teleo/teleo-infrastructure
8
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions 1

Fix Cloud SQL staging-function provisioning order

Browse source 
Cloud SQL's postgres role is cloudsqlsuperuser, not a true superuser.
After ALTER FUNCTION ... OWNER TO leoclean_kb_stage_owner, it can no
longer revoke ACLs on the transferred function:

  ERROR: permission denied for function stage_leoclean_proposal

Reorder so ACL normalization and the runtime GRANT happen while postgres
still owns the function, then transfer ownership. Identical end state.

Observed on teleo-pgvector-standby during M2 Step 4 provisioning
(BOOTSTRAP_EXIT=3 at SQL line 800).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This commit is contained in:
fwazb 2026-07-23 22:41:24 -07:00
parent 5d9eefb8a0
commit eece69cd70
1 changed files with 6 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
ops/gcp_leoclean_runtime_role.sql
View file

@ -799,15 +799,11 @@ begin
end end
$function$; $function$;
alter function kb_stage.stage_leoclean_proposal(text, text, text, text, jsonb)
owner to leoclean_kb_stage_owner;
revoke create on schema kb_stage from leoclean_kb_stage_owner;
-- Normalize explicit ACL entries left by CREATE OR REPLACE or an earlier grant. -- Normalize explicit ACL entries left by CREATE OR REPLACE or an earlier grant.
-- A newly-created function starts with owner EXECUTE, while CREATE OR REPLACE -- A newly-created function starts with owner EXECUTE, while CREATE OR REPLACE
-- preserves an existing ACL on reruns. Revoke every scoped/default entry here -- preserves an existing ACL on reruns. Revoke every scoped/default entry here
-- so the first successful provision already has the same runtime-only ACL as -- while postgres still owns the function, so Cloud SQL's cloudsqlsuperuser
-- every later provision. -- privilege is sufficient for the revoke.
revoke all on function kb_stage.stage_leoclean_proposal(text, text, text, text, jsonb) revoke all on function kb_stage.stage_leoclean_proposal(text, text, text, text, jsonb)
from public, leoclean_kb_runtime, leoclean_kb_stage_owner; from public, leoclean_kb_runtime, leoclean_kb_stage_owner;
select format( select format(
@ -828,6 +824,10 @@ select format(
grant execute on function kb_stage.stage_leoclean_proposal(text, text, text, text, jsonb) grant execute on function kb_stage.stage_leoclean_proposal(text, text, text, text, jsonb)
to leoclean_kb_runtime; to leoclean_kb_runtime;
alter function kb_stage.stage_leoclean_proposal(text, text, text, text, jsonb)
owner to leoclean_kb_stage_owner;
revoke create on schema kb_stage from leoclean_kb_stage_owner;
select format('revoke leoclean_kb_stage_owner from %I', current_user) select format('revoke leoclean_kb_stage_owner from %I', current_user)
where current_user <> 'leoclean_kb_stage_owner' where current_user <> 'leoclean_kb_stage_owner'
\gexec \gexec