PostgreSQL documentation](http://www.postgresql.org/docs/current/static/auth-pg-hba-conf.html).

‎manifests/server/dbgroup.pp‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
# Define for creating a redshift group. See README.md for more information
2+
define postgresql::server::dbgroup(
3+
$db = $postgresql::server::default_database,
4+
$port = undef,
5+
$groupmembers = [],
6+
$groupname = $title,
7+
$dialect = $postgresql::server::dialect,
8+
$connect_settings = undef,
9+
) {
10+
$psql_user = $postgresql::server::user
11+
$psql_group = $postgresql::server::group
12+
$psql_path = $postgresql::server::psql_path
13+
$module_workdir = $postgresql::server::module_workdir
14+
15+
#
16+
# Port, order of precedence: $port parameter, $connect_settings[PGPORT], $postgresql::server::port
17+
#
18+
if $port != undef {
19+
$port_override = $port
20+
} elsif $connect_settings != undef and has_key( $connect_settings, 'PGPORT') {
21+
$port_override = undef
22+
} else {
23+
$port_override = $postgresql::server::port
24+
}
25+
26+
Postgresql_psql {
27+
db => $db,
28+
port => $port_override,
29+
psql_user => $psql_user,
30+
psql_group => $psql_group,
31+
psql_path => $psql_path,
32+
connect_settings => $connect_settings,
33+
cwd => $module_workdir,
34+
require => [
35+
Postgresql_psql["${title}: CREATE GROUP ${groupname}"],
36+
Class['postgresql::server'],
37+
],
38+
}
39+
40+
postgresql_psql { "${title}: CREATE GROUP ${groupname}":
41+
command => "CREATE GROUP '${groupname}'",
42+
unless => "SELECT 1 FROM pg_group WHERE groname = '${groupname}'",
43+
environment => [],
44+
require => Class['Postgresql::Server'],
45+
}
46+
47+
postgresql_psql {"${title}: UPDATE pg_group SET grolist = ARRAY${groupmembers} WHERE groname = '${groupname}'":
48+
command => "UPDATE pg_group SET grolist = ARRAY${groupmembers} WHERE groname = '${groupname}'",
49+
unless => "SELECT 1 FROM pg_group WHERE groname = '${groupname}' AND grolist = ARRAY${groupmembers}",
50+
}
51+
}

‎manifests/server/group.pp‎

Lines changed: 0 additions & 29 deletions
This file was deleted.

‎manifests/server/role.pp‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -112,33 +112,40 @@
112112
}
113113

114114
postgresql_psql {"${title}: ALTER ${role_keyword} \"${username}\" ${createdb_sql}":
115+
command => "ALTER ${role_keyword} \"${username}\" ${createdb_sql}",
115116
unless => "SELECT 1 FROM ${role_table} WHERE ${role_column_prefix}name = '${username}' AND ${role_column_prefix}createdb = ${createdb}",
116117
}
117118

118119
if ($dialect == 'postgres') {
119120
postgresql_psql {"${title}: ALTER ${role_keyword} \"${username}\" ${createrole_sql}":
121+
command => "ALTER ${role_keyword} \"${username}\" ${createrole_sql}",
120122
unless => "SELECT 1 FROM ${role_table} WHERE ${role_column_prefix}name = '${username}' AND rolcreaterole = ${createrole}",
121123
}
122124

123125
postgresql_psql {"${title}: ALTER ${role_keyword} \"${username}\" ${superuser_sql}":
126+
command => "ALTER ${role_keyword} \"${username}\" ${superuser_sql}",
124127
unless => "SELECT 1 FROM ${role_table} WHERE rolname = '${username}' AND rolsuper = ${superuser}",
125128
}
126129

127130
postgresql_psql {"${title}: ALTER ${role_keyword} \"${username}\" ${login_sql}":
131+
command => "ALTER ${role_keyword} \"${username}\" ${login_sql}",
128132
unless => "SELECT 1 FROM ${role_table} WHERE rolname = '${username}' AND rolcanlogin = ${login}",
129133
}
130134

