From 6c8a3b0d252634a68af569f4558e20888e8d3986 Mon Sep 17 00:00:00 2001 From: Polina Bungina <27892524+hughcapet@users.noreply.github.com> Date: Wed, 24 May 2023 09:01:56 +0200 Subject: [PATCH] Remove bootstrap.pg_hba (#2684) * Remove bootstrap.pg_hba * Extend docs for postgresql.pg_hba/pg_ident * Add postgresql.pg_hba/pg_ident to dynamic config docs --------- Co-authored-by: Alexander Kukushkin --- Dockerfile | 7 ++++--- Dockerfile.citus | 7 ++++--- docs/dynamic_configuration.rst | 10 ++++++++++ docs/yaml_configuration.rst | 16 ++++++---------- kubernetes/Dockerfile.citus | 4 +++- kubernetes/entrypoint.sh | 6 +++--- patroni/validator.py | 1 - postgres0.yml | 15 +++++++-------- postgres1.yml | 15 +++++++-------- postgres2.yml | 15 +++++++-------- tests/test_validator.py | 1 - 11 files changed, 51 insertions(+), 46 deletions(-) diff --git a/Dockerfile b/Dockerfile index 5892e1ef..4aa0ce5c 100644 --- a/Dockerfile +++ b/Dockerfile @@ -155,14 +155,15 @@ WORKDIR $PGHOME RUN sed -i 's/env python/&3/' /patroni*.py \ # "fix" patroni configs - && sed -i 's/^\( connect_address:\| - host\)/#&/' postgres?.yml \ && sed -i 's/^ listen: 127.0.0.1/ listen: 0.0.0.0/' postgres?.yml \ && sed -i "s|^\( data_dir: \).*|\1$PGDATA|" postgres?.yml \ && sed -i "s|^#\( bin_dir: \).*|\1$PGBIN|" postgres?.yml \ && sed -i 's/^ - encoding: UTF8/ - locale: en_US.UTF-8\n&/' postgres?.yml \ - && sed -i 's/^\(scope\|name\|etcd\| host\| authentication\| pg_hba\| parameters\):/#&/' postgres?.yml \ + && sed -i 's/^\(scope\|name\|etcd\| host\| authentication\| connect_address\| parameters\):/#&/' postgres?.yml \ && sed -i 's/^ \(replication\|superuser\|rewind\|unix_socket_directories\|\(\( \)\{0,1\}\(username\|password\)\)\):/#&/' postgres?.yml \ - && sed -i 's/^ parameters:/ pg_hba:\n - local all all trust\n - host replication all all md5\n - host all all all md5\n&\n max_connections: 100/' postgres?.yml \ + && sed -i 's/^ parameters:/&\n max_connections: 100/' postgres?.yml \ + && sed -i 's/^ pg_hba:/&\n - local all all trust/' postgres?.yml \ + && sed -i 's/^\(.*\) \(.*\) md5/\1 all md5/' postgres?.yml \ && if [ "$COMPRESS" = "true" ]; then chmod u+s /usr/bin/sudo; fi \ && chmod +s /bin/ping \ && chown -R postgres:postgres "$PGHOME" /run /etc/haproxy diff --git a/Dockerfile.citus b/Dockerfile.citus index b0920557..2a10745e 100644 --- a/Dockerfile.citus +++ b/Dockerfile.citus @@ -176,16 +176,17 @@ WORKDIR $PGHOME RUN sed -i 's/env python/&3/' /patroni*.py \ # "fix" patroni configs - && sed -i 's/^\( connect_address:\| - host\)/#&/' postgres?.yml \ && sed -i 's/^ listen: 127.0.0.1/ listen: 0.0.0.0/' postgres?.yml \ && sed -i "s|^\( data_dir: \).*|\1$PGDATA|" postgres?.yml \ && sed -i "s|^#\( bin_dir: \).*|\1$PGBIN|" postgres?.yml \ && sed -i 's/^ - encoding: UTF8/ - locale: en_US.UTF-8\n&/' postgres?.yml \ && sed -i 's/^scope:/log:\n loggers:\n patroni.postgresql.citus: DEBUG\n#&/' postgres?.yml \ - && sed -i 's/^\(name\|etcd\| host\| authentication\| pg_hba\| parameters\):/#&/' postgres?.yml \ + && sed -i 's/^\(name\|etcd\| host\| authentication\| connect_address\| parameters\):/#&/' postgres?.yml \ && sed -i 's/^ \(replication\|superuser\|rewind\|unix_socket_directories\|\(\( \)\{0,1\}\(username\|password\)\)\):/#&/' postgres?.yml \ && sed -i 's/^postgresql:/&\n basebackup:\n checkpoint: fast/' postgres?.yml \ - && sed -i 's|^ parameters:| pg_hba:\n - local all all trust\n - hostssl replication all all md5 clientcert=verify-ca\n - hostssl all all all md5 clientcert=verify-ca\n&\n max_connections: 