From 63586f0477748760e800f7691da6c40fa4a807b6 Mon Sep 17 00:00:00 2001 From: Alexander Kukushkin Date: Tue, 21 Dec 2021 11:19:39 +0100 Subject: [PATCH] Add ctl.keyfile_password support (#2145) It compliments restapi.keyfile_password added in the #1825 --- docs/SETTINGS.rst | 3 ++- patroni/request.py | 3 +++ 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/docs/SETTINGS.rst b/docs/SETTINGS.rst index 53227c8b..7433d438 100644 --- a/docs/SETTINGS.rst +++ b/docs/SETTINGS.rst @@ -329,7 +329,7 @@ REST API - **password**: Basic-auth password to protect unsafe REST API endpoints. - **certfile**: (optional): Specifies the file with the certificate in the PEM format. If the certfile is not specified or is left empty, the API server will work without SSL. - **keyfile**: (optional): Specifies the file with the secret key in the PEM format. - - **keyfile_password**: (optional): Specifies a password for decrypting the keyfile. + - **keyfile\_password**: (optional): Specifies a password for decrypting the keyfile. - **cafile**: (optional): Specifies the file with the CA_BUNDLE with certificates of trusted CAs to use while verifying client certs. - **ciphers**: (optional): Specifies the permitted cipher suites (e.g. "ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-GCM-SHA256:!SSLv1:!SSLv2:!SSLv3:!TLSv1:!TLSv1.1") - **verify\_client**: (optional): ``none`` (default), ``optional`` or ``required``. When ``none`` REST API will not check client certificates. When ``required`` client certificates are required for all REST API calls. When ``optional`` client certificates are required for all unsafe REST API endpoints. When ``required`` is used, then client authentication succeeds, if the certificate signature verification succeeds. For ``optional`` the client cert will only be checked for ``PUT``, ``POST``, ``PATCH``, and ``DELETE`` requests. @@ -367,6 +367,7 @@ CTL - **cacert**: Specifies the file with the CA_BUNDLE file or directory with certificates of trusted CAs to use while verifying REST API SSL certs. If not provided patronictl will use the value provided for REST API "cafile" parameter. - **certfile**: Specifies the file with the client certificate in the PEM format. If not provided patronictl will use the value provided for REST API "certfile" parameter. - **keyfile**: Specifies the file with the client secret key in the PEM format. If not provided patronictl will use the value provided for REST API "keyfile" parameter. + - **keyfile\_password**: Specifies a password for decrypting the keyfile. If not provided patronictl will use the value provided for REST API "keyfile\_password" parameter. Watchdog -------- diff --git a/patroni/request.py b/patroni/request.py index 0463831c..dfc0a625 100644 --- a/patroni/request.py +++ b/patroni/request.py @@ -34,6 +34,9 @@ class PatroniRequest(object): if self._apply_ssl_file_param(config, 'cert'): self._apply_ssl_file_param(config, 'key') + + password = self._get_cfg_value(config, 'keyfile_password') + self._apply_pool_param('key_password', password) else: self._pool.connection_pool_kw.pop('key_file', None)