在 GCP 上的表上禁用触发器

Question

I'm doing DB migration and I would need to disable the foreign key constraints on a table in order to migrate peacefully.

From this: How do I temporarily disable triggers in PostgreSQL?

I've gathered that I would need superuser permissions to run:

SET session_replication_role = replica;

and

SET session_replication_role = DEFAULT;

However; on google cloud platform it is impossible to get those privileges as detailed in the docs:

The postgres user is part of the cloudsqlsuperuser role and has the following attributes (privileges): CREATEROLE, CREATEDB, and LOGIN. It does not have the SUPERUSER or REPLICATION attributes

and to this StackOverflow question: upgrade user to superuser in postgres google cloud

I also tried to disable triggers via:

alter table orders.orders disable trigger all;

However; for this it seems to me, that I also need su rights: ERROR: permission denied: "RI_ConstraintTrigger_a_25017" is a system trigger

So then, what is the solution, can I even disable triggers // foreign key constraints on this particular table or not?

Answer 1

Actually you don't need superuser to issue

SET session_replication_role = replica;
SET session_replication_role = default;

you just need REPLICATION ( I just tested it )

ALTER ROLE <your user> REPLICATION;

Answer 2

Like you have read from the documentation , these commands require superuser privileges, which are not available to users in CloudSQL yet.

Because Cloud SQL for PostgreSQL is a managed service, it restricts access to certain system procedures and tables that require advanced privileges.

There is actually an open feature request focusing on this feature. It does not seem to have an ETA yet as per the available info. Regardless, it appears that there are replication services which do not require superuser , as this thread says. Otherwise, GCP also offers the Data Migration Service , which, according to the documentation, supports migrating foreign key constraints for PostgreSQL instances.

Answer 3

There is no way to get superuser privilege but you can gain some of the superuser privileges by setting the right database flags.

Quoting from the documentation: https://cloud.google.com/sql/docs/postgres/flags#session_replication_role

session_replication_role PostgreSQL has a session_replication_role flag which is designed to be used for logical replication and which allows disabling constraint triggers in individual sessions.

Sometimes this flag can also be used for some maintenance operations to circumvent constraint (most often Foreign Key) checks.

This flag can be set in a session by any user which has the REPLICATION property set. The REPLICATION property for any user can be set by cloudsqlsuperuser when one of flags cloudsql.enable_pglogical or cloudsql.logical_decoding is set for the instance.

How you can set a flag in your database is very easy and explained here: https://cloud.google.com/sql/docs/postgres/flags#set_a_database_flag for all cases (console, gcloud, terraform and etc)

What worked for me

I have found the above solution while trying to solve the very same problem. However, as @Paolo Castelletti said,

ALTER ROLE <your user> REPLICATION;

was actually enough for me to apply

SET session_replication_role = replica;

I wanted to share the other approach as well in case it helps someone