100\n shared_buffers: 16MB\n ssl: "on"\n ssl_ca_file: /etc/ssl/certs/ssl-cert-snakeoil.pem\n ssl_cert_file: /etc/ssl/certs/ssl-cert-snakeoil.pem\n ssl_key_file: /etc/ssl/private/ssl-cert-snakeoil.key\n citus.node_conninfo: "sslrootcert=/etc/ssl/certs/ssl-cert-snakeoil.pem sslkey=/etc/ssl/private/ssl-cert-snakeoil.key sslcert=/etc/ssl/certs/ssl-cert-snakeoil.pem sslmode=verify-ca"|' postgres?.yml \ + && sed -i 's|^ parameters:|&\n max_connections: 100\n shared_buffers: 16MB\n ssl: "on"\n ssl_ca_file: /etc/ssl/certs/ssl-cert-snakeoil.pem\n ssl_cert_file: /etc/ssl/certs/ssl-cert-snakeoil.pem\n ssl_key_file: /etc/ssl/private/ssl-cert-snakeoil.key\n citus.node_conninfo: "sslrootcert=/etc/ssl/certs/ssl-cert-snakeoil.pem sslkey=/etc/ssl/private/ssl-cert-snakeoil.key sslcert=/etc/ssl/certs/ssl-cert-snakeoil.pem sslmode=verify-ca"|' postgres?.yml \ + && sed -i 's/^ pg_hba:/&\n - local all all trust/' postgres?.yml \ + && sed -i 's/^\(.*\) \(.*\) \(.*\) \(.*\) \(.*\) md5.*$/\1 hostssl \3 \4 all md5 clientcert=verify-ca/' postgres?.yml \ && sed -i 's/^#\(ctl\| certfile\| keyfile\)/\1/' postgres?.yml \ && sed -i 's|^# cafile: .*$| verify_client: required\n cafile: /etc/ssl/certs/ssl-cert-snakeoil.pem|' postgres?.yml \ && sed -i 's|^# cacert: .*$| cacert: /etc/ssl/certs/ssl-cert-snakeoil.pem|' postgres?.yml \ diff --git a/docs/dynamic_configuration.rst b/docs/dynamic_configuration.rst index 85121d7c..5486bf6e 100644 --- a/docs/dynamic_configuration.rst +++ b/docs/dynamic_configuration.rst @@ -26,6 +26,16 @@ In order to change the dynamic configuration you can use either ``patronictl edi - **recovery\_conf**: additional configuration settings written to recovery.conf when configuring follower. There is no recovery.conf anymore in PostgreSQL 12, but you may continue using this section, because Patroni handles it transparently. - **parameters**: list of configuration settings for Postgres. + - **pg\_hba**: list of lines that Patroni will use to generate ``pg_hba.conf``. Patroni ignores this parameter if ``hba_file`` PostgreSQL parameter is set to a non-default value. + + - **- host all all 0.0.0.0/0 md5** + - **- host replication replicator 127.0.0.1/32 md5**: A line like this is required for replication. + + - **pg\_ident**: list of lines that Patroni will use to generate ``pg_ident.conf``. Patroni ignores this parameter if ``ident_file`` PostgreSQL parameter is set to a non-default value. + + - **- mapname1 systemname1 pguser1** + - **- mapname1 systemname2 pguser2** + - **standby\_cluster**: if this section is defined, we want to bootstrap a standby cluster. - **host**: an address of remote node diff --git a/docs/yaml_configuration.rst b/docs/yaml_configuration.rst index 51f769ca..dd84f7cb 100644 --- a/docs/yaml_configuration.rst +++ b/docs/yaml_configuration.rst @@ -43,10 +43,6 @@ Bootstrap configuration - **- data-checksums**: Must be enabled when pg_rewind is needed on 9.3. - **- encoding: UTF8**: default encoding for new databases. - **- locale: UTF8**: default locale for new databases. - - **pg\_hba**: list of lines that you should add to pg\_hba.conf. - - - **- host all all 0.0.0.0/0 md5**. - - **- host replication replicator 127.0.0.1/32 md5**: A line like this is required for replication. - **users**: Some additional users which need to be created after initializing new cluster - **admin**: the name of user @@ -270,18 +266,18 @@ PostgreSQL - **recovery\_conf**: additional configuration settings written to recovery.conf when configuring follower. - **custom\_conf** : path