feat(postgresrole): support REASSIGN OWNED BY on deletion

cryptobioz · cryptobioz · commit 49a425ccad30 · 2026-03-31T20:11:27.000+02:00
diff --git a/api/v1alpha1/postgresrole_types.go b/api/v1alpha1/postgresrole_types.go
@@ -27,6 +27,10 @@ type PostgresRolePasswordFromSecret struct {
 	Key string `json:"key"`
 }
 
+type PostgresRoleOnDelete struct {
+	ReassignOwnedTo string `json:"reassignOwnedTo,omitempty"`
+}
+
 // PostgresRoleSpec defines the desired state of PostgresRole.
 type PostgresRoleSpec struct {
 	// PostgreSQL role name
@@ -50,6 +54,8 @@ type PostgresRoleSpec struct {
 	SecretTemplate     map[string]string               `json:"secretTemplate,omitempty"`
 
 	MemberOfRoles []string `json:"memberOfRoles,omitempty"`
+
+	OnDelete *PostgresRoleOnDelete `json:"onDelete,omitempty"`
 }
 
 // PostgresRoleStatus defines the observed state of PostgresRole.
diff --git a/api/v1alpha1/zz_generated.deepcopy.go b/api/v1alpha1/zz_generated.deepcopy.go
diff --git a/deploy/crds/managed-postgres-operator.hoppscale.com_postgresroles.yaml b/deploy/crds/managed-postgres-operator.hoppscale.com_postgresroles.yaml
@@ -63,6 +63,11 @@ spec:
                 x-kubernetes-validations:
                 - message: name is immutable
                   rule: self == oldSelf
+              onDelete:
+                properties:
+                  reassignOwnedTo:
+                    type: string
+                type: object
               passwordFromSecret:
                 properties:
                   key:
diff --git a/internal/controller/postgresrole_controller.go b/internal/controller/postgresrole_controller.go
@@ -144,7 +144,7 @@ func (r *PostgresRoleReconciler) Reconcile(ctx context.Context, req ctrl.Request
 			return r.Result(nil)
 		}
 
-		err = r.reconcileOnDeletion(existingRole, resource.Spec.KeepOnDelete)
+		err = r.reconcileOnDeletion(existingRole, resource.Spec.KeepOnDelete, resource.Spec.OnDelete)
 		if err != nil {
 			return r.Result(err)
 		}
@@ -217,16 +217,38 @@ func (r *PostgresRoleReconciler) Result(err error) (ctrl.Result, error) {
 }
 
 // reconcileOnDeletion performs all actions related to deleting the resource
-func (r *PostgresRoleReconciler) reconcileOnDeletion(existingRole *postgresql.Role, keepOnDelete bool) (err error) {
+func (r *PostgresRoleReconciler) reconcileOnDeletion(existingRole *postgresql.Role, keepOnDelete bool, onDeleteOptions *managedpostgresoperatorhoppscalecomv1alpha1.PostgresRoleOnDelete) (err error) {
 	if existingRole == nil {
 		r.logging.Info("Role doesn't exist, skipping DROP ROLE")
-		return
+		return nil
 	}
 
 	if keepOnDelete {
 		// If the resource is configured to keep the remote role on delete
 		r.logging.Info("keepOnDelete is true, skipping DROP ROLE")
-		return
+		return nil
+	}
+
+	if onDeleteOptions != nil {
+		if onDeleteOptions.ReassignOwnedTo != "" {
+			databases, err := postgresql.ListDatabases(r.PGPools.Default)
+			if err != nil {
+				return fmt.Errorf("failed to list databases: %s", err)
+			}
+
+			for _, database := range databases {
+				err := postgresql.EnsurePGPoolExists(r.PGPools, database)
+				if err != nil {
+					return fmt.Errorf("failed to open pg pool: %s", err)
+				}
+
+				err = postgresql.ReassignOwnedToRole(r.PGPools.Databases[database], existingRole.Name, onDeleteOptions.ReassignOwnedTo)
+				if err != nil {
+					return fmt.Errorf("failed to reassign owned objects in database before deletion: %s", err)
+				}
+			}
+			r.logging.Info(fmt.Sprintf("Objects owned by '%s' have been reassigned to '%s'", existingRole.Name, onDeleteOptions.ReassignOwnedTo))
+		}
 	}
 
 	err = postgresql.DropRole(r.PGPools.Default, existingRole.Name)
@@ -236,7 +258,7 @@ func (r *PostgresRoleReconciler) reconcileOnDeletion(existingRole *postgresql.Ro
 
 	r.logging.Info("Role has been deleted")
 
