Manage PostgreSQL role using shell-operator

[susanaws86]

I am trying to manage the role in GCP Cloud PostgreSQL as the new user created using Config Connector is not bind with a role that can access the tables.
If you have any example using shell-operator is help full.

[diafour]

Hello! There is no example specific to the PostgreSQL in GCP Cloud.
I assume you want to run a script when a CR for the new user appears in the cluster. You can start from this very basic example that uses CRD: https://github.com/flant/shell-operator/blob/master/examples/105-crd-simple

[susanaws86]

I have successfully configured the shell-operator But I am getting the below error while the hook binding.

{"level":"info","msg":"start shell-operator","time":"2021-10-26T18:06:27Z"}
{"level":"info","msg":"queue task EnableKubernetesBindings:::pgsql-user-hook.sh:EnableKubernetesBindings for hook pgsql-user-hook.sh","operator.component":"initMainQueue","time":"2021-10-26T18:06:27Z"}
{"binding":"","hook":"pgsql-user-hook.sh","level":"info","msg":"Enable kubernetes binding for hook","queue":"main","task":"EnableKubernetesBindings","time":"2021-10-26T18:06:27Z"}
{"level":"info","msg":"Create metric histogram shell_operator_kubernetes_client_rate_limiter_latency_seconds","operator.component":"metricsStorage","time":"2021-10-26T18:06:27Z"}
{"level":"error","msg":"kubernetes[0]{OnCreateDeleteSQLUser}: initial list resources of kind 'SQLUser': sqlusers.sql.cnrm.cloud.google.com is forbidden: User "system:serviceaccount:example-sqluser-simple:" cannot list resource "sqlusers" in API group "sql.cnrm.cloud.google.com" at the cluster scope","time":"2021-10-26T18:06:27Z"}
{"level":"error","msg":"load existing objects: sqlusers.sql.cnrm.cloud.google.com is forbidden: User "system:serviceaccount:example-sqluser-simple:" cannot list resource "sqlusers" in API group "sql.cnrm.cloud.google.com" at the cluster scope","time":"2021-10-26T18:06:27Z"}
{"binding":"","hook":"pgsql-user-hook.sh","level":"error","msg":"Enable Kubernetes binding for hook failed. Will retry after delay. Failed count is 1. Error: run monitor: sqlusers.sql.cnrm.cloud.google.com is forbidden: User "system:serviceaccount:example-sqluser-simple:" cannot list resource "sqlusers" in API group "sql.cnrm.cloud.google.com" at the cluster scope","queue":"main","task":"EnableKubernetesBindings","time":"2021-10-26T18:06:27Z"}

[diafour]

Hello! It seems that ServiceAccount/example-sqluser-simple needs a ClusterRoleBinding with grants to list "sqlusers" resource.