From acecbe0d8f66cc24c789f4682d3877f97f2d3949 Mon Sep 17 00:00:00 2001 From: Polina Bungina Date: Tue, 17 Jan 2023 10:52:03 +0100 Subject: [PATCH] Fix a couple of linter problems, delete TODO.md (#2526) Fix a couple of linter problems, remove trailing whitespaces Co-authored-by: Alexander Kukushkin --- .github/ISSUE_TEMPLATE/bug_report.md | 6 +++--- Dockerfile | 10 ++++----- TODO.md | 12 ----------- docker/entrypoint.sh | 12 ++++++++--- docs/README.rst | 4 ++-- docs/SETTINGS.rst | 2 +- docs/releases.rst | 2 +- docs/security.rst | 6 +++--- extras/startup-scripts/README.md | 4 ++-- kubernetes/Dockerfile | 3 +-- kubernetes/openshift-example/README.md | 24 ++++++++++----------- kubernetes/openshift-example/test/README.md | 2 +- 12 files changed, 40 insertions(+), 47 deletions(-) delete mode 100644 TODO.md diff --git a/.github/ISSUE_TEMPLATE/bug_report.md b/.github/ISSUE_TEMPLATE/bug_report.md index a1d28110..f0f6ca04 100644 --- a/.github/ISSUE_TEMPLATE/bug_report.md +++ b/.github/ISSUE_TEMPLATE/bug_report.md @@ -20,9 +20,9 @@ A clear and concise description of what you expected to happen. If applicable, add screenshots to help explain your problem. **Environment** -- Patroni version: -- PostgreSQL version: -- DCS (and its version): +- Patroni version: +- PostgreSQL version: +- DCS (and its version): **Patroni configuration file** ``` diff --git a/Dockerfile b/Dockerfile index f9ad4e72..e424f588 100644 --- a/Dockerfile +++ b/Dockerfile @@ -43,18 +43,18 @@ RUN set -ex \ && echo 'syntax on\nfiletype plugin indent on\nset mouse-=a\nautocmd FileType yaml setlocal ts=2 sts=2 sw=2 expandtab' > /etc/vim/vimrc.local \ \ # Prepare postgres/patroni/haproxy environment - && mkdir -p $PGHOME/.config/patroni /patroni /run/haproxy \ - && ln -s ../../postgres0.yml $PGHOME/.config/patroni/patronictl.yaml \ + && mkdir -p "$PGHOME/.config/patroni" /patroni /run/haproxy \ + && ln -s ../../postgres0.yml "$PGHOME/.config/patroni/patronictl.yaml" \ && ln -s /patronictl.py /usr/local/bin/patronictl \ && sed -i "s|/var/lib/postgresql.*|$PGHOME:/bin/bash|" /etc/passwd \ && chown -R postgres:postgres /var/log \ \ # Download etcd - && curl -sL https://github.com/coreos/etcd/releases/download/v${ETCDVERSION}/etcd-v${ETCDVERSION}-linux-$(dpkg --print-architecture).tar.gz \ + && curl -sL "https://github.com/coreos/etcd/releases/download/v$ETCDVERSION/etcd-v$ETCDVERSION-linux-$(dpkg --print-architecture).tar.gz" \ | tar xz -C /usr/local/bin --strip=1 --wildcards --no-anchored etcd etcdctl \ \ # Download confd - && curl -sL https://github.com/kelseyhightower/confd/releases/download/v${CONFDVERSION}/confd-${CONFDVERSION}-linux-$(dpkg --print-architecture) \ + && curl -sL "https://github.com/kelseyhightower/confd/releases/download/v$CONFDVERSION/confd-$CONFDVERSION-linux-$(dpkg --print-architecture)" \ > /usr/local/bin/confd && chmod +x /usr/local/bin/confd \ \ # Clean up all useless packages and some files @@ -153,7 +153,7 @@ RUN sed -i 's/env python/&3/' /patroni*.py \ && sed -i 's/^ parameters:/ pg_hba:\n - local all all trust\n - host replication all all md5\n - host all all all md5\n&\n max_connections: 100/' postgres?.yml \ && if [ "$COMPRESS" = "true" ]; then chmod u+s /usr/bin/sudo; fi \ && chmod +s /bin/ping \ - && chown -R postgres:postgres $PGHOME /run /etc/haproxy + && chown -R postgres:postgres "$PGHOME" /run /etc/haproxy USER postgres diff --git a/TODO.md b/TODO.md deleted file mode 100644 index eb40b18b..00000000 --- a/TODO.md +++ /dev/null @@ -1,12 +0,0 @@ -Failover -======== -- When determining who should become master, include the minor version of PostgreSQL in the decision. - -Configuration -============== -- Provide a way to change pg_hba.conf of a running cluster on the Patroni level, without changing individual