-	return
+	return nil
 }
 
 // reconcileOnCreation performs all actions related to creating the resource
diff --git a/internal/controller/postgresrole_controller_test.go b/internal/controller/postgresrole_controller_test.go
@@ -867,6 +867,7 @@ var _ = Describe("PostgresRole Controller", func() {
 			When("no role exists", func() {
 				It("should return immediately", func() {
 					var existingRole *postgresql.Role
+					var onDeleteOptions *managedpostgresoperatorhoppscalecomv1alpha1.PostgresRoleOnDelete
 
 					controllerReconciler := &PostgresRoleReconciler{
 						Client:             k8sClient,
@@ -875,7 +876,7 @@ var _ = Describe("PostgresRole Controller", func() {
 						CacheRolePasswords: map[string]string{},
 					}
 
-					err := controllerReconciler.reconcileOnDeletion(existingRole, false)
+					err := controllerReconciler.reconcileOnDeletion(existingRole, false, onDeleteOptions)
 					Expect(err).NotTo(HaveOccurred())
 					for _, poolMock := range pgpoolsMock {
 						if err := poolMock.ExpectationsWereMet(); err != nil {
@@ -884,6 +885,95 @@ var _ = Describe("PostgresRole Controller", func() {
 					}
 				})
 			})
+
+			When("reassignOwnedTo is configured", func() {
+				It("reassign owned objects before deletion", func() {
+					existingRole := &postgresql.Role{
+						Name: "myrole",
+					}
+					onDeleteOptions := &managedpostgresoperatorhoppscalecomv1alpha1.PostgresRoleOnDelete{
+						ReassignOwnedTo: "myrolebis",
+					}
+
+					databases := []string{
+						"postgres",
+						"foo",
+					}
+
+					for _, database := range databases {
+						mock, err := pgxmock.NewPool()
+						if err != nil {
+							Fail(err.Error())
+						}
+						pgpoolsMock[database] = mock
+						pgpools.Databases[database] = pgpoolsMock[database]
+					}
+
+					/*
+						pgpoolsMock["default"].ExpectQuery(fmt.Sprintf("^%s$", regexp.QuoteMeta(postgresql.GetRoleSQLStatement))).
+							WithArgs("myrole").
+							WillReturnRows(
+								pgxmock.NewRows([]string{
+									"rolname",
+									"rolsuper",
+									"rolinherit",
+									"rolcreaterole",
+									"rolcreatedb",
+									"rolcanlogin",
+									"rolreplication",
+									"rolbypassrls",
+								}).
+									AddRow(
+										"myrole",
+										false,
+										false,
+										true,
+										true,
+										false,
+										false,
+										false,
+									),
+							)
+					*/
+
+					pgpoolsMock["default"].ExpectQuery(fmt.Sprintf("^%s$", regexp.QuoteMeta("SELECT datname FROM pg_database WHERE datistemplate = false"))).
+						WillReturnRows(
+							pgxmock.NewRows([]string{
+								"datname",
+							}).
+								AddRow(
+									"postgres",
+								).
+								AddRow(
+									"foo",
+								),
+						)
+
+					for _, database := range databases {
+						pgpoolsMock[database].ExpectExec(fmt.Sprintf("^%s$", regexp.QuoteMeta(`REASSIGN OWNED BY "myrole" TO "myrolebis"`))).
+							WillReturnResult(pgxmock.NewResult("REASSIGN OWNED", 1))
+					}
+
+					pgpoolsMock["default"].ExpectExec(fmt.Sprintf("^%s$", regexp.QuoteMeta(`DROP ROLE "myrole"`))).
+						WillReturnResult(pgxmock.NewResult("DROP ROLE", 1))
+
+					controllerReconciler := &PostgresRoleReconciler{
+						Client:             k8sClient,
+						Scheme:             k8sClient.Scheme(),
+						PGPools:            pgpools,
+						CacheRolePasswords: map[string]string{},
+					}
+
+					err := controllerReconciler.reconcileOnDeletion(existingRole, false, onDeleteOptions)
+					Expect(err).NotTo(HaveOccurred())
+					for _, poolMock := range pgpoolsMock {
+						if err := poolMock.ExpectationsWereMet(); err != nil {
+							Fail(err.Error())
+						}
+					}
+				})
+			})
+
 		})
 	})
 })
diff --git a/internal/postgresql/database.go b/internal/postgresql/database.go
@@ -171,3 +171,20 @@ func RevokeDatabaseRolePrivilege(pgpool PGPoolInterface, database, role, privile
 
