diff --git a/src/current/_includes/releases/v23.1/v23.1.0-alpha.2.md b/src/current/_includes/releases/v23.1/v23.1.0-alpha.2.md index b29c1339dcd..d8d57276b29 100644 --- a/src/current/_includes/releases/v23.1/v23.1.0-alpha.2.md +++ b/src/current/_includes/releases/v23.1/v23.1.0-alpha.2.md @@ -50,7 +50,7 @@ We chose a default of `25h` originally to accommodate daily incremental backups - The `CONTROLCHANGEFEED` [role option](https://www.cockroachlabs.com/docs/v23.1/alter-role#role-options) will be deprecated in the future (see issue [#94757](https://github.com/cockroachdb/cockroach/issues/94757)). With this change, usages of the `CONTROLCHANGEFEED` role option will come with a deprecation warning. Its existing behavior remains the same. The `SELECT` and `CHANGEFEED` privileges will be used for changefeeds henceforth: - The `SELECT` privilege on a set of tables allows a user to run core changefeeds against them. - The `CHANGEFEED` privilege on a set of tables allows a user to run enterprise changefeeds on them, and also manage the underlying changefeed job (ie. view, pause, cancel, and resume the job). - Notably, a new [cluster setting](https://www.cockroachlabs.com/docs/v23.1/cluster-settings) `changefeed.permissions.enforce_external_connections` is added and set to `false` by default. Enabling this setting restricts users with `CHANGEFEED` on a set of tables to create enterprise changefeeds into external connections only. To use a given external connection, a user typically needs the `USAGE` privilege on it. Note that `ALTER DEFAULT PRIVILEGES` can be used with both the `CHANGEFEED` and `SELECT` privileges to assign coarse-grained permissions (i.e., assign permissions to all tables in a schema rather than manually assign them for each table). [#94796][#94796] + Notably, a new [cluster setting](https://www.cockroachlabs.com/docs/v23.1/cluster-settings) `changefeed.permissions.require_external_connection_sink.enabled` is added and set to `false` by default. Enabling this setting restricts users with `CHANGEFEED` on a set of tables to create enterprise changefeeds into external connections only. To use a given external connection, a user typically needs the `USAGE` privilege on it. Note that `ALTER DEFAULT PRIVILEGES` can be used with both the `CHANGEFEED` and `SELECT` privileges to assign coarse-grained permissions (i.e., assign permissions to all tables in a schema rather than manually assign them for each table). [#94796][#94796] - Changefeeds created/altered with a `metrics_label` set while `server.child_metrics.enabled` is set to `false` will now provide the user a notice upon creation. [#94948][#94948] - Fix a bug in [`ALTER CHANGEFEED`](https://www.cockroachlabs.com/docs/v23.1/alter-changefeed) that would panic when altering changefeeds to remove a table that has already been dropped. [#95739][#95739] - Reduced the default size of scan RPC replies to improve cluster stability during changefeed accounting for transient memory. [#95798][#95798] diff --git a/src/current/_includes/releases/v23.1/v23.1.0.md b/src/current/_includes/releases/v23.1/v23.1.0.md index f739b36eb8d..89d652811d9 100644 --- a/src/current/_includes/releases/v23.1/v23.1.0.md +++ b/src/current/_includes/releases/v23.1/v23.1.0.md @@ -480,7 +480,7 @@ The following changes should be reviewed prior to upgrading. Default cluster set - The `CONTROLCHANGEFEED` [role option](https://www.cockroachlabs.com/docs/v23.1/alter-role#role-options) will be deprecated in the future (see issue [#94757](https://github.com/cockroachdb/cockroach/issues/94757)). With this change, usages of the `CONTROLCHANGEFEED` role option will come with a deprecation warning. Its existing behavior remains the same. The `SELECT` and `CHANGEFEED` privileges will be used for changefeeds henceforth: - The `SELECT` privilege on a set of tables allows a user to run core changefeeds against them. - The `CHANGEFEED` privilege on a set of tables allows a user to run enterprise changefeeds on them, and also manage the underlying changefeed job (ie. view, pause, cancel, and resume the job). - Notably, a new [cluster