provisioner

func DropDatabase ¶

func DropDatabase(ctx context.Context, adminDSN, dbName string) error

DropDatabase removes dbName on the Postgres server addressed by adminDSN. Idempotent: returns nil when the database is already absent (3D000). Forces disconnection of any active sessions on the target DB so DROP DATABASE can't hang waiting for clients to drain — necessary at duckling teardown time because the per-tenant Lakekeeper pod may still be alive when the drop runs (the k8s teardown is fire-and-forget and the operator's reconciliation lag means connections linger).

Reassigns ownership to CURRENT_USER before the drop so the admin role can issue DROP DATABASE even when it doesn't own the target. EnsureRole runs ALTER DATABASE ... OWNER TO <role>, which means a non-superuser admin (e.g. the ducklingexample master on a shared RDS) wouldn't otherwise have permission — 42501 must be owner of database. GRANT role-membership first so CURRENT_USER inherits the necessary privileges to ALTER OWNER (which itself requires being a member of the new owner role on Postgres 14+).

Caller must connect via a privileged DSN against a different database than dbName (the admin DSN's path is OK to be `postgres`).

func DropRole ¶

func DropRole(ctx context.Context, adminDSN, role string) error

DropRole removes role on the Postgres server addressed by adminDSN. Idempotent: returns nil when the role is already absent. Best-effort REASSIGN/DROP OWNED first so any object the role owns (e.g. grants on the maintenance DB, default privileges) doesn't block DROP ROLE with 2BP01 ("role cannot be dropped because some objects depend on it").

Requires role-membership in `role` for REASSIGN OWNED + DROP OWNED to run (Postgres 14+); the GRANT is best-effort because if `role` is already gone the GRANT itself fails. The caller's admin must either be a superuser or already a member of role; on RDS we explicitly GRANT the membership first since the admin is neither.

Caller must connect via a privileged DSN.

func EnsureDatabase ¶

func EnsureDatabase(ctx context.Context, adminDSN, dbName string) error

EnsureDatabase creates dbName on the Postgres server addressed by adminDSN if it does not already exist. Idempotent: returns nil when the database is already present. Caller owns the DSN's credential lifetime.

CREATE DATABASE cannot run in a transaction and Postgres does not support CREATE DATABASE IF NOT EXISTS, so we probe pg_database first and only fire CREATE DATABASE when the row is missing. There is a TOCTOU race against concurrent callers; we handle the duplicate_database SQLSTATE (42P04) as a benign collision rather than an error.

func EnsureRole ¶

func EnsureRole(ctx context.Context, adminDSN, role, password, ownedDB string) error

EnsureRole creates a login role with the given password, or rotates the password if the role already exists. Used by the Lakekeeper provisioner to make sure Lakekeeper's pod can connect with the credentials stored in its K8s Secret — a freshly-created database has no users by default.

On a re-run with the same password the ALTER ROLE is a no-op for Postgres internals. On a re-run with a different password we explicitly rotate; callers must keep the password in their Secret in sync with whatever was last passed here. The Lakekeeper provisioner achieves this by reading the existing Secret on every run (resolveOrGenerateSecret) rather than regenerating, so the same password threads through to EnsureRole.

Grants the role ALL PRIVILEGES on the named database. Cluster admin permissions are not granted.

func ProbeMetadataStore ¶

func ProbeMetadataStore(ctx context.Context, endpoint, user, password, database, sslMode string) error

ProbeMetadataStore does a real end-to-end connect to the metadata Postgres and runs SELECT 1 to confirm the path is reachable from a CP pod.

Purpose: AWS Aurora reports a cluster as Available before the cluster's DNS record has propagated to in-cluster CoreDNS, and even further before pgbouncer's resolver picks it up. If the provisioner flips the warehouse to state=ready on AWS-Available alone, worker activations during the next 3-5 minutes hit "DuckLake migration check failed → connect to metadata store: DNS lookup failed". This probe closes that window — we only flip to ready when the actual path the workers will use actually works.

`endpoint` is "<host>[:<port>]"; missing port defaults to 5432. `sslMode` should be:

• "disable" when probing through the duckling's pgbouncer (the CR's pgbouncer pod is configured for plaintext between worker and pooler and brings TLS to RDS itself)
• "require" when probing the metadata RDS endpoint directly (Aurora requires TLS; AWS issues the cert from the AWS-RDS-Root CA chain)

The caller (provisioner controller) decides which path to probe based on the warehouse's pgbouncer.enabled toggle — ducklings can run with or without the pgbouncer pooler and the chosen path must match.