Skip to content

Commit 1705a35

Browse files
david22swandavid22swan
authored
Merge pull request #897 from infoxchange/add_role_ensure_absent
add ensure=>absent to postgresql::server::role
2 parents ebaf270 + 37273e2 commit 1705a35

File tree

3 files changed

+92
-58
lines changed

3 files changed

+92
-58
lines changed

‎README.md‎

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1487,7 +1487,16 @@ Provides the target for the rule, and is generally an internal only property.
14871487
**Use with caution.**
14881488

14891489
#### postgresql::server::role
1490-
Creates a role or user in PostgreSQL.
1490+
Creates or drops a role or user in PostgreSQL.
1491+
1492+
##### `ensure`
1493+
1494+
Specify whether to create or drop the role.
1495+
1496+
Specifying `present` will create the role.
1497+
Specifying `absent` will drop the role.
1498+
1499+
Default value: `present`.
14911500

14921501
##### `connection_limit`
14931502
Specifies how many concurrent connections the role can make.

‎manifests/server/role.pp‎

Lines changed: 66 additions & 57 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,7 @@
1313
$connection_limit = '-1',
1414
$username = $title,
1515
$connect_settings = $postgresql::server::default_connect_settings,
16+
Enum['present', 'absent'] $ensure = 'present',
1617
) {
1718
$psql_user = $postgresql::server::user
1819
$psql_group = $postgresql::server::group
@@ -38,20 +39,6 @@
3839
$version = $postgresql::server::_version
3940
}
4041

41-
$login_sql = $login ? { true => 'LOGIN', default => 'NOLOGIN' }
42-
$inherit_sql = $inherit ? { true => 'INHERIT', default => 'NOINHERIT' }
43-
$createrole_sql = $createrole ? { true => 'CREATEROLE', default => 'NOCREATEROLE' }
44-
$createdb_sql = $createdb ? { true => 'CREATEDB', default => 'NOCREATEDB' }
45-
$superuser_sql = $superuser ? { true => 'SUPERUSER', default => 'NOSUPERUSER' }
46-
$replication_sql = $replication ? { true => 'REPLICATION', default => '' }
47-
if ($password_hash != false) {
48-
$environment = "NEWPGPASSWD=${password_hash}"
49-
$password_sql = "ENCRYPTED PASSWORD '\$NEWPGPASSWD'"
50-
} else {
51-
$password_sql = ''
52-
$environment = []
53-
}
54-
5542
Postgresql_psql {
5643
db => $db,
5744
port => $port_override,
@@ -66,60 +53,82 @@
6653
],
6754
}
6855

69-
postgresql_psql { "CREATE ROLE ${username} ENCRYPTED PASSWORD ****":
70-
command => "CREATE ROLE \"${username}\" ${password_sql} ${login_sql} ${createrole_sql} ${createdb_sql} ${superuser_sql} ${replication_sql} CONNECTION LIMIT ${connection_limit}",
71-
unless => "SELECT 1 FROM pg_roles WHERE rolname = '${username}'",
72-
environment => $environment,
73-
require => Class['Postgresql::Server'],
74-
}
56+
if $ensure == 'present' {
57+
$login_sql = $login ? { true => 'LOGIN', default => 'NOLOGIN' }
58+
$inherit_sql = $inherit ? { true => 'INHERIT', default => 'NOINHERIT' }
59+
$createrole_sql = $createrole ? { true => 'CREATEROLE', default => 'NOCREATEROLE' }
60+
$createdb_sql = $createdb ? { true => 'CREATEDB', default => 'NOCREATEDB' }
61+
$superuser_sql = $superuser ? { true => 'SUPERUSER', default => 'NOSUPERUSER' }
62+
$replication_sql = $replication ? { true => 'REPLICATION', default => '' }
63+
if ($password_hash != false) {
64+
$environment = "NEWPGPASSWD=${password_hash}"
65+
$password_sql = "ENCRYPTED PASSWORD '\$NEWPGPASSWD'"
66+
} else {
67+
$password_sql = ''
68+
$environment = []
69+
}
7570

76-
postgresql_psql {"ALTER ROLE \"${username}\" ${superuser_sql}":
77-
unless => "SELECT 1 FROM pg_roles WHERE rolname = '${username}' AND rolsuper = ${superuser}",
78-
}
71+
postgresql_psql { "CREATE ROLE ${username} ENCRYPTED PASSWORD ****":
72+
command => "CREATE ROLE \"${username}\" ${password_sql} ${login_sql} ${createrole_sql} ${createdb_sql} ${superuser_sql} ${replication_sql} CONNECTION LIMIT ${connection_limit}",
73+
unless => "SELECT 1 FROM pg_roles WHERE rolname = '${username}'",
74+
environment => $environment,
75+
require => Class['Postgresql::Server'],
76+
}
7977

80-
postgresql_psql {"ALTER ROLE \"${username}\" ${createdb_sql}":
81-
unless => "SELECT 1 FROM pg_roles WHERE rolname = '${username}' AND rolcreatedb = ${createdb}",
82-
}
78+
postgresql_psql {"ALTER ROLE \"${username}\" ${superuser_sql}":
79+
unless => "SELECT 1 FROM pg_roles WHERE rolname = '${username}' AND rolsuper = ${superuser}",
80+
}
8381

