Skip to content

Conversation

@djahandarie
Copy link

@djahandarie djahandarie commented Jan 28, 2026

Motivation

Our CI/CD pipeline uses dbt to deploy Materialize objects in a multi-tenant Materialize instance that uses RBAC heavily. The CI/CD pipeline uses the mz_system user, so the objects it creates are owned by mz_system.

However, due to Materialize's RBAC model,

the owner of the view/materialized view (including those with superuser privileges) must have all required SELECT and USAGE privileges to run the view definition regardless of who is selecting from the view/materialized view.

we are required to do explicit grants of USAGE/SELECT to mz_system on all the objects, which feels both redundant and confusing given that mz_system is a superuser, and is not related to the role running queries against the objects.

So, we'd like dbt to be able to swap the owner of each object to the appropriate tenant's role at creation time.

Tips for reviewer

This is not yet tested, and I can't access buildkit 😅

Checklist

  • This PR has adequate test coverage / QA involvement has been duly considered. (trigger-ci for additional test/nightly runs)
  • This PR has an associated up-to-date design doc, is a design doc (template), or is sufficiently small to not require a design.
  • If this PR evolves an existing $T ⇔ Proto$T mapping (possibly in a backwards-incompatible way), then it is tagged with a T-proto label.
  • If this PR will require changes to cloud orchestration or tests, there is a companion cloud PR to account for those changes that is tagged with the release-blocker label (example).
  • If this PR includes major user-facing behavior changes, I have pinged the relevant PM to schedule a changelog post.

@djahandarie djahandarie requested a review from a team as a code owner January 28, 2026 06:26
@github-actions
Copy link

Thank you for your submission! We really appreciate it. Like many source-available projects, we require that you sign our Contributor License Agreement (CLA) before we can accept your contribution.

You can sign the CLA by posting a comment with the message below.


I have read the Contributor License Agreement (CLA) and I hereby sign the CLA.


You can retrigger this bot by commenting recheck in this Pull Request. Posted by the CLA Assistant Lite bot.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant