Let mdb_admin manage resource groups

.github/workflows/build-cloudberry-rocky8.yml

@@ -311,6 +311,7 @@ jobs:
                                "contrib/pgstattuple:installcheck",
                                "contrib/tablefunc:installcheck",
                                "contrib/passwordcheck:installcheck",
+                               "contrib/pg_aux_catalog:installcheck",
                                "contrib/pg_buffercache:installcheck",
                                "contrib/sslinfo:installcheck"]
               },

.github/workflows/build-cloudberry.yml

@@ -304,6 +304,7 @@ jobs:
                                "contrib/pgstattuple:installcheck",
                                "contrib/tablefunc:installcheck",
                                "contrib/passwordcheck:installcheck",
+                               "contrib/pg_aux_catalog:installcheck",
                                "contrib/pg_buffercache:installcheck",
                                "contrib/sslinfo:installcheck"]
               },

.github/workflows/build-deb-cloudberry.yml

@@ -243,6 +243,7 @@ jobs:
                                "contrib/pgstattuple:installcheck",
                                "contrib/tablefunc:installcheck",
                                "contrib/passwordcheck:installcheck",
+                               "contrib/pg_aux_catalog:installcheck",
                                "contrib/pg_buffercache:installcheck",
                                "contrib/sslinfo:installcheck"]
               },

contrib/Makefile

@@ -34,6 +34,7 @@ SUBDIRS = \
 		old_snapshot	\
 		pageinspect	\
 		passwordcheck	\
+		pg_aux_catalog	\
 		postgres_fdw \
 		pg_buffercache	\
 		pg_freespacemap \

contrib/pg_aux_catalog/.gitignore

@@ -0,0 +1,6 @@
+# Generated test output
+/log/
+/results/
+/tmp_check/
+/isolation2/results/
+/isolation2/output_iso/

contrib/pg_aux_catalog/Makefile

@@ -0,0 +1,37 @@
+# contrib/pg_aux_catalog/Makefile
+
+MODULE_big = pg_aux_catalog
+OBJS = \
+	$(WIN32RES) \
+	pg_aux_catalog.o
+
+EXTENSION = pg_aux_catalog
+DATA = pg_aux_catalog--1.0.sql
+
+PGFILEDESC = "pg_aux_catalog - auxiliary catalog management"
+
+REGRESS = pg_aux_catalog
+REGRESS_OPTS = --init-file=$(top_srcdir)/src/test/regress/init_file
+
+ifdef USE_PGXS
+PG_CONFIG = pg_config
+PGXS := $(shell $(PG_CONFIG) --pgxs)
+include $(PGXS)
+else
+subdir = contrib/pg_aux_catalog
+top_builddir = ../..
+include $(top_builddir)/src/Makefile.global
+include $(top_srcdir)/contrib/contrib-global.mk
+endif
+
+# Multi-session resource-group permission tests, run with the GPDB isolation2
+# harness.  Requires a running cluster with resource groups enabled
+# (gp_resource_manager=group); see installcheck-resgroup in
+# src/test/isolation2.  Not part of the default "installcheck".
+installcheck-isolation2: install
+	$(pg_isolation2_regress_installcheck) \
+	  --init-file=$(top_builddir)/src/test/regress/init_file \
+	  --inputdir=$(srcdir)/isolation2 \
+	  --outputdir=isolation2 \
+	  --schedule=$(srcdir)/isolation2/isolation2_schedule
+

