f05ef49c69
Admit vergabe_demo_company as the third declared consumer, track the bounded provisioner and scoped controls, and refresh admission occupancy to 3/3. Overflow remains apps-pg-2 before any fourth. Assistant: grok Assistant-Session: 01a0a23b-3bf0-7341-b4e5-9dc05f72573a
17 lines
1.1 KiB
SQL
17 lines
1.1 KiB
SQL
-- Idempotent controls not expressible in the installed CNPG managed.roles CRD.
|
|
-- Apply as the controlled apps-pg cluster administrator only after notifying
|
|
-- bound consumers of the published limits in docs/s3-consumer-interfaces.md.
|
|
-- The third consumer is scoped separately in helm/vergabe-demo-company-controls.sql;
|
|
-- do not reuse this historical file to onboard it.
|
|
ALTER ROLE vergabe SET statement_timeout = '15s';
|
|
ALTER ROLE vergabe SET idle_in_transaction_session_timeout = '15s';
|
|
ALTER ROLE coulomb_social SET statement_timeout = '15s';
|
|
ALTER ROLE coulomb_social SET idle_in_transaction_session_timeout = '15s';
|
|
|
|
-- PostgreSQL grants CONNECT and TEMPORARY to PUBLIC by default. A database per
|
|
-- consumer is not an isolation boundary until those defaults are removed.
|
|
REVOKE CONNECT, TEMPORARY ON DATABASE apps_meta FROM PUBLIC;
|
|
REVOKE CONNECT, TEMPORARY ON DATABASE vergabe_db FROM PUBLIC;
|
|
REVOKE CONNECT, TEMPORARY ON DATABASE coulomb_social_db FROM PUBLIC;
|
|
GRANT CONNECT, TEMPORARY ON DATABASE vergabe_db TO vergabe;
|
|
GRANT CONNECT, TEMPORARY ON DATABASE coulomb_social_db TO coulomb_social;
|