to an optional custom ``postgresql.conf`` file, that will be used in place of ``postgresql.base.conf``. The file must exist on all cluster nodes, be readable by PostgreSQL and will be included from its location on the real ``postgresql.conf``. Note that Patroni will not monitor this file for changes, nor backup it. However, its settings can still be overridden by Patroni's own configuration facilities - see :ref:`dynamic configuration ` for details. - **parameters**: list of configuration settings for Postgres. Many of these are required for replication to work. - - **pg\_hba**: list of lines that Patroni will use to generate ``pg_hba.conf``. This parameter has higher priority than ``bootstrap.pg_hba``. Together with :ref:`dynamic configuration ` it simplifies management of ``pg_hba.conf``. + - **pg\_hba**: list of lines that Patroni will use to generate ``pg_hba.conf``. Patroni ignores this parameter if ``hba_file`` PostgreSQL parameter is set to a non-default value. Together with :ref:`dynamic configuration ` this parameter simplifies management of ``pg_hba.conf``. - - **- host all all 0.0.0.0/0 md5**. + - **- host all all 0.0.0.0/0 md5** - **- host replication replicator 127.0.0.1/32 md5**: A line like this is required for replication. - - **pg\_ident**: list of lines that Patroni will use to generate ``pg_ident.conf``. Together with :ref:`dynamic configuration ` it simplifies management of ``pg_ident.conf``. + - **pg\_ident**: list of lines that Patroni will use to generate ``pg_ident.conf``. Patroni ignores this parameter if ``ident_file`` PostgreSQL parameter is set to a non-default value. Together with :ref:`dynamic configuration ` this parameter simplifies management of ``pg_ident.conf``. - - **- mapname1 systemname1 pguser1**. - - **- mapname1 systemname2 pguser2**. + - **- mapname1 systemname1 pguser1** + - **- mapname1 systemname2 pguser2** - **pg\_ctl\_timeout**: How long should pg_ctl wait when doing ``start``, ``stop`` or ``restart``. Default value is 60 seconds. - **use\_pg\_rewind**: try to use pg\_rewind on the former leader when it joins cluster as a replica. - **remove\_data\_directory\_on\_rewind\_failure**: If this option is enabled, Patroni will remove the PostgreSQL data directory and recreate the replica. Otherwise it will try to follow the new leader. Default value is **false**. - - **remove\_data\_directory\_on\_diverged\_timelines**: Patroni will remove the PostgreSQL data directory and recreate the replica if it notices that timelines are diverging and the former primary can not start streaming from the new primary. This option is useful when ``pg_rewind`` can not be used. While performing timelines divergence check on PostgreSQL v10 and older Patroni will try to connect with replication credential to the "postgres" database. Hence, such access should be allowed in the pg_hba.conf. Default value is **false**. + - **remove\_data\_directory\_on\_diverged\_timelines**: Patroni will remove the PostgreSQL data directory and recreate the replica if it notices that timelines are diverging and the former primary can not start streaming from the new primary. This option is useful when ``pg_rewind`` can not be used. While performing timelines divergence check on PostgreSQL v10 and older Patroni will try to connect with replication credential to the "postgres" database. Hence, such access should be allowed in the pg_hba.conf. Default value is **false**. - **replica\_method**: for each create_replica_methods other than