Search

2.6. Allowing Read-Only Access to the History Database

download PDF

To allow access to the history database without allowing edits, you must create a read-only PostgreSQL user that can log in to and read from the ovirt_engine_history database. This procedure must be executed on the system on which the history database is installed.

Allowing Read-Only Access to the History Database

  1. Enable psql commands:

    # su - postgres -c 'scl enable rh-postgresql10 bash'
  2. Create the user to be granted read-only access to the history database:

    # psql -U postgres -c "CREATE ROLE username WITH LOGIN ENCRYPTED PASSWORD 'password';" -d ovirt_engine_history
  3. Grant the newly created user permission to connect to the history database:

    # psql -U postgres -c "GRANT CONNECT ON DATABASE ovirt_engine_history TO username;"
  4. Grant the newly created user usage of the public schema:

    # psql -U postgres -c "GRANT USAGE ON SCHEMA public TO username;" ovirt_engine_history
  5. Generate the rest of the permissions that will be granted to the newly created user and save them to a file:

    # psql -U postgres -c "SELECT 'GRANT SELECT ON ' || relname || ' TO username;' FROM pg_class JOIN pg_namespace ON pg_namespace.oid = pg_class.relnamespace WHERE nspname = 'public' AND relkind IN ('r', 'v');" --pset=tuples_only=on  ovirt_engine_history > grant.sql
  6. Use the file you created in the previous step to grant permissions to the newly created user:

    # psql -U postgres -f grant.sql ovirt_engine_history
  7. Remove the file you used to grant permissions to the newly created user:

    # rm grant.sql
  8. Exit the postgres user shell by pressing Ctrl+d.
  9. Add the following lines for the newly created user to /var/opt/rh/rh-postgresql10/lib/pgsql/data/pg_hba.conf preceding the line beginning local all all, as follows:

    # TYPE  DATABASE                USER           ADDRESS                 METHOD
    host    ovirt_engine_history    username    0.0.0.0/0               md5
    host    ovirt_engine_history    username    ::0/0                   md5
    local   all             all                                     peer
  10. Reload the PostgreSQL service:

    # systemctl reload rh-postgresql10-postgresql
  11. To test the read-only user’s access permissions:

    # su - postgres -c 'scl enable rh-postgresql10 -- psql -U username ovirt_engine_history -h localhost'
    Password for user username:
    psql (9.2.23)
    Type "help" for help.
    
    ovirt_engine_history=>
  12. To exit the ovirt_engine_history database, enter \q.

The read-only user’s SELECT statements against tables and views in the ovirt_engine_history database succeed, while modifications fail.

Red Hat logoGithubRedditYoutubeTwitter

Learn

Try, buy, & sell

Communities

About Red Hat Documentation

We help Red Hat users innovate and achieve their goals with our products and services with content they can trust.

Making open source more inclusive

Red Hat is committed to replacing problematic language in our code, documentation, and web properties. For more details, see the Red Hat Blog.

About Red Hat

We deliver hardened solutions that make it easier for enterprises to work across platforms and environments, from the core datacenter to the network edge.

© 2024 Red Hat, Inc.