fix: also grant pg_create_subscription & pg_monitor post-upgrade

Author: soedirgo

ansible/files/admin_api_scripts/pg_upgrade_scripts/complete.sh

@@ -255,7 +255,21 @@ EOF
     )
     run_sql -c "$REENCRYPT_VAULT_SECRETS_QUERY"
 
-    run_sql -c "grant pg_read_all_data, pg_signal_backend to postgres"
+    GRANT_PREDEFINED_ROLES_TO_POSTGRES_QUERY=$(cat <<EOF
+    DO \$\$
+    DECLARE
+      major_version INT;
+    BEGIN
+      SELECT current_setting('server_version_num')::INT / 10000 INTO major_version;
+      IF major_version >= 16 THEN
+        GRANT pg_create_subscription TO postgres;
+      END IF;
+      GRANT pg_monitor, pg_read_all_data, pg_signal_backend TO postgres;
+    END
+    \$\$;
+EOF
+    )
+    run_sql -c "$GRANT_PREDEFINED_ROLES_TO_POSTGRES_QUERY"
 }
 
 function complete_pg_upgrade {