basebackup, you would add a configuration section of the same name. At a minimum, this should include "command" with a full path to the actual script to be executed. Other configuration parameters will be passed along to the script in the form "parameter=value". - **pre\_promote**: a fencing script that executes during a failover after acquiring the leader lock but before promoting the replica. If the script exits with a non-zero code, Patroni does not promote the replica and removes the leader key from DCS. - **before\_stop**: a script that executes immediately prior to stopping postgres. As opposed to a callback, this script runs synchronously, blocking shutdown until it has completed. The return code of this script does not impact whether shutdown proceeds afterwards. diff --git a/kubernetes/Dockerfile.citus b/kubernetes/Dockerfile.citus index 195bb8e9..e61850c7 100644 --- a/kubernetes/Dockerfile.citus +++ b/kubernetes/Dockerfile.citus @@ -34,7 +34,9 @@ ADD entrypoint.sh / ENV PGSSLMODE=verify-ca PGSSLKEY=/etc/ssl/private/ssl-cert-snakeoil.key PGSSLCERT=/etc/ssl/certs/ssl-cert-snakeoil.pem PGSSLROOTCERT=/etc/ssl/certs/ssl-cert-snakeoil.pem RUN sed -i 's/^postgresql:/&\n basebackup:\n checkpoint: fast/' /entrypoint.sh \ - && sed -i "s|^ postgresql:|&\n pg_hba:\n - local all all trust\n - hostssl replication all all md5 clientcert=$PGSSLMODE\n - hostssl all all all md5 clientcert=$PGSSLMODE\n parameters:\n max_connections: 100\n shared_buffers: 16MB\n ssl: 'on'\n ssl_ca_file: $PGSSLROOTCERT\n ssl_cert_file: $PGSSLCERT\n ssl_key_file: $PGSSLKEY\n citus.node_conninfo: 'sslrootcert=$PGSSLROOTCERT sslkey=$PGSSLKEY sslcert=$PGSSLCERT sslmode=$PGSSLMODE'|" /entrypoint.sh \ + && sed -i "s|^ postgresql:|&\n parameters:\n max_connections: 100\n shared_buffers: 16MB\n ssl: 'on'\n ssl_ca_file: $PGSSLROOTCERT\n ssl_cert_file: $PGSSLCERT\n ssl_key_file: $PGSSLKEY\n citus.node_conninfo: 'sslrootcert=$PGSSLROOTCERT sslkey=$PGSSLKEY sslcert=$PGSSLCERT sslmode=$PGSSLMODE'|" /entrypoint.sh \ + && sed -i 's/^ pg_hba:/&\n - local all all trust/' /entrypoint.sh \ + && sed -i "s/^\(.*\) \(.*\) \(.*\) \(.*\) \(.*\) md5.*$/\1 hostssl \3 \4 all md5 clientcert=$PGSSLMODE/" /entrypoint.sh \ && sed -i "s#^ \(superuser\|replication\):#&\n sslmode: $PGSSLMODE\n sslkey: $PGSSLKEY\n sslcert: $PGSSLCERT\n sslrootcert: $PGSSLROOTCERT#" /entrypoint.sh EXPOSE 5432 8008 diff --git a/kubernetes/entrypoint.sh b/kubernetes/entrypoint.sh index b4fa58be..ad7f6263 100755 --- a/kubernetes/entrypoint.sh +++ b/kubernetes/entrypoint.sh @@ -12,15 +12,15 @@ bootstrap: dcs: postgresql: use_pg_rewind: true + pg_hba: + - host all all 0.0.0.0/0 md5 + - host replication ${PATRONI_REPLICATION_USERNAME} ${PATRONI_KUBERNETES_POD_IP}/16 md5 initdb: - auth-host: md5 - auth-local: trust - encoding: UTF8 - locale: en_US.UTF-8 - data-checksums - pg_hba: - - host all all 0.0.0.0/0 md5 - - host replication ${PATRONI_REPLICATION_USERNAME} ${PATRONI_KUBERNETES_POD_IP}/16 md5 restapi: connect_address: '${PATRONI_KUBERNETES_POD_IP}:8008' postgresql: diff --git a/patroni/validator.py b/patroni/validator.py index 3d30ca2c..ccf41fd0 100644 --- a/patroni/validator.py +++ b/patroni/validator.py @@ -773,7 +773,6 @@ schema = Schema({ Optional("retry_timeout"): int, Optional("maximum_lag_on_failover"): int }, - "pg_hba": [str], "initdb": [Or(str, dict)] }, Or(*available_dcs): Case({ diff --git a/postgres0.yml b/postgres0.yml index 7aed19b9..2e83c7e1 100644 --- a/postgres0.yml +++ b/postgres0.yml @@ -59,6 +59,13 @@ bootstrap: #primary_slot_name: patroni postgresql: use_pg_rewind: true + pg_hba: + # For kerberos gss based connectivity (discard @.