Set the cluster to read-only in yugabytedb

General
1

Hi
Is there a global switch that can set the entire cluster to read-only in yugabytedb ?
That is to say, after setting the switch, all nodes in the cluster will accept user operations only as read-only, and write operations will be rejected.
Thanks a lot.

2

Hi @ZhenNan2016

There is no such mode. Maybe you can create a read-only user in YSQL?

3

There is a parameter called default_transaction_read_only that can be set to make all transactions read only.

See: Make a Database Read Only
See: Ensure a Read Replica Cluster is Strictly Read-Only

However, the setting can be overridden easily at the session level.

As Dorian suggested, a read only user is a good option.
See: Create a Read Only User

Note that PG15 support is coming to YB! So the pg_read_all_data role will available real soon! :slight_smile:

4

Hi, @Jim_Knicely.
Thanks for the reply.
Read-only switches based on session level may not fulfill the requirements. My requirement is that I want all sessions, all users, to have read-only access to the database, not write.
Thanks a lot.

5

Can you explain the requirement more? Why can’t you just create read-only users?

6

Hi.
There is such a scenario, the user originally has read and write permissions, but will be triggered based on a certain condition, do not want the user to continue to write data, only read the old data.
If the control is based on the user, there are two demand points:
1, if the user has been created, with read and write access, it also needs to be changed to read-only, preventing the continuation of writing.
2, if you re-create a user that can read and write operations, then also still have read and write permissions. This way, the user can’t be in read-only state after a certain condition is triggered.

Thanks a lot.

7

I didn’t understand why you can’t use per-role though. Why not alter role and only allow reads when your condition is triggered?

8

Hi
If the control user permissions are read-only, it is OK for old usernames. If you create another user, is it possible to read and write to the database again? To draw an analogy:
Original test-a, set to read-only, no problem. However, if you re-create test-b, you can read and write again, which violates the “read-only” principle.
The general principle is that you want the entire cluster, i.e. all nodes, to be read-only for all user operations.
Thanks.