feat(gateway): add PostgreSQL privileges reference for Kong Gateway - #7070
Open
outsinre wants to merge 1 commit into
Open
feat(gateway): add PostgreSQL privileges reference for Kong Gateway#7070outsinre wants to merge 1 commit into
outsinre wants to merge 1 commit into
Conversation
Document the minimal PostgreSQL role attributes and privileges Kong Gateway needs for migrations, runtime, and admin CLI operations, since no existing page covered least-privilege database setup. Cross-link it from the datastore how-to and the sibling PostgreSQL reference pages.
Contributor
There was a problem hiding this comment.
Pull request overview
Adds a new Gateway reference page documenting least-privilege PostgreSQL role attributes/privileges required by Kong Gateway, and cross-links it from the existing PostgreSQL reference pages and the datastore how-to.
Changes:
- Added
app/gateway/postgresql-privileges-reference.mddescribing migration, runtime, admin CLI, and read-only user privilege requirements. - Added cross-links to the new privileges reference from the PostgreSQL TLS and OAuth reference pages.
- Added a “next steps” link from the datastore configuration how-to to the new privileges reference.
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| app/gateway/postgresql-reference.md | Adds a related resource link to the new PostgreSQL privileges reference page. |
| app/gateway/postgresql-privileges-reference.md | Introduces the new least-privilege PostgreSQL roles/privileges reference content. |
| app/gateway/postgresql-oauth.md | Adds a related resource link to the new PostgreSQL privileges reference page. |
| app/_how-tos/gateway/configure-datastore.md | Adds a next-step link pointing readers to the new privileges hardening reference. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
+253
to
+256
| GRANT SELECT ON ALL TABLES IN SCHEMA <pg_schema> TO <pg_ro_user>; | ||
|
|
||
| -- [DCL] Auto-grant SELECT on future tables created by the migration-time write user | ||
| ALTER DEFAULT PRIVILEGES FOR ROLE <pg_user> IN SCHEMA <pg_schema> GRANT SELECT ON TABLES TO <pg_ro_user>; |
Contributor
Author
There was a problem hiding this comment.
No! We have a comment above to cover it.
Comment on lines
+142
to
+146
| DROP SCHEMA IF EXISTS <pg_schema> CASCADE; | ||
|
|
||
| -- kong migrations bootstrap/up/finish | ||
| CREATE SCHEMA IF NOT EXISTS <pg_schema> AUTHORIZATION CURRENT_USER; | ||
| GRANT ALL ON SCHEMA <pg_schema> TO CURRENT_USER; |
Contributor
Author
There was a problem hiding this comment.
pg_schema is a Kong config.
Leave this part to docs team.
✅ Deploy Preview for kongdeveloper ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
outsinre
commented
Sep 2, 2026
|
|
||
| * **Migration session** — The `kong migrations` CLI connects to `pg_database` as `pg_user`. If the schema does not exist, it creates `pg_schema`, switches to it, and runs DDL. The gateway process is not running yet. | ||
| * **Runtime session** — The gateway process opens pooled connections to `pg_database` as `pg_user`. Each connection switches to `pg_schema`. | ||
| * **Admin CLI session** — A CLI command other than `kong migrations` can also open a database session. Examples are `kong workspace`, `kong config db_import`, and `kong config db_export`. This session is a one-off, unpooled connection, not part of the gateway's connection pool. The command connects to `pg_database` as `pg_user` and switches to `pg_schema`, the same as a runtime session. The command can run whether the gateway process is active or stopped. It can also run statements that the runtime session never runs, such as `TRUNCATE`. |
Contributor
Author
There was a problem hiding this comment.
unpool means without connection pool.
Leave it to docs team for wording accuracy.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Add PostgreSQL privileges reference for Kong Gateway
Document the minimal PostgreSQL role attributes and privileges Kong
Gateway needs for migrations, runtime, and admin CLI operations, since
no existing page covered least-privilege database setup. Cross-link it
from the datastore how-to and the sibling PostgreSQL reference pages.
https://konghq.atlassian.net/browse/FTI-7203
Preview Links
Checklist
descriptionentry in frontmatter.