Halt upgrades if evr is not owned by foreman

definitions/checks/foreman/check_external_db_evr_permissions.rb

@@ -0,0 +1,55 @@
+module Checks
+  module Foreman
+    class CheckExternalDbEvrPermissions < ForemanMaintain::Check
+      metadata do
+        label :external_db_evr_permissions
+        for_feature :foreman_database
+        description 'Check that external DBs have proper EVR extension permissions'
+        tags :pre_upgrade
+        confine do
+          feature(:foreman_database) && !feature(:foreman_database).local? && feature(:katello)
+        end
+      end
+
+      def run
+        # No check is needed if the evr extension does not exist
+        evr_exists = find_evr_exists
+        return if !evr_exists
+
+        error_msg = 'The evr extension is not owned by the foreman DB owner. Please run the following command to fix it: ' \
+                    "UPDATE pg_extension SET extowner = (SELECT oid FROM pg_authid WHERE rolname='foreman') WHERE extname='evr';"
+        foreman_owns_evr = find_foreman_owns_evr
+        fail!(error_msg) if !foreman_owns_evr
+      end
+
+      def find_evr_exists
+        evr_exists = feature(:foreman_database).query(self.class.query_for_evr_existence)
+        if !evr_exists.empty? && evr_exists.first['evr_exists'] == '1'
+          return evr_exists.first['evr_exists'] == '1'
+        end
+        return false
+      end
+
+      def find_foreman_owns_evr
+        evr_owned_by_postgres = feature(:foreman_database).query(self.class.query_to_find_evr_owner)
+        if !evr_owned_by_postgres.empty?
+          return evr_owned_by_postgres.first['evr_owned_by_postgres'] == '0'
+        end
+        fail!('Could not determine if the evr extension is owned by the foreman DB owner')
+      end
+
+      def self.query_for_evr_existence
+        <<-SQL
+          SELECT 1 AS evr_exists FROM pg_extension WHERE extname = 'evr'
+        SQL
+      end
+
+      def self.query_to_find_evr_owner
+        <<-SQL
+          SELECT CASE WHEN r.rolname = 'foreman' THEN 0 ELSE 1 END AS evr_owned_by_postgres
+          FROM pg_extension e JOIN pg_roles r ON e.extowner = r.oid WHERE e.extname = 'evr'
+        SQL
+      end
+    end
+  end
+end

definitions/scenarios/foreman_upgrade.rb

@@ -40,6 +40,7 @@ def compose
         Checks::Disk::AvailableSpaceCandlepin, # if candlepin
         Checks::Disk::AvailableSpacePostgresql13,
         Checks::Foreman::ValidateExternalDbVersion, # if external database
+        Checks::Foreman::CheckExternalDbEvrPermissions, # if external database
         Checks::Foreman::CheckCorruptedRoles,
         Checks::Foreman::CheckDuplicatePermissions,
         Checks::Foreman::TuningRequirements, # if katello present

definitions/scenarios/satellite_upgrade.rb

@@ -39,6 +39,7 @@ def compose
         Checks::Disk::AvailableSpace,
         Checks::Disk::AvailableSpaceCandlepin, # if candlepin
         Checks::Foreman::ValidateExternalDbVersion, # if external database
+        Checks::Foreman::CheckExternalDbEvrPermissions, # if external database
         Checks::Foreman::CheckCorruptedRoles,
         Checks::Foreman::CheckDuplicatePermissions,
         Checks::Foreman::TuningRequirements, # if katello present