Exclude template DBs from discovery and schema-qualify discovery query #50
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
When doing database auto-discovery, exclude all databases marked as templates and any databases that do not allow connections.
It's conceivable, but not very likely, that someone could want to scrape metrics from a template DB, but pg_exporter currently defaults to excluding template1 anyway. postgres_exporter also has the same behaviour of excluding template DBs from discovery. So I did not add a CLI option to override this behaviour.
Additionally, schema-qualify references to
pg_database
and thepg_is_in_recovery
function call in the database discovery query to guarantee protection against any possiblesearch_path
based attacks. I can't immediately see how it'd be possible in this case, so it's not a vulnerability, but it's best practice to always schema-qualify everything in any query that could possibly be run as a privileged role.