*$) + #- host replication replicator 127.0.0.1/32 gss include_realm=0 + #- host all all 0.0.0.0/0 gss include_realm=0 + - host replication replicator 127.0.0.1/32 md5 + - host all all 0.0.0.0/0 md5 + # - hostssl all all 0.0.0.0/0 md5 # use_slots: true parameters: # wal_level: hot_standby @@ -83,14 +90,6 @@ bootstrap: - encoding: UTF8 - data-checksums - pg_hba: # Add following lines to pg_hba.conf after running 'initdb' - # For kerberos gss based connectivity (discard @.*$) - #- host replication replicator 127.0.0.1/32 gss include_realm=0 - #- host all all 0.0.0.0/0 gss include_realm=0 - - host replication replicator 127.0.0.1/32 md5 - - host all all 0.0.0.0/0 md5 -# - hostssl all all 0.0.0.0/0 md5 - # Additional script to be launched after initial cluster creation (will be passed the connection URL as parameter) # post_init: /usr/local/bin/setup_cluster.sh diff --git a/postgres1.yml b/postgres1.yml index ce7d1ee2..e8b2806d 100644 --- a/postgres1.yml +++ b/postgres1.yml @@ -53,6 +53,13 @@ bootstrap: maximum_lag_on_failover: 1048576 postgresql: use_pg_rewind: true + pg_hba: + # For kerberos gss based connectivity (discard @.*$) + #- host replication replicator 127.0.0.1/32 gss include_realm=0 + #- host all all 0.0.0.0/0 gss include_realm=0 + - host replication replicator 127.0.0.1/32 md5 + - host all all 0.0.0.0/0 md5 + # - hostssl all all 0.0.0.0/0 md5 # use_slots: true parameters: # wal_level: hot_standby @@ -77,14 +84,6 @@ bootstrap: - encoding: UTF8 - data-checksums - pg_hba: # Add following lines to pg_hba.conf after running 'initdb' - # For kerberos gss based connectivity (discard @.*$) - #- host replication replicator 127.0.0.1/32 gss include_realm=0 - #- host all all 0.0.0.0/0 gss include_realm=0 - - host replication replicator 127.0.0.1/32 md5 - - host all all 0.0.0.0/0 md5 -# - hostssl all all 0.0.0.0/0 md5 - # Additional script to be launched after initial cluster creation (will be passed the connection URL as parameter) # post_init: /usr/local/bin/setup_cluster.sh diff --git a/postgres2.yml b/postgres2.yml index 5ca44cd0..8272e3ba 100644 --- a/postgres2.yml +++ b/postgres2.yml @@ -53,6 +53,13 @@ bootstrap: maximum_lag_on_failover: 1048576 postgresql: use_pg_rewind: true + pg_hba: + # For kerberos gss based connectivity (discard @.*$) + #- host replication replicator 127.0.0.1/32 gss include_realm=0 + #- host all all 0.0.0.0/0 gss include_realm=0 + - host replication replicator 127.0.0.1/32 md5 + - host all all 0.0.0.0/0 md5 + # - hostssl all all 0.0.0.0/0 md5 # use_slots: true parameters: # wal_level: hot_standby @@ -77,14 +84,6 @@ bootstrap: - encoding: UTF8 - data-checksums - pg_hba: # Add following lines to pg_hba.conf after running 'initdb' - # For kerberos gss based connectivity (discard @.*$) - #- host replication replicator 127.0.0.1/32 gss include_realm=0 - #- host all all 0.0.0.0/0 gss include_realm=0 - - host replication replicator 127.0.0.1/32 md5 - - host all all 0.0.0.0/0 md5 -# - hostssl all all 0.0.0.0/0 md5 - # Some additional users users which needs to be created after initializing new cluster users: admin: diff --git a/tests/test_validator.py b/tests/test_validator.py index 87ea78b7..cec1f140 100644 --- a/tests/test_validator.py +++ b/tests/test_validator.py @@ -24,7 +24,6 @@ config = { "retry_timeout": 1000, "maximum_lag_on_failover": 1000 }, - "pg_hba": ["string"], "initdb": ["string", {"key": "value"}] }, "consul": {