Repository navigation
Minimum Postgres security posture For GA #2097
Description
To successfully and securely bring Substrate to GA we need to make sure that the way Substrate is using Postgres is secure by default. In order to accomplish that we should do the following:
-
Separate out DDL and DML roles to ensure a clean separation between the persona creating/modifying the schema, and the persona accessing/modifying the data in the DB. This will require the presence of 2 roles in the DB prior to Substrate connecting to it. In order to do this we should:
a. Add a bootstrap step to ate-setup which properly bootstraps the roles in the included DB
b. Document how the roles can be properly added to Cloud/other existing DBs for Substrate to successfully connect. -
Ensure that all connections from Substrate to the DB are properly secured. For the bundled PG this can most likely use mTLS pod certs (research to come). For the cloud DBs use sidecars like gcloud today.
Activity
EItanya commentedon Oct 1, 2026
I can't assign Jeremy Alvis (@iplay88keys) for some reason, but he will be taking this across the finish line
iplay88keys commentedon Oct 2, 2026
Work/PRs associated with this:
Other areas I won't be tackling as part of this at this phase, but are worth noting:
As this covers our minimum security posture for GA, these will also be deferred for now:
Authenticate bundled PostgreSQL logins with separate pod certificates (…
iplay88keys commentedon Oct 13, 2026
Mofi Rahman (@moficodes), I believe you have been working on docs. Just wanted to raise these aspects (that I pulled out of my above comment) and get your opinion on how to get documentation around them:
ate-setupfrom Set up bundled PostgreSQL identities in ate-setup #2025 for operators to use when setting up dbsdestijl commentedon Oct 13, 2026
The GA part of this is done minus some docs, so to help our M3 burndown I think we should either remove M3 if we're leaving this open, or close it and file non-M3 blocking issues. I think I'd rather we did the second, but no strong opinion.
EItanya commentedon Oct 13, 2026
Agreed, I will close