84-
postgresql_psql {"ALTER ROLE \"${username}\" ${createrole_sql}":
85-
unless => "SELECT 1 FROM pg_roles WHERE rolname = '${username}' AND rolcreaterole = ${createrole}",
86-
}
82+
postgresql_psql {"ALTER ROLE \"${username}\" ${createdb_sql}":
83+
unless => "SELECT 1 FROM pg_roles WHERE rolname = '${username}' AND rolcreatedb = ${createdb}",
84+
}
8785

88-
postgresql_psql {"ALTER ROLE \"${username}\" ${login_sql}":
89-
unless => "SELECT 1 FROM pg_roles WHERE rolname = '${username}' AND rolcanlogin = ${login}",
90-
}
86+
postgresql_psql {"ALTER ROLE \"${username}\" ${createrole_sql}":
87+
unless => "SELECT 1 FROM pg_roles WHERE rolname = '${username}' AND rolcreaterole = ${createrole}",
88+
}
9189

92-
postgresql_psql {"ALTER ROLE \"${username}\" ${inherit_sql}":
93-
unless => "SELECT 1 FROM pg_roles WHERE rolname = '${username}' AND rolinherit = ${inherit}",
94-
}
90+
postgresql_psql {"ALTER ROLE \"${username}\" ${login_sql}":
91+
unless => "SELECT 1 FROM pg_roles WHERE rolname = '${username}' AND rolcanlogin = ${login}",
92+
}
9593

96-
if(versioncmp($version, '9.1') >= 0) {
97-
if $replication_sql == '' {
98-
postgresql_psql {"ALTER ROLE \"${username}\" NOREPLICATION":
99-
unless => "SELECT 1 FROM pg_roles WHERE rolname = '${username}' AND rolreplication = ${replication}",
100-
}
101-
} else {
102-
postgresql_psql {"ALTER ROLE \"${username}\" ${replication_sql}":
103-
unless => "SELECT 1 FROM pg_roles WHERE rolname = '${username}' AND rolreplication = ${replication}",
94+
postgresql_psql {"ALTER ROLE \"${username}\" ${inherit_sql}":
95+
unless => "SELECT 1 FROM pg_roles WHERE rolname = '${username}' AND rolinherit = ${inherit}",
96+
}
97+
98+
if(versioncmp($version, '9.1') >= 0) {
99+
if $replication_sql == '' {
100+
postgresql_psql {"ALTER ROLE \"${username}\" NOREPLICATION":
101+
unless => "SELECT 1 FROM pg_roles WHERE rolname = '${username}' AND rolreplication = ${replication}",
102+
}
103+
} else {
104+
postgresql_psql {"ALTER ROLE \"${username}\" ${replication_sql}":
105+
unless => "SELECT 1 FROM pg_roles WHERE rolname = '${username}' AND rolreplication = ${replication}",
106+
}
104107
}
105108
}
106-
}
107109

108-
postgresql_psql {"ALTER ROLE \"${username}\" CONNECTION LIMIT ${connection_limit}":
109-
unless => "SELECT 1 FROM pg_roles WHERE rolname = '${username}' AND rolconnlimit = ${connection_limit}",
110-
}
110+
postgresql_psql {"ALTER ROLE \"${username}\" CONNECTION LIMIT ${connection_limit}":
111+
unless => "SELECT 1 FROM pg_roles WHERE rolname = '${username}' AND rolconnlimit = ${connection_limit}",
112+
}
111113

112-
if $password_hash and $update_password {
113-
if($password_hash =~ /^md5.+/) {
114-
$pwd_hash_sql = $password_hash
115-
} else {
116-
$pwd_md5 = md5("${password_hash}${username}")
117-
$pwd_hash_sql = "md5${pwd_md5}"
114+
if $password_hash and $update_password {
115+
if($password_hash =~ /^md5.+/) {
116+
$pwd_hash_sql = $password_hash
117+
} else {
118+
$pwd_md5 = md5("${password_hash}${username}")
119+
$pwd_hash_sql = "md5${pwd_md5}"
120+
}
121+
postgresql_psql { "ALTER ROLE ${username} ENCRYPTED PASSWORD ****":
122+
command => "ALTER ROLE \"${username}\" ${password_sql}",
123+
unless => "SELECT 1 FROM pg_shadow WHERE usename = '${username}' AND passwd = '${pwd_hash_sql}'",
124+
environment => $environment,
125+
}
118126
}
119-
postgresql_psql { "ALTER ROLE ${username} ENCRYPTED PASSWORD ****":
120-
command => "ALTER ROLE \"${username}\" ${password_sql}",
121-
unless => "SELECT 1 FROM pg_shadow WHERE usename = '${username}' AND passwd = '${pwd_hash_sql}'",
122-
environment => $environment,
127+
} else {
128+
# ensure == absent
129+
postgresql_psql { "DROP ROLE \"${username}\"":
130+
onlyif => "SELECT 1 FROM pg_roles WHERE rolname = '${username}'",
131+
require => Class['Postgresql::Server'],
123132
}
124133
}
125134
}

‎spec/unit/defines/server/role_spec.rb‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -149,4 +149,20 @@
149149
end
150150
end
151151

152+
context 'with ensure set to absent' do
153+
let :params do
154+
{
155+
:ensure => 'absent',
156+
}
157+
end
158+
159+
let :pre_condition do
160+
"class {'postgresql::server':}"
161+
end
162+
163+
it 'should have drop role for "test" user if ensure absent' do
164+
is_expected.to contain_postgresql_psql('DROP ROLE "test"')
165+
end
166+
end
167+
152168
end

0 commit comments

Comments
 (0)