Repository navigation
[Feature]: Declarative role management (DatabaseRole CRD) #5341
Description
With the implementation of database management via the Database CRD, it’s important to offer an alternative approach to role management, currently handled through the .spec.managed.roles stanza. We propose introducing a new CRD called Role, which will eventually replace the existing implementation. For now, we will maintain both interfaces, ensuring that they are mutually exclusive if coexistence is not feasible.
gbartoliniUpdate. The proposal is to name the CRD DatabaseRole (see @svenakela's comment).
As far as the co-existence of the DatabaseRole CR with the current .spec.managed.roles capability is concerned, there can be three use cases regarding a specific role:
- The role is created via
.spec.managed.roles - The role is created via the new
RoleCR - The role is created directly in PostgreSQL (with a user having superuser/role privileges) - outside the scope.
Let's focus on the first two.
A role can only be reconciled by either 1 or 2, with 1 having higher precedence (since it is the current behaviour).
For example, if you create the dante user as follows:
apiVersion: postgresql.cnpg.io/v1
kind: Cluster
spec…Metadata
Metadata
Assignees
Type
Projects
- Status
Activity
mnencia commentedon Nov 28, 2024
Given the current timeline and the need to release version 1.25 before the end of the year, there is not enough time to complete this feature within the 1.25 release cycle. I’m moving this to version 1.26 for better planning and execution.
56 remaining items
gbartolini commentedon Mar 4, 2026
We are currently focused on completing our extensions story, which includes image catalog support for extensions (#8495), as well as the Postgres extension container images project (cloudnative-pg/postgres-extensions-containers#15). Therefore, we need to make a decision regarding our timeline:
I vote for the second option: moving this feature to version 1.30.
leonardoce commentedon Mar 4, 2026
I vote for the second option too.
armru commentedon Mar 4, 2026
I vote for the second option. I prefer releasing the 1.29 sooner to bring fixes to the end users
mnencia commentedon Mar 4, 2026
I agree to moving the feature to 1.30
gbartolini commentedon Mar 4, 2026
Ok, I see the majority has voted. Moving this to 1.30.
feat: introduce `DatabaseRole` CRD for declarative role management (c…