nodes. -- Provide hooks to store and retrieve cluster-wide passwords without exposing them in a plain-text form to unauthorized users. - -Documentation -============== -- Document how to run cascading replication and possibly initialize the cluster without an access to the master node. diff --git a/docker/entrypoint.sh b/docker/entrypoint.sh index 1c8e882f..13d473d5 100755 --- a/docker/entrypoint.sh +++ b/docker/entrypoint.sh @@ -16,18 +16,24 @@ readonly DOCKER_IP case "$1" in haproxy) haproxy -f /etc/haproxy/haproxy.cfg -p /var/run/haproxy.pid -D - CONFD="confd -prefix=$PATRONI_NAMESPACE/$PATRONI_SCOPE -interval=10 -backend" + set -- confd "-prefix=$PATRONI_NAMESPACE/$PATRONI_SCOPE" -interval=10 -backend if [ -n "$PATRONI_ZOOKEEPER_HOSTS" ]; then while ! /usr/share/zookeeper/bin/zkCli.sh -server "$PATRONI_ZOOKEEPER_HOSTS" ls /; do sleep 1 done - exec dumb-init "$CONFD" zookeeper -node "$PATRONI_ZOOKEEPER_HOSTS" + set -- "$@" zookeeper -node "$PATRONI_ZOOKEEPER_HOSTS" else while ! etcdctl cluster-health 2> /dev/null; do sleep 1 done - exec dumb-init "$CONFD" etcdv3 -node "$(echo "$ETCDCTL_ENDPOINTS" | sed 's/,/ -node /g')" + set -- "$@" etcdv3 + while IFS='' read -r line; do + set -- "$@" -node "$line" + done <<-EOT +$(echo "$ETCDCTL_ENDPOINTS" | sed 's/,/\n/g') +EOT fi + exec dumb-init "$@" ;; etcd) exec "$@" -advertise-client-urls "http://$DOCKER_IP:2379" diff --git a/docs/README.rst b/docs/README.rst index 13bd76e1..48b59048 100644 --- a/docs/README.rst +++ b/docs/README.rst @@ -109,7 +109,7 @@ Planning the Number of PostgreSQL Nodes --------------------------------------- Patroni/PostgreSQL nodes are decoupled from DCS nodes (except when Patroni implements RAFT on its own) and therefore -there is no requirement on the minimal number of nodes. Running a cluster consisting of one primary and one standby is +there is no requirement on the minimal number of nodes. Running a cluster consisting of one primary and one standby is perfectly fine. You can add more standby nodes later. Running and Configuring @@ -177,7 +177,7 @@ Testing an HA solution is a time consuming process, with many variables. This is That said, here are some pieces of your infrastructure you should be sure to test: * Network (the network in front of your system as well as the NICs [physical or virtual] themselves) -* Disk IO +* Disk IO * file limits (nofile in Linux) * RAM. Even if you have oomkiller turned off as suggested, the unavailability of RAM could cause issues. * CPU diff --git a/docs/SETTINGS.rst b/docs/SETTINGS.rst index 37d40add..a0e6e8af 100644 --- a/docs/SETTINGS.rst +++ b/docs/SETTINGS.rst @@ -184,7 +184,7 @@ ZooKeeper - **key**: (optional) File with the client key. - **key_password**: (optional) The client key password. - **verify**: (optional) Whether to verify certificate or not. Defaults to ``true``. -- **set_acls**: (optional) If set, configure Kazoo to apply a default ACL to each ZNode that it creates. ACLs will assume 'x509' schema and should be specified as a dictionary with the principal as the key and one or more permissions as a list in the value. Permissions may be one of ``CREATE``, ``READ``, ``WRITE``, ``DELETE`` or ``ADMIN``. For example, ``set_acls: {CN=principal1: [CREATE, READ], CN=principal2: [ALL]}``. +- **set_acls**: (optional) If set, configure Kazoo to apply a default ACL to each ZNode that it creates. ACLs will assume 'x509' schema and should be specified as a dictionary with the principal as the key and one or more permissions as a list in the value. Permissions may be one of ``CREATE``, ``READ``, ``WRITE``, ``DELETE`` or ``ADMIN``. For example, ``set_acls: {CN=principal1: [CREATE, READ], CN=principal2: [ALL]}``. .. note:: It is required to install ``kazoo>=2.6.0`` to support SSL. diff --git