[sdairs]

CLI exposure for the Postgres part of the #1112 drift remediation. Refs #1112. Stacked on API 3 (#1121, cursor/openapi-drift-1112-api-clickstack-c05d), which it merges; the Postgres library changes it uses are in API 1 (#1117).

Follow-up issues

I can't open issues from this environment. This PR's tracking issue would read:

CLI: Postgres IP access rules and new pgConfig settings (#1112). Expose cloud postgres create --ip-allow IP_OR_CIDR:PORTS[=DESCRIPTION] (repeatable) and --block-public-access; cloud postgres update --add-ip-allow and --remove-ip-allow RULE_ID_OR_SOURCE; IP rules in cloud postgres get; the 22 new pgConfig keys. Not exposed: editing a rule in place (add with an existing id), since remove and re-add covers it with simpler syntax.

Changes

• postgres create adds --ip-allow IP_OR_CIDR:PORTS[=DESCRIPTION] (repeatable). PORTS is 5432, 6432 or an inclusive range like 5432..6432. Sources must be IPv4 (the API ignores IPv6), and clap rejects bad input as a usage error. --block-public-access sends an empty list; it conflicts with --ip-allow. Without either flag, the request still omits ipAccessList, which keeps the API's allow-all default.
• postgres update adds --add-ip-allow (same syntax) and --remove-ip-allow RULE_ID_OR_SOURCE. Removal matches a rule ID or every rule for a source (a bare IP means its /32) against the list returned by the pre-update GET. The update already did that GET for tags; it now also runs with --clear-tags when a removal is requested, and the permission declaration says so. An unmatched value is a usage error before any PATCH, mirroring cloud service update --remove-ip-allow.
• postgres get (human output) lists the rules with their IDs, or none (public access blocked) for an empty list.
• pgConfig: the 22 new settings are accepted, and default_toast_compression, enable_parallel_hash, io_method and log_lock_waits are checked against the library VALUES.
• Help text follows the cli-help-text skill. The create help warns about the allow-all default, and the update help notes that removals apply first and can partially succeed.
• docs/guides/managed-postgres.md gains a "Restrict network access" section.

Tests

• Parsing: flag repetition, the --block-public-access/--ip-allow conflict, value validation (IPv6, CIDR prefix, port range bounds and order, empty description).
• Request builders: create (omitted, blocked, listed) and update (ipAccessList patch serialization).
• Removal resolution: by ID, by source with multiple ports, deduplication, unmatched value as a usage error, missing list.
• Subprocess with wiremock: create sends the rules or an empty list; update resolves removals from the GET (with and without --clear-tags); an unmatched removal exits 2 without a PATCH; get prints the rules.
• The new pgConfig keys round-trip, and invalid values for the new enums are rejected.

Verification

cargo fmt --all --check, cargo clippy -p clickhousectl -- -D warnings, cargo clippy -p clickhousectl --all-targets --no-default-features -- -D warnings, cargo check -p clickhousectl --no-default-features and cargo test -p clickhousectl all pass. No files added or renamed.

  

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}