131135
postgresql_psql {"${title}: ALTER ${role_keyword} \"${username}\" ${inherit_sql}":
136+
command => "ALTER ${role_keyword} \"${username}\" ${inherit_sql}",
132137
unless => "SELECT 1 FROM ${role_table} WHERE rolname = '${username}' AND rolinherit = ${inherit}",
133138
}
134139

135140
if(versioncmp($version, '9.1') >= 0) {
136141
if $replication_sql == '' {
137142
postgresql_psql {"${title}: ALTER ${role_keyword} \"${username}\" NOREPLICATION":
143+
command => "ALTER ${role_keyword} \"${username}\" NOREPLICATION",
138144
unless => "SELECT 1 FROM ${role_table} WHERE rolname = '${username}' AND rolreplication = ${replication}",
139145
}
140146
} else {
141147
postgresql_psql {"${title}: ALTER ${role_keyword} \"${username}\" ${replication_sql}":
148+
command => "ALTER ${role_keyword} \"${username}\" ${replication_sql}",
142149
unless => "SELECT 1 FROM ${role_table} WHERE rolname = '${username}' AND rolreplication = ${replication}",
143150
}
144151
}
@@ -147,11 +154,13 @@
147154

148155
# CREATEUSER actually defines superuser privileges in Redshift: http://docs.aws.amazon.com/redshift/latest/dg/r_CREATE_USER.html
149156
postgresql_psql {"${title}: ALTER ${role_keyword} \"${username}\" ${createrole_sql}":
157+
command => "ALTER ${role_keyword} \"${username}\" ${createrole_sql}",
150158
unless => "SELECT 1 FROM ${role_table} WHERE usename = '${username}' AND usesuper = ${createrole}",
151159
}
152160
}
153161

154162
postgresql_psql {"${title}: ALTER ${role_keyword} \"${username}\" CONNECTION LIMIT ${role_connection_limit}":
163+
command => "ALTER ${role_keyword} \"${username}\" CONNECTION LIMIT ${role_connection_limit}",
155164
unless => "SELECT 1 FROM ${role_table} WHERE ${role_column_prefix}name = '${username}' AND ${role_column_prefix}connlimit = '${role_connection_limit}'",
156165
}
157166

‎spec/unit/defines/server/dbgroup_spec.rb‎

Lines changed: 76 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,76 @@
1+
require 'spec_helper'
2+
3+
describe 'postgresql::server::dbgroup', :type => :define do
4+
5+
let :facts do
6+
{
7+
:osfamily => 'Debian',
8+
:operatingsystem => 'Debian',
9+
:operatingsystemrelease => '6.0',
10+
:kernel => 'Linux',
11+
:concat_basedir => tmpfilename('contrib'),
12+
:id => 'root',
13+
:path => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin',
14+
}
15+
end
16+
17+
let :title do
18+
'test'
19+
end
20+
21+
context 'no members' do
22+
23+
let :pre_condition do
24+
"class {'postgresql::server': dialect => 'postgres'}"
25+
end
26+
27+
it { is_expected.to contain_postgresql__server__dbgroup('test') }
28+
it 'should have create group for test' do
29+
is_expected.to contain_postgresql_psql('test: CREATE GROUP test').with({
30+
'command' => "CREATE GROUP 'test'",
31+
'environment' => [],
32+
'unless' => "SELECT 1 FROM pg_group WHERE groname = 'test'",
33+
'port' => "5432",
34+
})
35+
end
36+
it 'should have update pg_group for test group with groupmembers as []' do
37+
is_expected.to contain_postgresql_psql("test: UPDATE pg_group SET grolist = ARRAY[] WHERE groname = 'test'").with({
38+
'command' => "UPDATE pg_group SET grolist = ARRAY[] WHERE groname = 'test'",
39+
'environment' => [],
40+
'unless' => "SELECT 1 FROM pg_group WHERE groname = 'test' AND grolist = ARRAY[]",
41+
'port' => "5432",
42+
})
43+
end
44+
end
45+
46+
context 'group containing test members' do
47+
48+
let :pre_condition do
49+
"class {'postgresql::server': dialect => 'postgres'}"
50+
end
51+
52+
let :params do
53+
{
54+
:groupmembers => ['testuser1', 'testuser2'],
55+
}
56+
end
57+
58+
it { is_expected.to contain_postgresql__server__dbgroup('test') }
59+
it 'should have create group for test' do
60+
is_expected.to contain_postgresql_psql('test: CREATE GROUP test').with({
61+
'command' => "CREATE GROUP 'test'",
62+
'environment' => [],
63+
'unless' => "SELECT 1 FROM pg_group WHERE groname = 'test'",
64+
'port' => "5432",
65+
})
66+
end
67+
it 'should have update pg_group for test group with provided groupmembers' do
68+
is_expected.to contain_postgresql_psql("test: UPDATE pg_group SET grolist = ARRAY[testuser1, testuser2] WHERE groname = 'test'").with({
69+
'command' => "UPDATE pg_group SET grolist = ARRAY[testuser1, testuser2] WHERE groname = 'test'",
70+
'environment' => [],
71+
'unless' => "SELECT 1 FROM pg_group WHERE groname = 'test' AND grolist = ARRAY[testuser1, testuser2]",
72+
'port' => "5432",
73+
})
74+
end
75+
end
76+
end

‎spec/unit/defines/server/role_spec.rb‎

Lines changed: 14 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -75,9 +75,9 @@
7575
{
7676
:password_hash => 'new-pa$s',
7777
:connect_settings => { 'PGHOST' => 'postgres-db-server',
78-
'DBVERSION' => '9.1',
79-
'PGUSER' => 'login-user',
80-
'PGPASSWORD' => 'login-pass' },
78+
'DBVERSION' => '9.1',
79+
'PGUSER' => 'login-user',
80+
'PGPASSWORD' => 'login-pass' },
8181
}
8282
end
8383

@@ -119,10 +119,10 @@
119119
{
120120
:password_hash => 'new-pa$s',
121121
:connect_settings => { 'PGHOST' => 'postgres-db-server',
122-
'DBVERSION' => '9.1',
123-
'PGPORT' => '1234',
124-
'PGUSER' => 'login-user',
125-
'PGPASSWORD' => 'login-pass' },
122+
'DBVERSION' => '9.1',
123+
'PGPORT' => '1234',
124+
'PGUSER' => 'login-user',
125+
'PGPASSWORD' => 'login-pass' },
126126
}
127127
end
128128

@@ -214,9 +214,9 @@
214214
{
215215
:password_hash => 'new-pa$s',
216216
:connect_settings => { 'PGHOST' => 'redshift-db-server',
217-
'DBVERSION' => '9.1',
218-
'PGUSER' => 'login-user',
219-
'PGPASSWORD' => 'login-pass' },
217+
'DBVERSION' => '9.1',
218+
'PGUSER' => 'login-user',
219+
'PGPASSWORD' => 'login-pass' },
220220
}
221221
end
222222

@@ -258,10 +258,10 @@
258258
{
259259
:password_hash => 'new-pa$s',
260260
:connect_settings => { 'PGHOST' => 'redshift-db-server',
261-
'DBVERSION' => '9.1',
262-
'PGPORT' => '1234',
263-
'PGUSER' => 'login-user',
264-
'PGPASSWORD' => 'login-pass' },
261+
'DBVERSION' => '9.1',
262+
'PGPORT' => '1234',
263+
'PGUSER' => 'login-user',
264+
'PGPASSWORD' => 'login-pass' },
265265
}
266266
end
267267

0 commit comments

Comments
 (0)