Repository navigation
fix(#2810): PSE setup is instance-level admin, not a container grant - #2848
Merged
Merged
Conversation
…iner grant Remove db/src/defaults/default_access_role.hdbrole entirely. The PSE and remote source are one-time, database-level admin objects — shared across containers/apps — not HDI container artifacts. Baking TRUST ADMIN into default_access_role would over-privilege every app binding user permanently for a one-time setup, and the container #OO can't delegate PKI system privileges anyway (confirmed: #OO not allowed to grant CERTIFICATE ADMIN, DEV 20261019-125352). This also unblocks DEV deploys, which were failing every db-deployer run on the TRUST ADMIN grant since #2846/#2847. Correct split (runbook rewritten): - B1: a HANA admin creates PSE + remote source once (needs TRUST ADMIN + CREATE REMOTE SOURCE). CERTIFICATE ADMIN is managed-PSE-only, not needed. - B2: container gets only GRANT EXECUTE ON REMOTE SOURCE TUTORIALS_AICORE. - B3: VECTOR_EMBEDDING proof, unchanged. - All three failed container-grant attempts recorded in a details block. default_access_role.hdbrole remains the right mechanism for privileges the container user should own long-term — just not for this.
This was referenced Oct 19, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Corrects the approach direction from #2846/#2847. The PSE +
CREATE REMOTE SOURCEfor HANA↔AI Core embeddings are a one-time, instance-level admin action — shared database objects, not HDI container artifacts. Trying to grant the PSE privilege into thetutorials-hanacontainer was the wrong shape.Why
TRUST ADMINintodefault_access_rolewould permanently over-privilege every app binding user for a one-time task.#OOcan't delegate PKI system privileges anyway — confirmed on DEV (20261019-125352):user "…#OO" is not allowed to grant the privilege "CERTIFICATE ADMIN".Changes
db/src/defaults/default_access_role.hdbrole. This also unblocks DEV deploys, which have failed everytutorials-db-deployerrun since fix(#2810): grant CREATE PSE via default_access_role.hdbrole #2846 landed the (broken) role.TRUST ADMIN+CREATE REMOTE SOURCE;CERTIFICATE ADMINis managed-PSE-only and not needed).GRANT EXECUTE ON REMOTE SOURCE TUTORIALS_AICORE.VECTOR_EMBEDDINGproof, unchanged.default_access_role.hdbroleis still the right tool for privileges the container user should own long-term — just not for one-time instance-level admin setup.Next (after merge)
DEV HANA admin runs B1 + B2 (one-time), then I run B3 to prove Tier B. Tier A (built-in NLP) already green.