a/docs/releases.rst b/docs/releases.rst index 17828e1b..a73a7b37 100644 --- a/docs/releases.rst +++ b/docs/releases.rst @@ -1271,7 +1271,7 @@ Version 1.6.1 - Kill all children along with the callback process before starting the new one (Alexander Kukushkin) - Not doing so makes it hard to implement callbacks in bash and eventually can lead to the situation when two callbacks are running at the same time. + Not doing so makes it hard to implement callbacks in bash and eventually can lead to the situation when two callbacks are running at the same time. - Fix 'start failed' issue (Alexander Kukushkin) diff --git a/docs/security.rst b/docs/security.rst index c4ed9d14..262ad91a 100644 --- a/docs/security.rst +++ b/docs/security.rst @@ -9,11 +9,11 @@ A Patroni cluster has two interfaces to be protected from unauthorized access: t Protecting DCS ============== -Patroni and patronictl both store and retrieve data to/from the DCS. +Patroni and patronictl both store and retrieve data to/from the DCS. Despite DCS doesn't contain any sensitive information, it allows changing some of Patroni/Postgres configuration. Therefore the very first thing that should be protected is DCS itself. -The details of protection depend on the type of DCS used. The authentication and encryption parameters (tokens/basic-auth/client certificates) for the supported types of DCS are covered in :ref:`SETTINGS ` +The details of protection depend on the type of DCS used. The authentication and encryption parameters (tokens/basic-auth/client certificates) for the supported types of DCS are covered in :ref:`SETTINGS ` The general recommendation is to enable TLS for all DCS communication. @@ -22,7 +22,7 @@ Protecting the REST API Protecting the REST API is a more complicated task. -The Patroni REST API is used by Patroni itself during the leader race, by the ``patronictl`` tool in order to perform failovers/switchovers/reinitialize/restarts/reloads, by HAProxy or any other kind of load balancer to perform HTTP health checks, and of course could also be used for monitoring. +The Patroni REST API is used by Patroni itself during the leader race, by the ``patronictl`` tool in order to perform failovers/switchovers/reinitialize/restarts/reloads, by HAProxy or any other kind of load balancer to perform HTTP health checks, and of course could also be used for monitoring. From the point of view of security, REST API contains safe (``GET`` requests, only retrieve information) and unsafe (``PUT``, ``POST``, ``PATCH`` and ``DELETE`` requests, change the state of nodes) endpoints. diff --git a/extras/startup-scripts/README.md b/extras/startup-scripts/README.md index ce0f047b..9d262e16 100644 --- a/extras/startup-scripts/README.md +++ b/extras/startup-scripts/README.md @@ -1,6 +1,6 @@ # startup scripts for Patroni -This directory contains sample startup scripts for various OSes +This directory contains sample startup scripts for various OSes and management tools for Patroni. Scripts supplied: @@ -10,7 +10,7 @@ Scripts supplied: Upstart job for Ubuntu 12.04 or 14.04. Requires Upstart > 1.4. Intended for systems where Patroni has been installed on a base system, rather than in Docker. ### patroni.service -Systemd service file, to be copied to /etc/systemd/system/patroni.service, tested on Centos 7.1 with Patroni installed from pip. +Systemd service file, to be copied to /etc/systemd/system/patroni.service, tested on Centos 7.1 with Patroni installed from pip. ### patroni Init.d service file for Debian-like distributions. Copy it to /etc/init.d/, make executable: diff --git a/kubernetes/Dockerfile b/kubernetes/Dockerfile index 8bb1c768..2fa25f73 100644 --- a/kubernetes/Dockerfile +++ b/kubernetes/Dockerfile @@ -4,7 +4,6 @@ LABEL maintainer="Alexander Kukushkin " RUN export DEBIAN_FRONTEND=noninteractive \ && echo 'APT::Install-Recommends "0";\nAPT::Install-Suggests "0";' > /etc/apt/apt.conf.d/01norecommend \ && apt-get update -y \ - && apt-get upgrade -y \ && apt-cache depends patroni | sed -n -e 's/.* Depends: \(python3-.\+\)$/\1/p' \ | grep -Ev '^python3-(sphinx|etcd|consul|kazoo|kubernetes)' \ | xargs apt-get install -y vim-tiny curl jq locales git python3-pip python3-wheel \ @@ -25,7 +24,7 @@ RUN export DEBIAN_FRONTEND=noninteractive \ && apt-get clean -y \ && rm -rf /var/lib/apt/lists/* /root/.cache -ADD entrypoint.sh / +COPY entrypoint.sh / EXPOSE 5432 8008 ENV LC_ALL=en_US.UTF-8 LANG=en_US.UTF-8 EDITOR=/usr/bin/editor diff --git a/kubernetes/openshift-example/README.md b/kubernetes/openshift-example/README.md index a5424b00..0b177f47 100644 --- a/kubernetes/openshift-example/README.md +++ b/kubernetes/openshift-example/README.md @@ -1,5 +1,5 @@ # Patroni OpenShift Configuration -Patroni can be run in OpenShift. Based on the kubernetes configuration, the Dockerfile and Entrypoint has been modified to support the dynamic UID/GID configuration that is applied in OpenShift. This can be run under the standard `restricted` SCC. +Patroni can be run in OpenShift. Based on the kubernetes configuration, the Dockerfile and Entrypoint has been modified to support the dynamic UID/GID configuration that is applied in OpenShift. This can be run under the standard `restricted` SCC. # Examples @@ -11,39 +11,39 @@ oc new-project patroni-test ## Build the image -Note: Update the references when merged upstream. -Note: If deploying as a template for multiple users, the following commands should be performed in a shared namespace like `openshift`. +Note: Update the references when merged upstream. +Note: If deploying as a template for multiple users, the following commands should be performed in a shared namespace like `openshift`. ``` oc import-image postgres:10 --confirm -n openshift oc new-build https://github.com/zalando/patroni --context-dir=kubernetes -n openshift ``` -## Deploy the Image -Two configuration templates exist in [templates](templates) directory: -- Patroni Ephemeral -- Patroni Persistent +## Deploy the Image +Two configuration templates exist in [templates](templates) directory: +- Patroni Ephemeral +- Patroni Persistent -The only difference is whether or not the statefulset requests persistent storage. +The only difference is whether or not the statefulset requests persistent storage. ## Create the Template -Install the template into the `openshift` namespace if this should be shared across projects: +Install the template into the `openshift` namespace if this should be shared across projects: ``` oc create -f templates/template_patroni_ephemeral.yml -n openshift ``` -Then, from your own project: +Then, from your own project: ``` oc new-app patroni-pgsql-ephemeral ``` -Once the pods are running, two configmaps should be available: +Once the pods are running, two configmaps should be available: ``` $ oc get configmap NAME DATA AGE patroniocp-config 0 1m patroniocp-leader 0 1m -``` \ No newline at end of file +``` diff --git a/kubernetes/openshift-example/test/README.md b/kubernetes/openshift-example/test/README.md index f0f21430..e45deb2c 100644 --- a/kubernetes/openshift-example/test/README.md +++ b/kubernetes/openshift-example/test/README.md @@ -1,2 +1,2 @@ # Jenkins Test -This pipeline test will create a separate deployment config for a pgbench pod and execute a test against the patroni cluster. This is a sample and should be customized. \ No newline at end of file +This pipeline test will create a separate deployment config for a pgbench pod and execute a test against the patroni cluster. This is a sample and should be customized.