Versions Compared

Old Version 6

changes.mady.by.user eric revollo

Saved on

compared with

New Version Current

changes.mady.by.user eric revollo

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

This section assumes you have already created the RED Metadata using the admin user.

  1. Connect to the repo dbDB
  2. Create the RED user role and provide grants. 
    Code Block
    languagesql
    CREATE ROLE reduser_role NOLOGIN ADMIN postgres;
    Give grants to the metadata objects
    Code Block
    languagesql
    
GRANT USAGE ON SCHEMA red TO reduser_role;
GRANT EXECUTE ON ALL FUNCTIONS IN SCHEMA red TO reduser_role;
GRANT EXECUTE ON ALL PROCEDURES IN SCHEMA red TO reduser_role;
GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA red TO reduser_role;

    Tip
    titleTip
    For each developer user of RED create an individual PostgreSQL user for them.
  3. Create a RED user and grant the user role.
    Code Block
    languagesql
    CREATE USER red_user WITH PASSWORD 'red_pass';
GRANT reduser_role to red_user; 

5. Create a RED Scheduler role and user in PostgreSQL

It is important to make sure you have completed step 4 prior to running the following user grants.

...

Add a RED Scheduler Role and User

...

This section assumes you have already created the RED Metadata using the admin user.

...

  1. Create the RED Scheduler user role and provide grants.
    Code Block
    languagesql
  1. CREATE ROLE redscheduler_role NOLOGIN ADMIN postgres;

...

  1.

...

  1. GRANT

...

  1.

...

  1. USAGE ON SCHEMA red TO redscheduler_role;
GRANT EXECUTE ON ALL FUNCTIONS IN SCHEMA red TO redscheduler_role;
GRANT EXECUTE ON ALL PROCEDURES IN SCHEMA red TO redscheduler_role;

...

  1. We can potentially grant "INSERT, 
...
  1.  UPDATE, 
...
  1.  DELETE" 
...
  1.  to 
...
  1.  only 
...
  1.  the 
...
  1.  ws_wrk 
...
  1.  tables 
...
  1.  here, 
...
  1.  but 
...
  1.  we 
...
  1.  still 
...
  1.  need 
...
  1.  select 
...
  1.  on 
...
  1.  the 
...
  1. rest. 
     Code Block
    languagesql
    GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA red TO redscheduler_role;
...
  1. Grant redscheduler_role 
...
  1.  select 
...
  1.  access 
...
  1.  to 
...
  1.  the 
...
  1. redadmin schema 
     Code Block
    languagesql
    GRANT USAGE ON SCHEMA redadmin TO redscheduler_role;
GRANT SELECT ON ALL TABLES IN SCHEMA redadmin TO redscheduler_role;
...
  2. Create 
...
  1.  the 
...
  1.  RED 
...
  1.  scheduler 
...
  1.  user 
...
  1.  and 
...
  1.  grant 
...
  1.  the 
...
  1.  RED 
...
  1.  Scheduler 
...
  1. role 
     Code Block
    languagesql
    CREATE USER redscheduler_user WITH PASSWORD 'redscheduler_pass';
GRANT redscheduler_role to redscheduler_user;
...
  2. Optionally, create the RED Scheduler Profile Role and User, or just use the redadmin_user for Profile maintenance 
     Code Block
    languagesql
    CREATE ROLE redschedulerprofile_role NOLOGIN ADMIN postgres;
...
  1. Grant 'red' 
...
  1.  schema 
...
  1. permissions.
     Code Block
    languagesql
    GRANT USAGE ON SCHEMA red TO redschedulerprofile_role;
GRANT SELECT ON ALL TABLES IN SCHEMA red TO redschedulerprofile_role;
...
  1. Grant 'redadmin' 
...
  1.  schema 
...
  1. permissions
     Code Block
    languagesql
    GRANT USAGE ON SCHEMA redadmin TO redschedulerprofile_role;
GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA redadmin TO redschedulerprofile_role;
...
  1. Create a RED profile admin user and grant the user role
     Code Block
    languagesql
    CREATE USER redschedulerprofile_user WITH PASSWORD 'red_pass';
GRANT redschedulerprofile_role to redschedulerprofile_user;
...
Create 
...
an Azkaban User role and user in PostgreSQL
...
languagesql
titleCreate Azkaban Role and User
collapsetrue
...
 This section assumes you have already created the Azkaban Metadata using the admin user.
  1. Create the Azkaban metadata user role and provide grants to the Azkaban metadata objects in schema 'white'
     Code Block
    languagesql
    CREATE ROLE azkabanmeta_role NOLOGIN ADMIN postgres;
...
  1. 

...
  1. GRANT
...
  1.  
...
  1. USAGE ON SCHEMA white TO azkabanmeta_role;
GRANT USAGE ON ALL SEQUENCES IN SCHEMA white TO azkabanmeta_role;
GRANT EXECUTE ON ALL FUNCTIONS IN SCHEMA white TO azkabanmeta_role;
GRANT EXECUTE ON ALL PROCEDURES IN SCHEMA white TO azkabanmeta_role;
GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA white TO azkabanmeta_role;
...
  2. Create an Azkaban meta user and grant the user role
     Code Block
    languagesql
...
...
  1. CREATE USER
...
  1.  
...
  1. azkabanmeta_user WITH PASSWORD 'azkabanmeta_pass';
GRANT azkabanmeta_role to azkabanmeta_user;
...
Adding Azkaban Users
If you require additional users for the Azkaban dashboard or API, other than the default users, you can add them following this process:
...
 Code Block
<?xml version="1.0" encoding="UTF-8" standalone="no"?>
<azkaban-users>
  <role name="admin" permissions="ADMIN"/>
  <role name="read" permissions="READ"/>
  <role name="executor" permissions="EXECUTE"/>
  <user username="admin" password="admin" roles="admin"/>
  <user username="readonly" password="readonly" roles="read"/>
  <user username="executor" password="executor" roles="executor,read"/>
</azkaban-users><azkaban-users/>
 Note
titleNote
When entering the passwords they must follow the same password encryption settings configured on Azkaban, for more information refer to the Password Encryption in Azkaban section in RED Scheduler Configuration.

The possible role permissions are the following:
...