[DPE-2167] Added admin extra user role

[marceloneppel]

Issue

There is no admin extra user role that can be requested by client application charms.

Solution

Add only read permissions to the special admin role. The permission to create anything in the public schema of the postgres database was removed.

Also add to it the permission to create and drop databases (except the system database postgres).

While reviewing, the following files can be ignored (they are generated):

• poetry.lock
• requirements.txt
• tests/integration/ha_tests/application-charm/requirements.txt
• tests/integration/new_relations/application-charm/requirements.txt

We disabled the hashes temporarily on all the requirements.txt files due to [canonical/charmcraft#1179] (so we can pack the charms now). I will be reverted later.

Fixes #192.

[dragomirp]

I think PGB is using superuser. We should change that to admin after this change.

[marceloneppel]

Good point. I reverted this part of the code as I realised that Landscape needs a superuser (for plpython extension, a requirement that may or may not be removed at some time, but also due to some schema changes that may happen in a landscape server upgrade).

[taurus-forever]

1. we should document this properly. JFMI, which extra_user_role used by pgbouncer?
2. re: plpython. We will have to hide it for now (c) Mohamed. Security concerns. This is why it was missing on mid-sync presentation. Mohamed will create a ticket to discuss and hide in documentation for now. No rush necessary today!

[marceloneppel]

PgBouncer currently uses SUPERUSER (to be able to create other superusers).

[taurus-forever]

Thank you!
What about to improve https://charmhub.io/postgresql-k8s/docs/e-users to expand "Relation/integration users" with description of extra_user_roles (internal and allowed o be used "admin". BTW, if no extra-user-roles requested, how do we call this "role"? :-) )

[delgod]

I would limit privs by read and write all databases.

Suggested change

	extra_user_roles="pg_read_all_data,pg_read_all_settings,pg_read_all_stats,pg_stat_scan_tables,pg_monitor,pg_signal_backend",
	extra_user_roles="pg_read_all_data,pg_write_all_data",

[marceloneppel]

Updated on 3b95919.

[marceloneppel]

Thank you! What about to improve https://charmhub.io/postgresql-k8s/docs/e-users to expand "Relation/integration users" with description of extra_user_roles (internal and allowed o be used "admin". BTW, if no extra-user-roles requested, how do we call this "role"? :-) )

Good suggestion. I added the following text to both https://discourse.charmhub.io/t/charmed-postgresql-k8s-explanations-users/10843 and https://discourse.charmhub.io/t/charmed-postgresql-explanations-users/10798:

When an application charm requests a new user through the relation/integration it can specify that the user should have the admin role in the extra_user_roles field. The admin role enables the new user to read and write to all databases (for the postgres system database it can only read data) and also to create and delete non-system databases.