Repository navigation
create supabase_admin_monitor role for monitoring services - #2642
Open
TheOtherBrian1 wants to merge 5 commits into
Open
TheOtherBrian1 wants to merge 5 commits into
TheOtherBrian1 wants to merge 5 commits into
Conversation
Contributor
Author
|
@copilot resolve the merge conflicts in this pull request |
…tor-role # Conflicts: # ansible/files/postgresql_config/supautils.conf.j2 Co-authored-by: TheOtherBrian1 <91111415+TheOtherBrian1@users.noreply.github.com>
PostgreSQL Extension Dependency Analysis: PR #2642
SummaryNo extensions had dependencies with MAJOR version updates. Full Analysis ResultsPostgreSQL 15 Extension DependenciesPostgreSQL 17 Extension DependenciesOrioleDB 17 Extension Dependencies |
PostgreSQL Package Dependency Analysis: PR #2642
SummaryNo packages had MAJOR version updates. Full Analysis ResultsPostgreSQL 15 Dependency ChangesExtracting PostgreSQL 15 dependencies...
Runtime Closure Size
Raw Dependency ClosurePostgreSQL 17 Dependency ChangesExtracting PostgreSQL 17 dependencies...
Runtime Closure Size
Raw Dependency Closure |
Package version diffCompares built package versions in legacyPackages between this PR and the tip of the base branch, per system. aarch64-linux: Closure size: 372 -> 372 (2 paths added, 2 paths removed, delta +0, disk usage +808B).x86_64-linux: Closure size: 370 -> 370 (2 paths added, 2 paths removed, delta +0, disk usage +808B). |
Copilot started work to fix failing Actions workflows on behalf of
TheOtherBrian1
November 12, 2026 11:23
Copilot started work to fix failing Actions workflows on behalf of
TheOtherBrian1
November 12, 2026 11:34
Copilot stopped work on behalf of
TheOtherBrian1 due to an error
November 12, 2026 11:34
Copilot started work to fix failing Actions workflows on behalf of
TheOtherBrian1
November 12, 2026 13:55
mmlb
requested changes
Nov 12, 2026
Comment on lines
+22
to
+34
| -- Supabase monitoring user: no password and can only connect via localhost, | ||
| -- reads every table | ||
| -- bypassing RLS, read-only, owns nothing. | ||
| -- so the name can never be pre-empted: a plain CREATE fails loudly if it exists. | ||
| create role supabase_monitor_admin with login bypassrls connection limit 2; | ||
| grant pg_read_all_data, pg_monitor to supabase_monitor_admin; | ||
| alter role supabase_monitor_admin set default_transaction_read_only = on; | ||
| alter role supabase_monitor_admin set transaction_read_only = on; | ||
| alter role supabase_monitor_admin set search_path = ''; | ||
| alter role supabase_monitor_admin set statement_timeout = '3s'; | ||
| alter role supabase_monitor_admin set lock_timeout = '3s'; | ||
| alter role supabase_monitor_admin set idle_in_transaction_session_timeout = '3s'; | ||
|
|
Collaborator
There was a problem hiding this comment.
according to docs this should be in its own migration
Contributor
Author
There was a problem hiding this comment.
Thanks for looking over the PR, @mmlb! I was following the example set in the request:
It created the supabase_etl_admin user.
Collaborator
There was a problem hiding this comment.
yeah we don't have CI catching this atm and if its not a test then it doesn't get enforced :(, but I'd appreciate doing as the docs say
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What kind of change does this PR introduce?
Adds a new read-only role called
supabase_admin_monitorWhat is the current behavior?
Some monitor roles are not
read-only.What is the new behavior?
This is supposed to be a new monitoring role for advisors and other tools
Additional context
Our monitoring tools should not use roles with any write priveleges. The new
supabase_admin_monitorhas the following properties:DEFAULT CONFIGS:
Read all attributes and grants: BYPASSRLS, pg_read_all_data, pg_monitor to supabase_monitor_adminRead all configs: "default_transaction_read_only, transaction_read_only" (redundancy safe-guard against postgres granting the role write permissions over its tables)Connection limit: connection limit set to 2. May be worth setting it to 5 to account for future usagetimeout management: "statement_timeout, lock_timeout, idle_in_transaction_session_timeout" (lock mitigation)search_path: removes risks of path hijacking