v.22.6Improvement
Add Separate CLUSTER Grant and Backward Compatibility Configuration Directive
Add separateCLUSTERgrant (andaccess_control_improvements.on_cluster_queries_require_cluster_grantconfiguration directive, for backward compatibility, default tofalse). #35767 (Azat Khuzhin).
Why it matters
This feature provides improved security by allowing administrators to explicitly grant permissions for executing queries on clusters. It addresses the need to separate cluster query permissions from other privileges, reducing risks and improving clarity in access management.How to use it
To enable the separateCLUSTER grant, assign the CLUSTER privilege to the appropriate users or roles. For backward compatibility, the configuration directive access_control_improvements.on_cluster_queries_require_cluster_grant is introduced and defaults to false. Set it to true to enforce this new grant requirement.