From 877acf2a55adf55d53a3f92eb647a3139de23fce Mon Sep 17 00:00:00 2001
From: kviset <kviset@mail.ru>
Date: Wed, 9 Oct 2024 12:57:38 +0300
Subject: [PATCH] Disable pgaudit when creating users to not expose password
 (#3175)

pgaudit could be added to shared_preload_libraries, but we don't check for it, because setting a custom GUC works in all cases.
---
 patroni/postgresql/bootstrap.py | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/patroni/postgresql/bootstrap.py b/patroni/postgresql/bootstrap.py
index 35841777..30895e80 100644
--- a/patroni/postgresql/bootstrap.py
+++ b/patroni/postgresql/bootstrap.py
@@ -411,6 +411,7 @@ END;$$""".format(quote_literal(name), quote_ident(name, self._postgresql.connect
         self._postgresql.query('SET log_min_duration_statement TO -1')
         self._postgresql.query("SET log_min_error_statement TO 'log'")
         self._postgresql.query("SET pg_stat_statements.track_utility to 'off'")
+        self._postgresql.query("SET pgaudit.log TO none")
         try:
             self._postgresql.query(sql)
         finally:
@@ -418,6 +419,7 @@ END;$$""".format(quote_literal(name), quote_ident(name, self._postgresql.connect
             self._postgresql.query('RESET log_min_duration_statement')
             self._postgresql.query('RESET log_statement')
             self._postgresql.query('RESET pg_stat_statements.track_utility')
+            self._postgresql.query('RESET pgaudit.log')
 
     def post_bootstrap(self, config: Dict[str, Any], task: CriticalTask) -> Optional[bool]:
         try: