Offline access control

[Vonng]

Scenario

In real world production environment, It is common requirements that running some ETL process / Interactive Queries / SAGA on OLTP databases.

It is highly recommended to run that shit on dedicate instance (which may named offline) to avoid undesired side-effect on entire cluster.

Thus, we need a mechanism to MARK a specific instance for that purpose. and a new default role to MARK users with that sort of needs.

Proposal

We may introduce a new default role dbrole_offline which have same privilege as dbrole_readonly but is not a member of dbrole_readonly. It will be granted to ETL/SAGA/Interactive users.

And members of dbrole_offline will only be allowed by hba on instances with pg_role = offline or variable pg_offline_query = true.

[Vonng]

Resolved by 0683622