PGD predefined roles ==================== PGD predefined roles are created when the BDR extension is installed. After BDR extension is dropped from a database, the roles continue to exist. You need to drop them manually if dropping is required. bdr_superuser ^^^^^^^^^^^^^ This is a role for an admin user that can manage anything PGD related. It allows you to separate management of the database and table access. Using it allows you to have a user that can manage the PGD cluster without giving them PostgreSQL superuser privileges. Privileges ^^^^^^^^^^ - ALL PRIVILEGES ON ALL TABLES IN SCHEMA BDR - ALL PRIVILEGES ON ALL ROUTINES IN SCHEMA BDR bdr_read_all_stats ^^^^^^^^^^^^^^^^^^ This role provides read access to most of the tables, views, and functions that users or applications may need to observe the statistics and state of the PGD cluster. .. _privileges-1: Privileges ^^^^^^^^^^ ``SELECT`` privilege on: - ``bdr.autopartition_partitions`` - ``bdr.autopartition_rules`` - :ref:`bdr.ddl_epoch ` - :ref:`bdr.ddl_replication ` - :ref:`bdr.global_consensus_journal_details ` - :ref:`bdr.global_lock ` - :ref:`bdr.global_locks ` - :ref:`bdr.group_camo_details ` - :ref:`bdr.local_consensus_state ` - :ref:`bdr.local_node_summary ` - :ref:`bdr.node_config ` - :ref:`bdr.node_catchup_info ` - :ref:`bdr.node_catchup_info_details ` - :ref:`bdr.node_conflict_resolvers ` - :ref:`bdr.node_group_config ` - :ref:`bdr.node_local_info ` - :ref:`bdr.node_peer_progress ` - :ref:`bdr.node_replication_rates ` - :ref:`bdr.node_slots ` - :ref:`bdr.node_summary ` - :ref:`bdr.replication_sets ` - ``bdr.replication_status`` - :ref:`bdr.sequences ` - :ref:`bdr.stat_activity ` - :ref:`bdr.stat_relation ` - :ref:`bdr.stat_subscription ` *deprecated* - :ref:`bdr.state_journal_details ` - :ref:`bdr.subscription ` - :ref:`bdr.subscription_summary ` - :ref:`bdr.tables ` - :ref:`bdr.taskmgr_local_work_queue ` - :ref:`bdr.taskmgr_work_queue ` - :ref:`bdr.worker_errors ` *deprecated* - :ref:`bdr.workers ` - :ref:`bdr.writers ` - ``bdr.xid_peer_progress`` EXECUTE privilege on: - ``bdr.bdr_edition`` *deprecated* - :ref:`bdr.bdr_version ` - :ref:`bdr.bdr_version_num ` - :ref:`bdr.decode_message_payload ` - :ref:`bdr.get_consensus_status ` - :ref:`bdr.get_decoding_worker_stat ` - :ref:`bdr.get_global_locks ` - ``bdr.get_min_required_replication_slots`` - ``bdr.get_min_required_worker_processes`` - :ref:`bdr.get_raft_status ` - :ref:`bdr.get_relation_stats ` - :ref:`bdr.get_slot_flush_timestamp ` - ``bdr.get_sub_progress_timestamp`` - :ref:`bdr.get_subscription_stats ` - :ref:`bdr.lag_control ` - ``bdr.lag_history`` - :ref:`bdr.node_catchup_state_name ` - :ref:`bdr.node_kind_name ` - :ref:`bdr.peer_state_name ` - ``bdr.pglogical_proto_version_ranges`` - :ref:`bdr.show_subscription_status ` - :ref:`bdr.show_workers ` - :ref:`bdr.show_writers ` - ``bdr.stat_get_activity`` - :ref:`bdr.wal_sender_stats ` - ``bdr.worker_role_id_name`` bdr_monitor ^^^^^^^^^^^ This role provides read access to any tables, views, and functions that users or applications may need to monitor the PGD cluster. It includes all the privileges of the :ref:`bdr_read_all_stats ` role. .. _privileges-2: Privileges ^^^^^^^^^^ All privileges from :ref:`bdr_read_all_stats ` plus the following additional privileges: ``SELECT`` privilege on: - :ref:`bdr.group_raft_details ` - :ref:`bdr.group_replslots_details ` - :ref:`bdr.group_subscription_summary ` - :ref:`bdr.group_versions_details ` - ``bdr.raft_instances`` ``EXECUTE`` privilege on: - ``bdr.get_raft_instance_by_nodegroup`` - ``bdr.monitor_camo_on_all_nodes`` - :ref:`bdr.monitor_group_raft ` - :ref:`bdr.monitor_group_versions ` - :ref:`bdr.monitor_local_replslots ` - ``bdr.monitor_raft_details_on_all_nodes`` - ``bdr.monitor_replslots_details_on_all_nodes`` - ``bdr.monitor_subscription_details_on_all_nodes`` - ``bdr.monitor_version_details_on_all_nodes`` - ``bdr.node_group_member_info`` bdr_application ^^^^^^^^^^^^^^^ This role is designed for applications that require access to PGD features, objects, and functions such as sequences, CRDT datatypes, CAMO status functions, or trigger management functions. .. _privileges-3: Privileges ^^^^^^^^^^ ``EXECUTE`` privilege on: - All functions for column_timestamps datatypes - All functions for CRDT datatypes - :ref:`bdr.alter_sequence_set_kind ` - :ref:`bdr.create_conflict_trigger ` - :ref:`bdr.create_transform_trigger ` - :ref:`bdr.drop_trigger ` - :ref:`bdr.get_configured_camo_partner ` - :ref:`bdr.global_lock_table ` - :ref:`bdr.is_camo_partner_connected ` - :ref:`bdr.is_camo_partner_ready ` - :ref:`bdr.logical_transaction_status ` - ``bdr.ri_fkey_trigger`` - :ref:`bdr.seq_nextval ` - :ref:`bdr.seq_currval ` - :ref:`bdr.seq_lastval ` - :ref:`bdr.trigger_get_committs ` - :ref:`bdr.trigger_get_conflict_type ` - :ref:`bdr.trigger_get_origin_node_id ` - :ref:`bdr.trigger_get_row ` - :ref:`bdr.trigger_get_type ` - :ref:`bdr.trigger_get_xid ` - :ref:`bdr.wait_for_camo_partner_queue ` - :ref:`bdr.wait_slot_confirm_lsn ` Many of these functions require additional privileges before you can use them. For example, you must be the table owner to successfully execute ``bdr.alter_sequence_set_kind`` . These additional rules are described with each specific function. bdr_read_all_conflicts ^^^^^^^^^^^^^^^^^^^^^^ PGD logs conflicts into the :ref:`bdr.conflict_history ` table. Conflicts are visible only to table owners, so no extra privileges are required for the owners to read the conflict history. If, though, it’s useful to have a user that can see conflicts for all tables, you can optionally grant the role ``bdr_read_all_conflicts`` to that user. .. _privileges-4: Privileges ^^^^^^^^^^ An explicit policy is set on :ref:`bdr.conflict_history ` that allows this role to read the ``bdr.conflict_history`` table.