Struct PostgresPolicySpec 

pub struct PostgresPolicySpec {

    pub connection: ConnectionSpec,
    pub interval: String,
    pub suspend: bool,
    pub mode: PolicyMode,
    pub reconciliation_mode: CrdReconciliationMode,
    pub default_owner: Option<String>,
    pub profiles: HashMap<String, ProfileSpec>,
    pub schemas: Vec<SchemaBinding>,
    pub roles: Vec<RoleSpec>,
    pub grants: Vec<Grant>,
    pub default_privileges: Vec<DefaultPrivilege>,
    pub memberships: Vec<Membership>,
    pub retirements: Vec<RoleRetirement>,
}

Spec for a PostgresPolicy custom resource.

Defines the desired state of PostgreSQL roles, grants, default privileges, and memberships for a single database connection.

Fields

connection: ConnectionSpec

Database connection configuration.

interval: String

Reconciliation interval (e.g. “5m”, “1h”). Defaults to “5m”.

suspend: bool

Suspend reconciliation when true. Defaults to false.

mode: PolicyMode

Reconciliation mode: apply executes SQL, plan computes drift only.

reconciliation_mode: CrdReconciliationMode

Convergence strategy: how aggressively to converge the database.

• authoritative (default): full convergence — anything not in the manifest is revoked/dropped.
• additive: only grant, never revoke — safe for incremental adoption.
• adopt: manage declared roles fully, but never drop undeclared roles.

default_owner: Option<String>

Default owner for ALTER DEFAULT PRIVILEGES (e.g. “app_owner”).

profiles: HashMap<String, ProfileSpec>

Reusable privilege profiles.

schemas: Vec<SchemaBinding>

Schema bindings that expand profiles into concrete roles/grants.

roles: Vec<RoleSpec>

One-off role definitions.

grants: Vec<Grant>

One-off grants.

default_privileges: Vec<DefaultPrivilege>

One-off default privileges.

memberships: Vec<Membership>

Membership edges.

retirements: Vec<RoleRetirement>

Explicit role-retirement workflows for roles that should be removed.

Implementations

impl PostgresPolicySpec

pub fn validate_password_specs( &self, policy_name: &str, ) -> Result<(), PasswordValidationError>

pub fn referenced_secret_names(&self, policy_name: &str) -> BTreeSet<String>

All Kubernetes Secret names referenced by this spec.

Includes the connection Secret, password secretRef Secrets, and generated password Secrets. Used by the controller to trigger reconciliation when any of these Secrets change (or are deleted).

impl PostgresPolicySpec

pub fn to_policy_manifest(&self) -> PolicyManifest

Convert the CRD spec into a PolicyManifest for use with the core library.

pub fn ownership_claims(&self) -> Result<OwnershipClaims, ManifestError>

Derive a conservative ownership claim set from the policy spec.

This intentionally claims all declared/expanded roles and all referenced schemas so overlapping policies are rejected safely.

Trait Implementations

impl Clone for PostgresPolicySpec

fn clone(&self) -> PostgresPolicySpec

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for PostgresPolicySpec

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for PostgresPolicySpec

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl JsonSchema for PostgresPolicySpec

fn schema_name() -> Cow<'static, str>

The name of the generated JSON Schema.

fn schema_id() -> Cow<'static, str>

Returns a string that uniquely identifies the schema produced by this type.

fn json_schema(generator: &mut SchemaGenerator) -> Schema

Generates a JSON Schema for this type.

fn inline_schema() -> bool

Whether JSON Schemas generated for this type should be included directly in parent schemas, rather than being re-used where possible using the $ref keyword.

impl Serialize for PostgresPolicySpec

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.