Skip to content

migrator: Support privileged migrations

Warren Gifford requested to merge ef/privileged-migrations into main

Created by: efritz

This PR makes the following changes:

Big news:

  • Updates the migration runner to bail out on a privileged migration if a -unprivileged-only flag is set. This will inform the user that they need to run the contents of some migration file manually with elevated permissions.

Smaller news:

  • Adds privileged and nonIdempotent keys to each migration definition.
  • Updates squash to write two roots - a privileged and a non-privileged version. The privileged version extracts all of the create/comment on extension ... queries and marks the migration as privileged where necessary. We can add more queries that require superuser access to be pulled out automatically in the future as well. All squashed migrations are also now marked as non-idempotent.
  • Update migration/idempotency tests for each schema.
  • Re-squashes all three schemas to initially separate superuser-required queries.

Fixes #31372 (closed).

Test plan

Tested privileged migrations by hand locally. Will rely on existing and modified unit tests for confidence in migrations.

Merge request reports