setting](https://www.cockroachlabs.com/docs/v23.1/cluster-settings) `changefeed.permissions.enforce_external_connections` is added and set to `false` by default. Enabling this setting restricts users with `CHANGEFEED` on a set of tables to create enterprise changefeeds into external connections only. To use a given external connection, a user typically needs the `USAGE` privilege on it. Note that `ALTER DEFAULT PRIVILEGES` can be used with both the `CHANGEFEED` and `SELECT` privileges to assign coarse-grained permissions (i.e., assign permissions to all tables in a schema rather than manually assign them for each table). [#94796][#94796] + Notably, a new [cluster setting](https://www.cockroachlabs.com/docs/v23.1/cluster-settings) `changefeed.permissions.require_external_connection_sink.enabled` is added and set to `false` by default. Enabling this setting restricts users with `CHANGEFEED` on a set of tables to create enterprise changefeeds into external connections only. To use a given external connection, a user typically needs the `USAGE` privilege on it. Note that `ALTER DEFAULT PRIVILEGES` can be used with both the `CHANGEFEED` and `SELECT` privileges to assign coarse-grained permissions (i.e., assign permissions to all tables in a schema rather than manually assign them for each table). [#94796][#94796] - Deprecated the `PGDUMP` and `MYSQLDUMP` formats for [`IMPORT`](https://www.cockroachlabs.com/docs/v23.1/import). They are still present, but will be removed in a future release. See the [Migration Overview](https://www.cockroachlabs.com/docs/v23.1/migration-overview) page for alternatives. [#96386][#96386]

Known limitations

diff --git a/src/current/_includes/v23.1/cdc/ext-conn-cluster-setting.md b/src/current/_includes/v23.1/cdc/ext-conn-cluster-setting.md index 8b254b6b617..2bda230f066 100644 --- a/src/current/_includes/v23.1/cdc/ext-conn-cluster-setting.md +++ b/src/current/_includes/v23.1/cdc/ext-conn-cluster-setting.md @@ -1 +1 @@ -{% include_cached new-in.html version="v23.1" %} To restrict a user's access to changefeed data and sink credentials, enable the `changefeed.permissions.enforce_external_connections` cluster setting. When you enable this setting, users with the {% if page.name == "create-changefeed.md" %} `CHANGEFEED` privilege {% else %} [`CHANGEFEED` privilege]({% link {{ page.version.version }}/create-changefeed.md %}#required-privileges) {% endif %} on a set of tables can only create changefeeds into {% if page.name == "create-external-connection.md" %} external connections {% else %} [external connections]({% link {{ page.version.version }}/create-external-connection.md %}) {% endif %}. +{% include_cached new-in.html version="v23.1" %} To restrict a user's access to changefeed data and sink credentials, enable the `changefeed.permissions.require_external_connection_sink.enabled` cluster setting. When you enable this setting, users with the {% if page.name == "create-changefeed.md" %} `CHANGEFEED` privilege {% else %} [`CHANGEFEED` privilege]({% link {{ page.version.version }}/create-changefeed.md %}#required-privileges) {% endif %} on a set of tables can only create changefeeds into {% if page.name == "create-external-connection.md" %} external connections {% else %} [external connections]({% link {{ page.version.version }}/create-external-connection.md %}) {% endif %}. diff --git a/src/current/_includes/v23.1/cdc/privilege-model.md b/src/current/_includes/v23.1/cdc/privilege-model.md index 5020c324053..3861199fd42 100644 --- a/src/current/_includes/v23.1/cdc/privilege-model.md +++ b/src/current/_includes/v23.1/cdc/privilege-model.md @@ -1,5 +1,5 @@ {{site.data.alerts.callout_info}} -Starting in v22.2, CockroachDB introduces a new [system-level privilege model]({% link {{ page.version.version }}/security-reference/authorization.md %}#supported-privileges) that provides finer control over a user's privilege to work with the database, including creating and managing changefeeds. +Starting in v22.2, CockroachDB introduces a new [system-level privilege model]({% link {{ page.version.version }}/security-reference/authorization.md %}#supported-privileges) that provides finer control over a user's privilege