Dov/auth-doc-upgrade #32657
Dov/auth-doc-upgrade #32657
Conversation
…able-logic-self-managed-branch docs: selector needs to filter out /docs from /docs/self-managed
Fall back to local versions.json when global one is missing. Concatenate paths for links correctly
…d-versions-file-path-tweak docs: tweak fallback versions.json path
MaterializeInc#31076) …l (MaterializeInc#31069)" This reverts commit d67de03. Revert as the name change is an upcoming change (i.e., not yet available)
Authored-by: Nisar Hassan Naqvi <[email protected]>
…nc#31129) In prep for release, using `v25.1.0` instead of `v25.1.0-beta.1`
docs: Bump latest versions
…raform self-managed docs: Bump terraform versions too
… Hetzner overloaded
MaterializeInc#32452) Co-authored-by: Nisar Hassan Naqvi <[email protected]>
…2444) --------- Co-authored-by: kay-kim <[email protected]>
Co-authored-by: Nate <[email protected]>
DAlperin
force-pushed
the
dov/auth-doc-upgrade
branch
from
79c033a to
e416002
Compare
kay-kim
changed the base branch from
self-managed-docs/v25.1
to
self-managed-docs/v25.2
| ```mzsql | ||
|
|
||
| ``` |
There was a problem hiding this comment.
heh ... remove?
| ```mzsql | |
| ``` |
| ```mzsql | ||
| CREATE ROLE _role_name_ [WITH [SUPERUSER | NOSUPERUSER ] | ||
| [ LOGIN | NOLOGIN ] | ||
| [ INHERIT | NOINHERIT ] |
There was a problem hiding this comment.
I would remove NOINHERIT here since we don't support it for CREATE ROLE.
Per mention in the SQL meeting, will note that we've remove from the docs in our issue ... so that, later on, after Xmonths have passed, we can just remove it from our code base.
| | `SUPERUSER` | Materialize does not support the `SUPERUSER` option for `CREATE ROLE`.<ul><li>Instead, Materialize derives the `SUPERUSER` option for a role during authentication every time that role tries to connect.</li></ul>| | ||
| | Option | Description | | ||
| | ------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------- | | ||
| | `INHERIT` | Materialize implicitly uses `INHERIT` for the `CREATE ROLE` command. That is, `CREATE ROLE <name>` and `CREATE ROLE <name> WITH INHERIT` are equivalent. | |
There was a problem hiding this comment.
Ah ...
we lost the "Grants the role the ability to inherit privileges of other roles."
I would make this:
Optional. If specified, grants the role the ability to inherit privileges of other roles. (Default)
| | Option | Description | | ||
| | ------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------- | | ||
| | `INHERIT` | Materialize implicitly uses `INHERIT` for the `CREATE ROLE` command. That is, `CREATE ROLE <name>` and `CREATE ROLE <name> WITH INHERIT` are equivalent. | | ||
| | `NOINHERIT` | Materialize does not support the `NOINHERIT` option for `CREATE ROLE`. | |
There was a problem hiding this comment.
I'd remove
| | `NOINHERIT` | Materialize does not support the `NOINHERIT` option for `CREATE ROLE`. | |
| | ------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------- | | ||
| | `INHERIT` | Materialize implicitly uses `INHERIT` for the `CREATE ROLE` command. That is, `CREATE ROLE <name>` and `CREATE ROLE <name> WITH INHERIT` are equivalent. | | ||
| | `NOINHERIT` | Materialize does not support the `NOINHERIT` option for `CREATE ROLE`. | | ||
| | `LOGIN` | The `LOGIN` attribute allows a role to login via the postgresql or web endpoints | |
There was a problem hiding this comment.
Would capitalize PostgreSQL
Optional. If specified, allows
|
|
||
| ## Examples | ||
|
|
||
| ```mzsql | ||
| CREATE ROLE db_reader; | ||
| CREATE ROLE db_reader WITH LOGIN PASSWORD 'password'; |
There was a problem hiding this comment.
We could probably annotate these examples with what these are actually doing ... but ... eh.
| ALTER ROLE _role_name_ [WITH [SUPERUSER | NOSUPERUSER ] | ||
| [ LOGIN | NOLOGIN ] | ||
| [ INHERIT | NOINHERIT ] | ||
| [ PASSWORD <text> ]] [SET _name_ TO _value_] |
There was a problem hiding this comment.
Since our syntax doesn't render italics:
| ALTER ROLE _role_name_ [WITH [SUPERUSER | NOSUPERUSER ] | |
| [ LOGIN | NOLOGIN ] | |
| [ INHERIT | NOINHERIT ] | |
| [ PASSWORD <text> ]] [SET _name_ TO _value_] | |
| ALTER ROLE <role_name> [WITH [SUPERUSER | NOSUPERUSER ] | |
| [ LOGIN | NOLOGIN ] | |
| [ INHERIT | NOINHERIT ] | |
| [ PASSWORD <text> ]] [SET <name> TO <value> ] |
|
|
||
| ```mzsql | ||
| ALTER ROLE rj PASSWORD NULL; | ||
| ``` |
There was a problem hiding this comment.
Maybe adda warning
{{< warning >}}
Setting a NULL password removes the password requirement.
{{< /warning >}}
| ##### Making a role a superuser | ||
|
|
||
| ```mzsql | ||
| ALTER ROLE rj SUPERUSER; |
There was a problem hiding this comment.
Actually, since we do an example with setting this role password NULL below (even though it's not really sequential), you might change this to NOSUPERUSER instead of SUPERUSER
| | Field | Use | | ||
| | ------------- | ------------------------------------------------------------------------------------------------------------------------------------------------ | | ||
| | **INHERIT** | Grants the role the ability to inherit privileges of other roles. | | ||
| | `LOGIN` | The `LOGIN` attribute allows a role to login via the postgresql or web endpoints | |
There was a problem hiding this comment.
capitalize PostgreSQL?
Also, for my edification, is the web endpoint referring to the http endpoint?
kay-kim
force-pushed
the
self-managed-docs/v25.2
branch
from
06659ed to
50b3520
Compare
|
Apologies .. you'll need to rebase. I ended up branching off main and replaying the self-managed docs changes on top of that to get everything between v25.1 and v25.2 |
kay-kim
force-pushed
the
self-managed-docs/v25.2
branch
2 times, most recently
from
11a384a to
646ccab
Compare
|
superseded by #32697 |
Motivation
Tips for reviewer
Checklist
$T ⇔ Proto$Tmapping (possibly in a backwards-incompatible way), then it is tagged with aT-protolabel.