Grant read access to postgres_exporter

Production Change

Change Summary

We're expanding integer capacity monitoring in postgres-exporter with gitlab-cookbooks/gitlab-exporters!246 (merged). The PG user for the exporter doesn't have read access to some of those tables.

In this change, we grant SELECT permissions to postgres_exporter for one table that is missing this grant. A similar change for reference has been #3167 (closed).

Change Details

  1. Services Impacted - ServicePostgres
  2. Change Technician - @abrandl
  3. Change Reviewer - @nnelson
  4. Time tracking - 1
  5. Downtime Component - none

Detailed steps for the change

Change Steps - steps to take to execute the change

Estimated Time to Complete (mins) - 1

Run on primary:

GRANT SELECT ON TABLE ci_build_needs TO postgres_exporter;

Post-Change Steps - steps to take to verify the change

On a patroni host, log into psql and check that this does not result in a permissions error:

SET ROLE postgres_exporter;

    SELECT 'sent_notifications' as table_name, 'id' as column_name, max(id) as current, (select (2^(numeric_precision-1)-1) as maximum FROM information_schema.columns WHERE (table_name, column_name) = ('sent_notifications', 'id')) FROM sent_notifications
      UNION ALL
    SELECT 'notes', 'id', max(id), (select (2^(numeric_precision-1)-1) FROM information_schema.columns WHERE (table_name, column_name) = ('notes', 'id')) FROM notes
      UNION ALL
    SELECT 'system_note_metadata', 'id', max(id), (select (2^(numeric_precision-1)-1) FROM information_schema.columns WHERE (table_name, column_name) = ('system_note_metadata', 'id')) FROM system_note_metadata
      UNION ALL
    SELECT 'ci_pipelines', 'id', max(id), (select (2^(numeric_precision-1)-1) FROM information_schema.columns WHERE (table_name, column_name) = ('ci_pipelines', 'id')) FROM ci_pipelines
      UNION ALL
    SELECT 'ci_build_needs', 'id', max(id), (select (2^(numeric_precision-1)-1) FROM information_schema.columns WHERE (table_name, column_name) = ('ci_build_needs', 'id')) FROM ci_build_needs
      UNION ALL
    SELECT 'merge_request_diffs', 'id', max(id), (select (2^(numeric_precision-1)-1) FROM information_schema.columns WHERE (table_name, column_name) = ('merge_request_diffs', 'id')) FROM merge_request_diffs
      UNION ALL
    SELECT 'ci_pipeline_variables', 'id', max(id), (select (2^(numeric_precision-1)-1) FROM information_schema.columns WHERE (table_name, column_name) = ('ci_pipeline_variables', 'id')) FROM ci_pipeline_variables
      UNION ALL
    SELECT 'merge_request_metrics', 'id', max(id), (select (2^(numeric_precision-1)-1) FROM information_schema.columns WHERE (table_name, column_name) = ('merge_request_metrics', 'id')) FROM merge_request_metrics
      UNION ALL
    SELECT 'deployments', 'id', max(id), (select (2^(numeric_precision-1)-1) FROM information_schema.columns WHERE (table_name, column_name) = ('deployments', 'id')) FROM deployments

Rollback

Rollback steps - steps to be taken in the event of a need to rollback this change

REVOKE SELECT ON TABLE ci_build_needs FROM postgres_exporter;

Change Reviewer checklist

C4 C3 C2 C1:

  • The scheduled day and time of execution of the change is appropriate.
  • The change plan is technically accurate.
  • The change plan includes estimated timing values based on previous testing.
  • The change plan includes a viable rollback plan.
  • The specified metrics/monitoring dashboards provide sufficient visibility for the change.

C2 C1:

  • The complexity of the plan is appropriate for the corresponding risk of the change. (i.e. the plan contains clear details).
  • The change plan includes success measures for all steps/milestones during the execution.
  • The change adequately minimizes risk within the environment/service.
  • The performance implications of executing the change are well-understood and documented.
  • The specified metrics/monitoring dashboards provide sufficient visibility for the change. - If not, is it possible (or necessary) to make changes to observability platforms for added visibility?
  • The change has a primary and secondary SRE with knowledge of the details available during the change window.

Change Technician checklist

  • This issue has a criticality label (e.g. C1, C2, C3, C4) and a change-type label (e.g. changeunscheduled, changescheduled) based on the Change Management Criticalities.
  • This issue has the change technician as the assignee.
  • Pre-Change, Change, Post-Change, and Rollback steps and have been filled out and reviewed.
  • This Change Issue is linked to the appropriate Issue and/or Epic
  • Necessary approvals have been completed based on the Change Management Workflow.
  • Change has been tested in staging and results noted in a comment on this issue.
  • A dry-run has been conducted and results noted in a comment on this issue.
  • SRE on-call has been informed prior to change being rolled out. (In #production channel, mention @sre-oncall and this issue and await their acknowledgement.)
  • Release managers have been informed (If needed! Cases include DB change) prior to change being rolled out. (In #production channel, mention @release-managers and this issue and await their acknowledgment.)
  • There are currently no active incidents.
Edited by Andreas Brandl