to work with the database, including creating and managing changefeeds. There is continued support for the [legacy privilege model](#legacy-privilege-model) for changefeeds in v23.1, however it **will be removed** in a future release of CockroachDB. We recommend implementing the new privilege model that follows in this section for all changefeeds. {{site.data.alerts.end}} @@ -13,7 +13,7 @@ GRANT CHANGEFEED ON TABLE example_table TO user; When you grant a user the `CHANGEFEED` privilege on a set of tables, they can: -- Create changefeeds on the target tables even if the user does **not** have the [`CONTROLCHANGEFEED` role option]({% link {{ page.version.version }}/alter-role.md %}#role-options) or the `SELECT` privilege on the tables. +- Create changefeeds on the target tables even if the user does **not** have the [`CONTROLCHANGEFEED` role option]({% link {{ page.version.version }}/alter-role.md %}#role-options) or the `SELECT` privilege on the tables. - {% include_cached new-in.html version="v23.1" %} Manage the changefeed jobs running on the tables using the [`SHOW CHANGEFEED JOB`]({% link {{ page.version.version }}/show-jobs.md %}#show-changefeed-jobs), [`PAUSE JOB`]({% link {{ page.version.version }}/pause-job.md %}), [`RESUME JOB`]({% link {{ page.version.version }}/resume-job.md %}), and [`CANCEL JOB`](cancel-job.html) commands. These users will be able to create changefeeds, but they will not be able to run a `SELECT` query on that data directly. However, they could still read this data indirectly if they have read access to the [sink]({% link {{ page.version.version }}/changefeed-sinks.md %}). @@ -24,10 +24,10 @@ These users will be able to create changefeeds, but they will not be able to run The following summarizes the operations users can run when they have changefeed privileges on a table: -Granted privileges | Usage +Granted privileges | Usage -------------------+------- `CHANGEFEED` | Create changefeeds on tables.
Manage changefeed jobs on tables. -`CHANGEFEED` + [`USAGE`]({% link {{ page.version.version }}/create-external-connection.md %}#required-privileges) on external connection | Create changefeeds on tables to an external connection URI.
Manage changefeed jobs on tables.
**Note:** If you need to manage access to changefeed sink URIs, set the `changefeed.permissions.enforce_external_connections=true` cluster setting. This will mean that users with these privileges can **only** create changefeeds on external connections. +`CHANGEFEED` + [`USAGE`]({% link {{ page.version.version }}/create-external-connection.md %}#required-privileges) on external connection | Create changefeeds on tables to an external connection URI.
Manage changefeed jobs on tables.
**Note:** If you need to manage access to changefeed sink URIs, set the `changefeed.permissions.require_external_connection_sink.enabled=true` cluster setting. This will mean that users with these privileges can **only** create changefeeds on external connections. `SELECT` | Create a sinkless changefeed that emits messages to a SQL client. **Deprecated** `CONTROLCHANGEFEED` role option + `SELECT` | Create changefeeds on tables. diff --git a/src/current/_includes/v23.2/cdc/ext-conn-cluster-setting.md b/src/current/_includes/v23.2/cdc/ext-conn-cluster-setting.md index a7fb38f0b71..82d266ce59d 100644 --- a/src/current/_includes/v23.2/cdc/ext-conn-cluster-setting.md +++ b/src/current/_includes/v23.2/cdc/ext-conn-cluster-setting.md @@ -1 +1 @@ -To restrict a user's access to changefeed data and sink credentials, enable the `changefeed.permissions.enforce_external_connections` cluster setting. When you enable this setting, users with the [`CHANGEFEED` privilege]({% link {{ page.version.version }}/create-changefeed.md %}#required-privileges) on a set of tables can only create changefeeds into [external connections]({% link {{ page.version.version }}/create-external-connection.md %}). +To restrict a user's access to changefeed data and sink credentials, enable the `changefeed.permissions.require_external_connection_sink.enabled` cluster setting. When you enable this setting, users with the [`CHANGEFEED` privilege]({% link {{ page.version.version }}/create-changefeed.md %}#required-privileges) on a set of tables can only create changefeeds into [external connections]({% link {{ page.version.version }}/create-external-connection.md %}). diff --git a/src/current/_includes/v23.2/cdc/privilege-model.md b/src/current/_includes/v23.2/cdc/privilege-model.md index 293724d2460..e7b8153004c 100644 --- a/src/current/_includes/v23.2/cdc/privilege-model.md +++ b/src/current/_includes/v23.2/cdc/privilege-model.md @@ -1,5 +1,5 @@ {{site.data.alerts.callout_info}} -Starting in v22.2, CockroachDB introduces a new [system-level privilege model]({% link {{ page.version.version }}/security-reference/authorization.md %}#supported-privileges) that provides finer control over a user's privilege to work with the database, including creating and managing changefeeds. +Starting in v22.2, CockroachDB introduces a new [system-level privilege model]({% link {{ page.version.version }}/security-reference/authorization.md %}#supported-privileges) that provides finer control over a user's privilege to work with the database, including creating and managing changefeeds. There is continued support for the [legacy privilege model](#legacy-privilege-model) for changefeeds in v23.1, however it **will be removed** in a future release of CockroachDB. We recommend implementing the new privilege model that follows in this section for all changefeeds. {{site.data.alerts.end}} @@ -13,7 +13,7 @@ GRANT CHANGEFEED ON TABLE example_table TO user; When you grant a user the `CHANGEFEED` privilege on a set of tables, they can: -- Create changefeeds on the target tables even if the user does **not** have the [`CONTROLCHANGEFEED` role option]({% link {{ page.version.version }}/alter-role.md %}#role-options) or the `SELECT` privilege on the tables. +- Create changefeeds on the target tables even if the user does **not** have the [`CONTROLCHANGEFEED` role option]({% link {{ page.version.version }}/alter-role.md %}#role-options) or the `SELECT` privilege on the tables. - Manage the changefeed jobs running on the tables using the [`SHOW CHANGEFEED JOB`]({% link {{ page.version.version }}/show-jobs.md %}#show-changefeed-jobs), [`PAUSE JOB`]({% link {{ page.version.version }}/pause-job.md %}), [`RESUME JOB`]({% link {{ page.version.version }}/resume-job.md %}), and [`CANCEL JOB`](cancel-job.html) commands. These users will be able to create changefeeds, but they will not be able to run a `SELECT` query on that data directly. However, they could still read this data indirectly if they have read access to the [sink]({% link {{ page.version.version }}/changefeed-sinks.md %}). @@ -24,10 +24,10 @@ These users will be able to create changefeeds, but they will not be able to run The following summarizes the operations users can run when they have changefeed privileges on a table: -Granted privileges | Usage +Granted privileges | Usage -------------------+------- `CHANGEFEED` | Create changefeeds on tables.
Manage changefeed jobs on tables. -`CHANGEFEED` + [`USAGE`]({% link {{ page.version.version }}/create-external-connection.md %}#required-privileges) on external connection | Create changefeeds on tables to an external connection URI.
Manage changefeed jobs on tables.
**Note:** If you need to manage access to changefeed sink URIs, set the `changefeed.permissions.enforce_external_connections=true` cluster setting. This will mean that users with these privileges can **only** create changefeeds on external connections. +`CHANGEFEED` + [`USAGE`]({% link {{ page.version.version }}/create-external-connection.md %}#required-privileges) on external connection | Create changefeeds on tables to an external connection URI.
Manage changefeed jobs on tables.
**Note:** If you need to manage access to changefeed sink URIs, set the `changefeed.permissions.require_external_connection_sink.enabled=true` cluster setting. This will mean that users with these privileges can **only** create changefeeds on external connections. `SELECT` | Create a sinkless changefeed that emits messages to a SQL client. **Deprecated** `CONTROLCHANGEFEED` role option + `SELECT` | Create changefeeds on tables.