PGD predefined roles ==================== PGD predefined roles are created when the BDR extension is installed. After BDR extension is dropped from a database, the roles continue to exist. You need to drop them manually if dropping is required. bdr_superuser ^^^^^^^^^^^^^ This role is for an admin user that can manage anything PGD related. It allows you to separate management of the database and table access. Using it allows you to have a user that can manage the PGD cluster without giving them PostgreSQL superuser privileges. Privileges ^^^^^^^^^^ - ALL PRIVILEGES ON ALL TABLES IN SCHEMA BDR - ALL PRIVILEGES ON ALL ROUTINES IN SCHEMA BDR bdr_read_all_stats ^^^^^^^^^^^^^^^^^^ This role provides read access to most of the tables, views, and functions that users or applications may need to observe the statistics and state of the PGD cluster. .. _privileges-1: Privileges ^^^^^^^^^^ ``SELECT`` privilege on: - :: `bdr.autopartition_partitions `_ - :: `bdr.autopartition_rules `_ - :: `bdr.ddl_epoch `_ - :: `bdr.ddl_replication `_ - :: `bdr.global_consensus_journal_details `_ - :: `bdr.global_lock `_ - :: `bdr.global_locks `_ - :: `bdr.group_camo_details `_ - :: `bdr.local_consensus_state `_ - :: `bdr.local_node_summary `_ - :: `bdr.node `_ - :: `bdr.node_catchup_info `_ - :: `bdr.node_catchup_info_details `_ - :: `bdr.node_conflict_resolvers `_ - :: `bdr.node_group `_ - :: `bdr.node_local_info `_ - :: `bdr.node_peer_progress `_ - :: `bdr.node_replication_rates `_ - :: `bdr.node_slots `_ - :: `bdr.node_summary `_ - :: `bdr.replication_sets `_ - ``bdr.replication_status`` - :: `bdr.sequences `_ - :: `bdr.stat_activity `_ - :: `bdr.stat_relation `_ - :: `bdr.stat_subscription `_ _deprecated_ - :: `bdr.state_journal_details `_ - :: `bdr.subscription `_ - :: `bdr.subscription_summary `_ - :: `bdr.tables `_ - :: `bdr.taskmgr_local_work_queue `_ - :: `bdr.taskmgr_work_queue `_ - :: `bdr.worker_errors `_ _deprecated_ - :: `bdr.workers `_ - :: `bdr.writers `_ - :: `bdr.xid_peer_progress` EXECUTE privilege on: - :: `bdr.bdr_edition` _deprecated_ - :: `bdr.bdr_version `_ - :: `bdr.bdr_version_num `_ - :: `bdr.decode_message_payload `_ - :: `bdr.get_consensus_status `_ - :: `bdr.get_decoding_worker_stat `_ - :: `bdr.get_global_locks `_ - :: `bdr.get_min_required_replication_slots `_ - :: `bdr.get_min_required_worker_processes `_ - :: `bdr.get_raft_status `_ - :: `bdr.get_relation_stats `_ - :: `bdr.get_slot_flush_timestamp `_ - :: `bdr.get_sub_progress_timestamp` - :: `bdr.get_subscription_stats `_ - :: `bdr.lag_control `_ - :: `bdr.lag_history `_ - :: `bdr.node_catchup_state_name `_ - :: `bdr.node_kind_name `_ - :: `bdr.peer_state_name `_ - :: `bdr.show_subscription_status `_ - :: `bdr.show_workers `_ - :: `bdr.show_writers `_ - :: `bdr.stat_get_activity `_ - :: `bdr.wal_sender_stats `_ - :: `bdr.worker_role_id_name `_ bdr_monitor ^^^^^^^^^^^ This role provides read access to any tables, views, and functions that users or applications may need to monitor the PGD cluster. It includes all the privileges of the :ref:`bdr_read_all_stats ` role. .. _privileges-2: Privileges ^^^^^^^^^^ All privileges from :ref:`bdr_read_all_stats ` plus the following additional privileges: ``SELECT`` privilege on: - :: `bdr.group_raft_details `_ - :: `bdr.group_replslots_details `_ - :: `bdr.group_subscription_summary `_ - :: `bdr.group_versions_details `_ - :: `bdr.raft_instances` ``EXECUTE`` privilege on: - :: `bdr.get_raft_instance_by_nodegroup `_ - :: `bdr.monitor_camo_on_all_nodes `_ - :: `bdr.monitor_group_raft `_ - :: `bdr.monitor_group_versions `_ - :: `bdr.monitor_local_replslots `_ - :: `bdr.monitor_raft_details_on_all_nodes `_ - :: `bdr.monitor_replslots_details_on_all_nodes `_ - :: `bdr.monitor_subscription_details_on_all_nodes `_ - :: `bdr.monitor_version_details_on_all_nodes `_ - :: `bdr.node_group_member_info `_ bdr_application ^^^^^^^^^^^^^^^ This role is designed for applications that require access to PGD features, objects, and functions such as sequences, CRDT datatypes, CAMO status functions, or trigger management functions. .. _privileges-3: Privileges ^^^^^^^^^^ ``EXECUTE`` privilege on: - All functions for column_timestamps datatypes - All functions for CRDT datatypes - :: `bdr.alter_sequence_set_kind `_ - :: `bdr.create_conflict_trigger `_ - :: `bdr.create_transform_trigger `_ - :: `bdr.drop_trigger `_ - :: `bdr.get_configured_camo_partner `_ - :: `bdr.global_lock_table `_ - :: `bdr.is_camo_partner_connected `_ - :: `bdr.is_camo_partner_ready `_ - :: `bdr.logical_transaction_status `_ - ``bdr.ri_fkey_trigger`` - :: `bdr.seq_nextval `_ - :: `bdr.seq_currval `_ - :: `bdr.seq_lastval `_ - :: `bdr.trigger_get_committs `_ - :: `bdr.trigger_get_conflict_type `_ - :: `bdr.trigger_get_origin_node_id `_ - :: `bdr.trigger_get_row `_ - :: `bdr.trigger_get_type `_ - :: `bdr.trigger_get_xid `_ - :: `bdr.wait_for_camo_partner_queue `_ - :: `bdr.wait_slot_confirm_lsn `_ - :: `bdr.wait_node_confirm_lsn `_ Many of these functions require additional privileges before you can use them. For example, you must be the table owner to successfully execute ``bdr.alter_sequence_set_kind`` . These additional rules are described with each specific function. bdr_read_all_conflicts ^^^^^^^^^^^^^^^^^^^^^^ PGD logs conflicts into the `bdr.conflict_history `_ table. Conflicts are visible only to table owners, so no extra privileges are required for the owners to read the conflict history. However, if it’s useful to have a user that can see conflicts for all tables, you can optionally grant the role ``bdr_read_all_conflicts`` to that user. .. _privileges-4: Privileges ^^^^^^^^^^ An explicit policy is set on `bdr.conflict_history `_ that allows this role to read the ``bdr.conflict_history`` table.