[Yandex Cloud documentation](../../../index.md) > [Yandex Cloud Stackland](../../index.md) > [Step-by-step guides](../index.md) > Databases > Managed Service for PostgreSQL > Creating a user

# Creating a PostgreSQL user

If you have a [PostgreSQL cluster](../../concepts/components/postgresql.md) in your [project](../projects/create-project.md), you can create a user in it, i.e., a PostgreSQL role with login permissions. Use a `PostgresqlRole` resource to define the user. The user password is stored in a Kubernetes Secret: the operator can generate it automatically or you can provide a custom Secret with credentials.

{% list tabs group=instructions %}

- CLI {#cli}

  1. Create the `PostgresqlRole` resource file, e.g., using the `touch postgresqlrole.yaml` command.
  1. Open the file and paste the configuration below into it:

      The naming requirements are as follows:

      * The PostgreSQL role name (`spec.username`) must start with a Latin letter or underscore and can only contain Latin letters, numbers, and underscores.
      * The `PostgresqlRole` resource name (`metadata.name`) must follow this pattern: `<cluster_name>-<username_with_hyphens_instead_of_underscores>.

      {% list tabs %}

      - Minimum configuration

          ```yaml
          apiVersion: postgresql.stackland.yandex.cloud/v1alpha1
          kind: PostgresqlRole
          metadata:
            name: test-cluster-test-user # Name of the PostgresqlRole resource in this format: <cluster-name>-<username-with-dashes-instead-of-underscores>
          spec:
            cluster: test-cluster # Name of PostgresqlCluster resource
            username: test_user # Name of role in PostgreSQL
          ```

          The manifest defines only the required fields, such as the cluster name and the PostgreSQL role name. The password will be automatically generated and stored in a Kubernetes Secret with the same name as the `PostgresqlRole` resource.

      - Configuration with an explicit password

          ```yaml
          apiVersion: v1
          kind: Secret
          metadata:
            name: test-cluster-user-secret
          type: Opaque
          stringData:
            username: test_user # username
            password: "<user_password>" # password
          ---
          apiVersion: postgresql.stackland.yandex.cloud/v1alpha1
          kind: PostgresqlRole
          metadata:
            name: test-cluster-test-user # Name of the PostgresqlRole resource in this format: <cluster-name>-<username-with-dashes-instead-of-underscores>
          spec:
            cluster: test-cluster # Name of PostgresqlCluster resource
            username: test_user # Name of role in PostgreSQL
            authentication:
              type: password
              secretName: test-cluster-user-secret # Name of the Secret with the credentials
          ```

          The manifest defines a Secret with credentials and a `PostgresqlRole` resource that references this Secret via `spec.authentication.secretName`. The Secret must contain the `username` key with the username and the `password` key with the user password.

      - Full configuration

          ```yaml
          apiVersion: v1
          kind: Secret
          metadata:
            name: test-cluster-user-secret
          type: Opaque
          stringData:
            username: test_user # username
            password: "<user_password>" # password
          ---
          apiVersion: postgresql.stackland.yandex.cloud/v1alpha1
          kind: PostgresqlRole
          metadata:
            name: test-cluster-test-user # Name of the PostgresqlRole resource in this format: <cluster-name>-<username-with-dashes-instead-of-underscores>
          spec:
            cluster: test-cluster
            username: test_user
            authentication:
              type: password
              secretName: test-cluster-user-secret
            membership: # Parent roles to include the user in
              - test-parent-role
            options:
              superuser: false # Superuser privileges
              login: true # Allow login
              createdb: false # Permission to create databases
              createrole: false # Permission to create roles
              inherit: true # Permission inheritance from parent roles
              replication: false # Permission to use replication
              bypassRLS: false # Row-level security policy bypass
              connectionLimit: -1 # Limit on simultaneous connections: -1 for no limit
              validUntil: "2026-12-31T23:59:59Z" # Password expiration date in RFC3339 format
          ```

          `spec.options` defines role permissions, such as `superuser`, `login`, `createdb`, `createrole`, `inherit`, `replication`, `bypassRLS`, `connectionLimit`, or `validUntil`. `spec.membership` lists parent roles to include the user in.

      {% endlist %}

  1. Apply the manifest: `kubectl apply -f postgresqlrole.yaml -n <project_name>`. Optionally, you can specify the project name in the `metadata.namespace` resource property and skip it in the command.

- Management console {#console}

  1. If you have not opened a project yet, select one.
  1. In the left-hand menu, select **PostgreSQL Clusters**.
  1. Select the cluster.
  1. Go to the **Users** tab.
  1. Click **Create**.
  1. Fill out the fields as follows:

      * **Name**: Role name in PostgreSQL. The name must start with a Latin letter or `_` and can only contain Latin letters, numbers, and `_`. It may be up to 63 characters long.
      * **Password**: User password. Its value is stored in a Kubernetes Secret and not available in plain text once saved.
      * **Superuser**: Toggle for superuser privileges. Disabled by default.

  1. Expand the **Advanced parameters** section and change the values as needed:

      * **Allow login**: Allows the role to connect to PostgreSQL. This parameter is enabled by default.
      * **Parent roles**: List of roles the user will be included in.
      * **Creating databases**: Permission to create new databases. Disabled by default.
      * **Create roles**: Permission to create, modify, and delete roles. Disabled by default.
      * **Inherit role privileges**: Permission inheritance from parent roles. This parameter is enabled by default.
      * **Replication mode**: Permission to use replication and WAL shipping operations. Disabled by default.
      * **Bypass RLS**: Permission to bypass row-level security policies. Disabled by default.
      * **Connection limit**: Maximum number of simultaneous connections. If set to `-1`, there is no limit. `0` disables new connections. The default value is `-1`.
      * **Password valid until**: Password expiration date in RFC3339 format.

  1. Click **Create**.

  Done. The new user now appears in the cluster’s **Users** tab.

{% endlist %}