sql, server: regulate access to remaining observability features #85769
Conversation
|
This change is |
Santamaura
force-pushed
the
sys-priv-gating-obs
branch
from
ad69afa
to
2508ae8
Compare
Santamaura
changed the title
Santamaura
force-pushed
the
sys-priv-gating-obs
branch
2 times, most recently
from
877f665
to
a2bab72
Compare
There was a problem hiding this comment.
Nice! LGTM modulo updating the release note
Reviewed 8 of 9 files at r1, all commit messages.
Reviewable status:complete! 0 of 0 LGTMs obtained (waiting on @koorosh, @Santamaura, and @zachlite)
-- commits line 4 at r1:
This should be moved into the release note so docs can write about the new requirements
pkg/server/admin_test.go line 393 at r1 (raw file):
query = fmt.Sprintf( "GRANT SYSTEM %s TO %s", strings.Join(sysPrivileges, ", "),
Don't need to join here
Santamaura
force-pushed
the
sys-priv-gating-obs
branch
from
a2bab72
to
bfc2497
Compare
There was a problem hiding this comment.
TFTR!
Reviewable status:
Previously, RichardJCai (Richard Cai) wrote…
This should be moved into the release note so docs can write about the new requirements
Ok, I have added the details to the release note.
pkg/server/admin_test.go line 393 at r1 (raw file):
Previously, RichardJCai (Richard Cai) wrote…
Don't need to join here
Done
This change will control access to various observability features based on system privileges including the following: - admin ui databases/tables/schema endpoints requires admin or VIEWACTIVITY - EXPERIMENTAL_AUDIT requires admin or MODIFYCLUSTERSETTING - sql login requires not having NOSQLLOGIN or the equivalent role option Resolves: cockroachdb#83848, cockroachdb#83863, cockroachdb#83862 Release note (security update): Change requirements to access some observability features. Databases/tables/schema endpoints for admin ui require admin or VIEWACTIVITY. EXPERIMENTAL_AUDIT requires admin or MODIFYCLUSTERSETTING. SQL login requires not having NOSQLLOGIN or the equivalent role option.
Santamaura
force-pushed
the
sys-priv-gating-obs
branch
from
bfc2497
to
9e5c7a0
Compare
|
bors r+ |
|
Build succeeded: |
This change will control access to various observability
features based on system privileges including the following:
role option
Resolves: #83848, #83863, #83862
Release note (security update): Change requirements to access some
observability features. Databases/tables/schema endpoints for
admin ui require admin or VIEWACTIVITY. EXPERIMENTAL_AUDIT
requires admin or MODIFYCLUSTERSETTING. SQL login requires not
having NOSQLLOGIN or the equivalent role option.