Skip to content

fix(postgres): guard the Iceberg catalog database bootstrap #59

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
kaanyagci wants to merge 2 commits into from
Open

fix(postgres): guard the Iceberg catalog database bootstrap #59

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
fe9b64e
fix(postgres): preserve Iceberg catalog ownership and credentials
kaanyagci Oct 13, 2026
3e09e1f
chore(review): include isolated runner policy prerequisite
kaanyagci Oct 13, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
35 changes: 35 additions & 0 deletions bootstrap/iceberg-catalog.sql
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,35 @@
\set ON_ERROR_STOP on
SELECT pg_advisory_lock(hashtext('makepad-postgres'),hashtext('iceberg_catalog-bootstrap'));
SELECT NOT EXISTS(SELECT 1 FROM pg_roles WHERE rolname='iceberg_catalog') AND NOT EXISTS(SELECT 1 FROM pg_database WHERE datname='iceberg_catalog') AS fresh_install \gset
\if :fresh_install
\if :{?iceberg_catalog_password}
\else
\echo 'missing iceberg_catalog_password'
DO $$ BEGIN RAISE EXCEPTION 'Iceberg bootstrap precondition failed'; END $$;
\endif
SELECT length(:'iceberg_catalog_password') >= 32 AS strong_password \gset
\if :strong_password
\else
\echo 'iceberg_catalog_password must contain at least 32 characters'
DO $$ BEGIN RAISE EXCEPTION 'Iceberg bootstrap precondition failed'; END $$;
\endif
CREATE ROLE iceberg_catalog LOGIN NOSUPERUSER NOCREATEDB NOCREATEROLE NOREPLICATION NOBYPASSRLS PASSWORD :'iceberg_catalog_password';
CREATE DATABASE iceberg_catalog OWNER iceberg_catalog;
REVOKE ALL ON DATABASE iceberg_catalog FROM PUBLIC;
GRANT CONNECT ON DATABASE iceberg_catalog TO iceberg_catalog;
\else
SELECT EXISTS(
SELECT 1 FROM pg_database d JOIN pg_roles r ON d.datdba=r.oid
WHERE d.datname='iceberg_catalog' AND r.rolname='iceberg_catalog'
AND r.rolcanlogin AND NOT r.rolsuper AND NOT r.rolcreatedb
AND NOT r.rolcreaterole AND NOT r.rolreplication AND NOT r.rolbypassrls
AND NOT EXISTS(SELECT 1 FROM pg_auth_members m WHERE m.member=r.oid OR m.roleid=r.oid)
AND NOT EXISTS(SELECT 1 FROM aclexplode(COALESCE(d.datacl,acldefault('d',d.datdba))) a WHERE a.grantee<>d.datdba)
) AS existing_is_scoped \gset
\if :existing_is_scoped
\echo 'Existing Iceberg ownership and isolation verified; credentials unchanged.'
\else
DO $$ BEGIN RAISE EXCEPTION 'Existing Iceberg installation is incomplete or unsafe'; END $$;
\endif
\endif
SELECT pg_advisory_unlock(hashtext('makepad-postgres'),hashtext('iceberg_catalog-bootstrap'));