PGD predefined roles v5
PGD predefined roles are created when the BDR extension is installed. After BDR extension is dropped from a database, the roles continue to exist. You need to drop them manually if dropping is required. This practice allows PGD to be used in multiple databases on the same PostgreSQL instance without problem.
bdr_superuser
- ALL PRIVILEGES ON ALL TABLES IN SCHEMA BDR
- ALL PRIVILEGES ON ALL ROUTINES IN SCHEMA BDR
bdr_read_all_stats
SELECT privilege on:
bdr.autopartition_partitionsbdr.autopartition_rulesbdr.ddl_epochbdr.ddl_replicationbdr.global_consensus_journal_detailsbdr.global_lockbdr.global_locksbdr.group_camo_detailsbdr.local_consensus_statebdr.local_node_summarybdr.nodebdr.node_catchup_infobdr.node_catchup_info_detailsbdr.node_conflict_resolversbdr.node_groupbdr.node_local_infobdr.node_peer_progressbdr.node_replication_ratesbdr.node_slotsbdr.node_summarybdr.replication_setsbdr.replication_statusbdr.sequencesbdr.stat_activitybdr.stat_relationbdr.stat_subscriptiondeprecatedbdr.state_journal_detailsbdr.subscriptionbdr.subscription_summarybdr.tablesbdr.taskmgr_local_work_queuebdr.taskmgr_work_queuebdr.worker_errorsdeprecatedbdr.workersbdr.writersbdr.xid_peer_progress
EXECUTE privilege on:
bdr.bdr_editiondeprecatedbdr.bdr_versionbdr.bdr_version_numbdr.decode_message_payloadbdr.get_consensus_statusbdr.get_decoding_worker_statbdr.get_global_locksbdr.get_min_required_replication_slotsbdr.get_min_required_worker_processesbdr.get_raft_statusbdr.get_relation_statsbdr.get_slot_flush_timestampbdr.get_sub_progress_timestampbdr.get_subscription_statsbdr.lag_controlbdr.lag_historybdr.node_catchup_state_namebdr.node_kind_namebdr.peer_state_namebdr.pglogical_proto_version_rangesbdr.show_subscription_statusbdr.show_workersbdr.show_writersbdr.stat_get_activitybdr.wal_sender_statsbdr.worker_role_id_name
bdr_monitor
All privileges from bdr_read_all_stats.
Also, SELECT privilege on:
bdr.group_raft_detailsbdr.group_replslots_detailsbdr.group_subscription_summarybdr.group_versions_detailsbdr.raft_instances
Also, EXECUTE privilege on:
bdr.get_raft_instance_by_nodegroupbdr.monitor_camo_on_all_nodesbdr.monitor_group_raftbdr.monitor_group_versionsbdr.monitor_local_replslotsbdr.monitor_raft_details_on_all_nodesbdr.monitor_replslots_details_on_all_nodesbdr.monitor_subscription_details_on_all_nodesbdr.monitor_version_details_on_all_nodesbdr.node_group_member_info
bdr_application
EXECUTE privilege on:
- All functions for column_timestamps datatypes
- All functions for CRDT datatypes
bdr.alter_sequence_set_kindbdr.create_conflict_triggerbdr.create_transform_triggerbdr.drop_triggerbdr.get_configured_camo_partnerbdr.global_lock_tablebdr.is_camo_partner_connectedbdr.is_camo_partner_readybdr.logical_transaction_statusbdr.ri_fkey_triggerbdr.seq_nextvalbdr.seq_currvalbdr.seq_lastvalbdr.trigger_get_committsbdr.trigger_get_conflict_typebdr.trigger_get_origin_node_idbdr.trigger_get_rowbdr.trigger_get_typebdr.trigger_get_xidbdr.wait_for_camo_partner_queuebdr.wait_slot_confirm_lsn
Many of these functions require additional privileges before you can use them.
For example, you must be the table owner to successfully execute
bdr.alter_sequence_set_kind. These additional rules are described with each
specific function.
bdr_read_all_conflicts
PGD logs conflicts into the
bdr.conflict_history
table. Conflicts are visible only to table owners, so no extra privileges are
required to read the conflict history. If it's useful to have a user that can
see conflicts for all tables, you can optionally grant the role
bdr_read_all_conflicts to that user.