contrib/pg_aux_catalog/README.md

@@ -0,0 +1,71 @@
+# pg_aux_catalog
+
+Auxiliary catalog management for Apache Cloudberry.
+
+This extension provisions the **`mdb_admin`** privilege role, which lets a
+non-superuser manage resource groups in managed-service deployments where the
+client is never given superuser.
+
+## Background
+
+In Greenplum/Cloudberry only a superuser may `CREATE`/`ALTER`/`DROP` resource
+groups or move a running query between groups with `pg_resgroup_move_query()`.
+The server gates those four entry points on membership of `mdb_admin`,
+identified by a **fixed OID (8067)** rather than by name, so the privilege is
+recognised reliably across the coordinator and all segments.
+
+A fixed OID cannot be obtained from a plain `CREATE ROLE` (that assigns an
+ordinary OID). This extension provides the one supported way to create the
+role at OID 8067.
+
+## Functions
+
+### `pg_create_mdb_admin_role() returns oid`
+
+Creates the `mdb_admin` role with its fixed OID (8067).
+Returns the OID of the created role (8067). Errors if a role with that OID or
+the name `mdb_admin` already exists. The OID assignment is dispatched to the
+segments, so the role has the same OID cluster-wide.
+
+## Usage
+
+```sql
+CREATE EXTENSION pg_aux_catalog;
+
+-- Provision the role (the control plane does this once per cluster).
+SELECT pg_create_mdb_admin_role();
+
+-- Grant the capability to a tenant admin.
+GRANT mdb_admin TO cloud_admin;
+
+-- cloud_admin can now manage resource groups without superuser:
+SET ROLE cloud_admin;
+CREATE RESOURCE GROUP rg_tenant WITH (concurrency = 4, cpu_max_percent = 20);
+ALTER  RESOURCE GROUP rg_tenant SET cpu_max_percent 30;
+DROP   RESOURCE GROUP rg_tenant;
+```
+
+`admin_group` and `system_group` remain superuser-only for `ALTER`/`DROP`:
+they are infrastructure, not user-tunable groups.
+
+## Building and testing
+
+```sh
+make -C contrib/pg_aux_catalog install
+make -C contrib/pg_aux_catalog installcheck
+```
+
+`installcheck` runs a single-session regression test (role creation and the
+resource-group permission gate). A multi-session isolation2 test covering the
+dispatched / cross-session behaviour lives under `isolation2/` and is run
+separately, against a cluster with resource groups enabled
+(`gp_resource_manager=group`):
+
+```sh
+make -C contrib/pg_aux_catalog installcheck-isolation2
+```
+
+## Credits
+
+Based on [pg-sharding/cpg](https://github.com/pg-sharding/cpg) commit
+`7b8c912`. Some tests are adapted from open-gpdb/gpdb commit `3ac99962ad2`.

contrib/pg_aux_catalog/expected/pg_aux_catalog.out

@@ -0,0 +1,46 @@
+-- Tests for the pg_aux_catalog extension: creation of the fixed-OID
+-- mdb_admin role and the resource-group permission gate it enables.
+CREATE EXTENSION pg_aux_catalog;
+-- ---------------------------------------------------------------------
+-- pg_create_mdb_admin_role() creates the mdb_admin role with its fixed OID.
+-- ---------------------------------------------------------------------
+SELECT pg_create_mdb_admin_role() AS mdb_admin_oid;
+ mdb_admin_oid 
+---------------
+          8067
+(1 row)
+
+-- The role exists with the fixed OID and is a non-login, non-superuser,
+-- connection-limited role.
+SELECT oid = 8067 AS has_fixed_oid, rolcanlogin, rolsuper,
+       rolcreaterole, rolcreatedb, rolconnlimit
+  FROM pg_authid WHERE rolname = 'mdb_admin';
+ has_fixed_oid | rolcanlogin | rolsuper | rolcreaterole | rolcreatedb | rolconnlimit 
+---------------+-------------+----------+---------------+-------------+--------------
+ t             | f           | f        | f             | f           |            0
+(1 row)
+
+-- Creating it a second time is rejected.
+SELECT pg_create_mdb_admin_role();
+ERROR:  role with OID 8067 already exists
+-- ---------------------------------------------------------------------
+-- Resource-group permission gate: a role that is not a member of mdb_admin
+-- is rejected on every entry point.  These checks run before the "resource
+-- group is enabled" check, so they are deterministic regardless of the
+-- resource manager in use.
+-- ---------------------------------------------------------------------
+CREATE ROLE regress_rg_noadmin;
+SET ROLE regress_rg_noadmin;
+CREATE RESOURCE GROUP regress_rg_x WITH (concurrency=1, cpu_max_percent=5);
+ERROR:  must be mdb_admin to create resource groups
+ALTER RESOURCE GROUP regress_rg_x SET cpu_max_percent 6;
+ERROR:  must be mdb_admin to alter resource groups
+DROP RESOURCE GROUP regress_rg_x;
+ERROR:  must be mdb_admin to drop resource groups
+RESET ROLE;
+DROP ROLE regress_rg_noadmin;
+-- ---------------------------------------------------------------------
+-- Cleanup.
+-- ---------------------------------------------------------------------
+DROP ROLE mdb_admin;
+DROP EXTENSION pg_aux_catalog;

