Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Full Teardown fails - "user not permitted to log in" #153

Closed
vjeeva opened this issue Jan 4, 2023 · 3 comments
Closed

Full Teardown fails - "user not permitted to log in" #153

vjeeva opened this issue Jan 4, 2023 · 3 comments

Comments

@vjeeva
Copy link
Contributor

vjeeva commented Jan 4, 2023

Describe the bug
The teardown --full function fails to run to completion because the command tries to run things on the source database with a user that has LOGIN revoked. This occurs after pgbelt is used for a migration, so users on the source DB have login revoked.

To Reproduce
Steps to reproduce the behavior:

  1. Run a pgbelt migration with a cutover (using revoke-logins to ensure traffic has stopped on the source database)
  2. After the migration is complete, run teardown --full.

Expected behavior
Must fully tear down replication, the extension, deleting the pglogical user, etc.

@vjeeva
Copy link
Contributor Author

vjeeva commented May 8, 2023

The issue is here: https://github.com/Autodesk/pgbelt/blob/main/pgbelt/cmd/teardown.py#L90-L91

Those revokes need to be run by the schema owners of both databases (which have their logins revoked).

ALTERs are idempotent so we could ALTER WITH LOGIN before those lines. Removing login again after those lines should depend on in revoke-logins was run in the first place.

Maybe we can just ALTER WITH LOGIN for now, no need to really revoke that later anyways since teardown would occur well after the migration is complete.

@vjeeva
Copy link
Contributor Author

vjeeva commented May 9, 2023

Wow I forgot we wrote a restore-logins command. We should run that before teardown --full and should be fine.

@vjeeva
Copy link
Contributor Author

vjeeva commented Oct 6, 2023

We can run the REVOKEs as admin, solves the issue much easier.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant