CuBiC Comments - Windmill

CuBiC

•Created by CuBiC on 1/3/2025 in #help

Permission denied to set role "windmill_admin" on Postgres without superuser

Found the culprit. I guess it's a case of "it's been a long day for layer 8" 😁 if you look at the URL I posted above closely, you'll see a completely different username and database. I copy-pasted the reference for this secret from another service, so a wrong service URL has been pulled from the secret store.

14 replies

WWindmill

•Created by CuBiC on 1/3/2025 in #help

Permission denied to set role "windmill_admin" on Postgres without superuser

Unfortunately it's a homelab cluster, so there's no EE budget 😉 But thank you for having a look. I'll see what I can do to find out what's going on.

14 replies

WWindmill

•Created by CuBiC on 1/3/2025 in #help

Permission denied to set role "windmill_admin" on Postgres without superuser

I did test both cases, I'm aware that it will block superuser

14 replies

WWindmill

•Created by CuBiC on 1/3/2025 in #help

Permission denied to set role "windmill_admin" on Postgres without superuser

Yes, that's the strange part of that, I can verify in every container that the URL is correct:

I have no name!@windmill-app-66d6f8944d-dmfq7:/usr/src/app$ env | grep -i database
DATABASE_URL=postgresql://shlink:[snip]@postgres-pgbouncer.database.svc:5432/shlink?sslmode=disable

I have no name!@windmill-app-66d6f8944d-dmfq7:/usr/src/app$ env | grep -i database
DATABASE_URL=postgresql://shlink:[snip]@postgres-pgbouncer.database.svc:5432/shlink?sslmode=disable

or without pgBouncer

I have no name!@windmill-app-66d6f8944d-dmfq7:/usr/src/app$ env | grep -i database
DATABASE_URL=postgresql://shlink:[snip]@postgres-primary.database.svc:5432/shlink?sslmode=disable

I have no name!@windmill-app-66d6f8944d-dmfq7:/usr/src/app$ env | grep -i database
DATABASE_URL=postgresql://shlink:[snip]@postgres-primary.database.svc:5432/shlink?sslmode=disable

14 replies

WWindmill

•Created by CuBiC on 1/3/2025 in #help

Permission denied to set role "windmill_admin" on Postgres without superuser

I did and it seems fine using psql:

bash-4.4$ psql -U windmill -h localhost
Password for user windmill:
psql (17.2)
SSL connection (protocol: TLSv1.3, cipher: TLS_AES_256_GCM_SHA384, compression: off, ALPN: postgresql)
Type "help" for help.

windmill=> set role windmill_admin;
SET
windmill=>

bash-4.4$ psql -U windmill -h localhost
Password for user windmill:
psql (17.2)
SSL connection (protocol: TLSv1.3, cipher: TLS_AES_256_GCM_SHA384, compression: off, ALPN: postgresql)
Type "help" for help.

windmill=> set role windmill_admin;
SET
windmill=>

14 replies

WWindmill

•Created by CuBiC on 1/3/2025 in #help

Permission denied to set role "windmill_admin" on Postgres without superuser

According the the \drg from above is seems it does:

windmill=# \drg
                         List of role grants
   Role name    |         Member of         |   Options    | Grantor
----------------+---------------------------+--------------+----------
...
 windmill       | windmill_admin            | INHERIT, SET | postgres
 ...

windmill=# \drg
                         List of role grants
   Role name    |         Member of         |   Options    | Grantor
----------------+---------------------------+--------------+----------
...
 windmill       | windmill_admin            | INHERIT, SET | postgres
 ...

14 replies