contrib/pg_aux_catalog/isolation2/expected/resgroup_mdb_admin.out

@@ -0,0 +1,123 @@
+-- Tests permission checks for the mdb_admin role with
+-- resource groups enabled.
+
+-- start_matchsubs
+-- m/ERROR:  cannot find process: \d+/
+-- s/\d+/XXX/g
+-- end_matchsubs
+
+DROP ROLE IF EXISTS role_rg_admin;
+DROP
+DROP ROLE IF EXISTS role_rg_noadmin;
+DROP
+DROP ROLE IF EXISTS mdb_admin;
+DROP
+-- start_ignore
+DROP RESOURCE GROUP rg_perm_admin1;
+DROP RESOURCE GROUP rg_perm_admin2;
+DROP RESOURCE GROUP rg_perm_revoke1;
+DROP RESOURCE GROUP rg_perm_revoke2;
+DROP RESOURCE GROUP rg_perm_test;
+-- end_ignore
+
+-- ---------------------------------------------------------------------
+-- Setup.  The mdb_admin role is not predefined in the catalog; it is
+-- created here the same way the control plane provisions it at runtime.
+-- ---------------------------------------------------------------------
+CREATE RESOURCE GROUP rg_perm_test WITH (concurrency=2, cpu_max_percent=10);
+CREATE
+CREATE ROLE mdb_admin;
+CREATE
+CREATE ROLE role_rg_admin RESOURCE GROUP rg_perm_test;
+CREATE
+CREATE ROLE role_rg_noadmin RESOURCE GROUP rg_perm_test;
+CREATE
+GRANT mdb_admin TO role_rg_admin;
+GRANT
+
+-- ---------------------------------------------------------------------
+-- 1. Member of mdb_admin can CREATE/ALTER/DROP resource groups
+--    (statements are dispatched to segments).
+-- ---------------------------------------------------------------------
+1: SET ROLE role_rg_admin;
+SET
+1: CREATE RESOURCE GROUP rg_perm_admin1 WITH (concurrency=1, cpu_max_percent=5);
+CREATE
+1: ALTER RESOURCE GROUP rg_perm_admin1 SET cpu_max_percent 6;
+ALTER
+1: DROP RESOURCE GROUP rg_perm_admin1;
+DROP
+
+-- 2. Even a member cannot ALTER or DROP the system admin_group.
+1: ALTER RESOURCE GROUP admin_group SET cpu_max_percent 99;
+ERROR:  must be superuser to alter resource group "admin_group"
+1: DROP RESOURCE GROUP admin_group;
+ERROR:  must be superuser to drop resource group "admin_group"
+1q: ... <quitting>
+
+-- ---------------------------------------------------------------------
+-- 3. A non-member is rejected on every entry point.
+-- ---------------------------------------------------------------------
+2: SET ROLE role_rg_noadmin;
+SET
+2: CREATE RESOURCE GROUP rg_perm_admin2 WITH (concurrency=1, cpu_max_percent=5);
+ERROR:  must be mdb_admin to create resource groups
+2: ALTER RESOURCE GROUP rg_perm_test SET cpu_max_percent 7;
+ERROR:  must be mdb_admin to alter resource groups
+2: DROP RESOURCE GROUP rg_perm_test;
+ERROR:  must be mdb_admin to drop resource groups
+2q: ... <quitting>
+
+-- ---------------------------------------------------------------------
+-- 4. pg_resgroup_move_query() honours the same permission check.
+--    The first call (non-member) must fail with "must be mdb_admin".
+--    The second call (member) gets past the permission gate and
+--    fails on the pid lookup (masked by start_matchsubs above).
+-- ---------------------------------------------------------------------
+3: SET ROLE role_rg_noadmin;
+SET
+3: SELECT pg_resgroup_move_query(999999999, 'admin_group');
+ERROR:  must be mdb_admin to move query
+3: RESET ROLE;
+RESET
+3: SET ROLE role_rg_admin;
+SET
+3: SELECT pg_resgroup_move_query(999999999, 'admin_group');
+ERROR:  cannot find process: XXX
+3q: ... <quitting>
+
+-- ---------------------------------------------------------------------
+-- 5. Cross-session REVOKE takes effect on the granted session's
+--    next statement (the privilege is re-checked per command, not
+--    cached at SET ROLE time).
+-- ---------------------------------------------------------------------
+4: SET ROLE role_rg_admin;
+SET
+4: CREATE RESOURCE GROUP rg_perm_revoke1 WITH (concurrency=1, cpu_max_percent=5);
+CREATE
+5: REVOKE mdb_admin FROM role_rg_admin;
+REVOKE
+4: CREATE RESOURCE GROUP rg_perm_revoke2 WITH (concurrency=1, cpu_max_percent=5);
+ERROR:  must be mdb_admin to create resource groups
+4: DROP RESOURCE GROUP rg_perm_revoke1;
+ERROR:  must be mdb_admin to drop resource groups
+4q: ... <quitting>
+5q: ... <quitting>
+
+-- ---------------------------------------------------------------------
+-- Cleanup. Roles must be dropped before the resource group they
+-- reference, otherwise DROP RESOURCE GROUP fails with
+-- "resource group is used by at least one role".
+-- ---------------------------------------------------------------------
+RESET ROLE;
+RESET
+DROP ROLE role_rg_admin;
+DROP
+DROP ROLE role_rg_noadmin;
+DROP
+DROP ROLE mdb_admin;
+DROP
+DROP RESOURCE GROUP rg_perm_revoke1;
+DROP
+DROP RESOURCE GROUP rg_perm_test;
+DROP

contrib/pg_aux_catalog/isolation2/isolation2_schedule

@@ -0,0 +1 @@
+test: resgroup_mdb_admin