Ctrl+K

PGD predefined roles

PGD predefined roles#

PGD predefined roles are created when the BDR extension is installed. After BDR extension is dropped from a database, the roles continue to exist. You need to drop them manually if dropping is required.

bdr_superuser#

This is a role for an admin user that can manage anything PGD related. It allows you to separate management of the database and table access. Using it allows you to have a user that can manage the PGD cluster without giving them PostgreSQL superuser privileges.

Privileges#

  • ALL PRIVILEGES ON ALL TABLES IN SCHEMA BDR

  • ALL PRIVILEGES ON ALL ROUTINES IN SCHEMA BDR

bdr_read_all_stats#

This role provides read access to most of the tables, views, and functions that users or applications may need to observe the statistics and state of the PGD cluster.

Privileges#

SELECT privilege on:

EXECUTE privilege on:

bdr_monitor#

This role provides read access to any tables, views, and functions that users or applications may need to monitor the PGD cluster. It includes all the privileges of the bdr_read_all_stats role.

Privileges#

All privileges from bdr_read_all_stats plus the following additional privileges:

SELECT privilege on:

EXECUTE privilege on:

bdr_application#

This role is designed for applications that require access to PGD features, objects, and functions such as sequences, CRDT datatypes, CAMO status functions, or trigger management functions.

Privileges#

EXECUTE privilege on:

Many of these functions require additional privileges before you can use them. For example, you must be the table owner to successfully execute bdr.alter_sequence_set_kind . These additional rules are described with each specific function.

bdr_read_all_conflicts#

PGD logs conflicts into the bdr.conflict_history

table. Conflicts are visible only to table owners, so no extra privileges are required for the owners to read the conflict history.

If, though, it’s useful to have a user that can see conflicts for all tables, you can optionally grant the role bdr_read_all_conflicts to that user.

Privileges#

An explicit policy is set on bdr.conflict_history that allows this role to read the bdr.conflict_history table.

Contents