 	return
 }
+
+func ListDatabases(pgpool PGPoolInterface) (databases []string, err error) {
+	rows, err := pgpool.Query(context.Background(), "SELECT datname FROM pg_database WHERE datistemplate = false")
+	if err != nil {
+		err = fmt.Errorf("pg query failed: %s", err)
+		return
+	}
+	defer rows.Close()
+
+	databases, err = pgx.CollectRows(rows, pgx.RowTo[string])
+	if err != nil {
+		err = fmt.Errorf("failed to collect rows: %s", err)
+		return
+	}
+
+	return
+}
diff --git a/internal/postgresql/database_test.go b/internal/postgresql/database_test.go
@@ -481,4 +481,43 @@ var _ = Describe("PostgreSQL Database", func() {
 
 	})
 
+	Context("Calling ListDatabases", func() {
+		It("should return a list of databases without templates", func() {
+			pgpoolMock.ExpectQuery(fmt.Sprintf("^%s$", regexp.QuoteMeta(`SELECT datname FROM pg_database WHERE datistemplate = false`))).
+				WillReturnRows(
+					pgxmock.NewRows([]string{
+						"datname",
+					}).
+						AddRow(
+							"foo",
+						).
+						AddRow(
+							"postgres",
+						),
+				)
+
+			databases, err := ListDatabases(pgpool)
+
+			Expect(err).NotTo(HaveOccurred())
+			Expect(databases).To(Equal([]string{"foo", "postgres"}))
+			if err := pgpoolMock.ExpectationsWereMet(); err != nil {
+				Fail(err.Error())
+			}
+		})
+
+		It("should return an error if the PostgreSQL request failed", func() {
+			pgpoolMock.ExpectQuery(fmt.Sprintf("^%s$", regexp.QuoteMeta(`SELECT datname FROM pg_database WHERE datistemplate = false`))).
+				WillReturnError(fmt.Errorf("fake error from PostgreSQL"))
+
+			databases, err := ListDatabases(pgpool)
+
+			Expect(err).To(HaveOccurred())
+			Expect(databases).To(BeEmpty())
+			if err := pgpoolMock.ExpectationsWereMet(); err != nil {
+				Fail(err.Error())
+			}
+		})
+
+	})
+
 })
diff --git a/internal/postgresql/role.go b/internal/postgresql/role.go
@@ -195,3 +195,15 @@ func AlterRole(pgpool PGPoolInterface, operatorRole, existingRole, desiredRole *
 	}
 	return
 }
+
+func ReassignOwnedToRole(pgpool PGPoolInterface, oldRole, newRole string) (err error) {
+	sanitizedOldRoleName := pgx.Identifier{oldRole}.Sanitize()
+	sanitizedNewRoleName := pgx.Identifier{newRole}.Sanitize()
+
+	_, err = pgpool.Exec(context.Background(), fmt.Sprintf("REASSIGN OWNED BY %s TO %s", sanitizedOldRoleName, sanitizedNewRoleName))
+	if err != nil {
+		err = fmt.Errorf("pg exec failed: %s", err)
+		return
+	}
+	return
+}
diff --git a/internal/postgresql/role_test.go b/internal/postgresql/role_test.go
@@ -422,4 +422,30 @@ var _ = Describe("PostgreSQL Role", func() {
 			})
 		})
 	})
+
+	Context("Calling ReassignOwnedToRole", func() {
+		It("should reassign owned objects to a new role", func() {
+			pgpoolMock.ExpectExec(fmt.Sprintf("^%s$", regexp.QuoteMeta(`REASSIGN OWNED BY "foo" TO "bar"`))).
+				WillReturnResult(pgxmock.NewResult("bar", 1))
+
+			err := ReassignOwnedToRole(pgpool, "foo", "bar")
+
+			Expect(err).NotTo(HaveOccurred())
+			if err := pgpoolMock.ExpectationsWereMet(); err != nil {
+				Fail(err.Error())
+			}
+		})
+		It("should return an error if the PostgreSQL request failed", func() {
+			pgpoolMock.ExpectExec(fmt.Sprintf("^%s$", regexp.QuoteMeta(`REASSIGN OWNED BY "foo" TO "bar"`))).
+				WillReturnError(fmt.Errorf("fake error from PostgreSQL"))
+
+			err := ReassignOwnedToRole(pgpool, "foo", "bar")
+
+			Expect(err).To(HaveOccurred())
+			if err := pgpoolMock.ExpectationsWereMet(); err != nil {
+				Fail(err.Error())
+			}
+		})
+	})
+
 })
