Write the pg_rewind password in pgpass instead of passing it in the command line.

patroni/postgresql.py

@@ -135,14 +135,17 @@ class Postgresql:
     def delete_trigger_file(self):
         os.path.exists(self.trigger_file) and os.unlink(self.trigger_file)
 
+    def write_pgpass(self, record, append=False):
+        pgpass = 'pgpass'
+        with open(pgpass, 'w' if not append else 'a') as f:
+            os.fchmod(f.fileno(), 0o600)
+            f.write('{host}:{port}:*:{user}:{password}\n'.format(**record))
+        return pgpass
+
     def sync_from_leader(self, leader):
         r = parseurl(leader.conn_url)
 
-        pgpass = 'pgpass'
-        with open(pgpass, 'w') as f:
-            os.fchmod(f.fileno(), 0o600)
-            f.write('{host}:{port}:*:{user}:{password}\n'.format(**r))
-
+        pgpass = self.write_pgpass(r)
         env = os.environ.copy()
         env['PGPASSFILE'] = pgpass
         return self.create_replica(r, env) == 0
@@ -280,10 +283,8 @@ class Postgresql:
                 f.write(line + '\n')
 
     @staticmethod
-    def primary_conninfo(leader_url, replacement=None):
+    def primary_conninfo(leader_url):
         r = parseurl(leader_url)
-        if replacement is not None:
-            r.update(replacement)
         return 'user={user} password={password} host={host} port={port} sslmode=prefer sslcompression=1'.format(**r)
 
     def check_recovery_conf(self, leader):
@@ -313,8 +314,14 @@ recovery_target_timeline = 'latest'
                 for name, value in self.config.get('recovery_conf', {}).items():
                     f.write("{} = '{}'\n".format(name, value))
 
+    def prepare_pg_rewind_connection(self, leader_url, pg_rewind):
+        r = parseurl(leader_url)
+        r.update(pg_rewind)
+        self.write_pgpass(r, append=True)
+        return "user={user} host={host} port={port} dbname=postgres sslmode=prefer sslcompression=1".format(**r)
+
     def pg_rewind(self, leader):
-        pc = self.primary_conninfo(leader.conn_url, self._pg_rewind) + ' dbname=postgres'
+        pc = self.prepare_pg_rewind_connection(leader.conn_url, self._pg_rewind)
         logger.info("running pg_rewind from {}".format(pc))
         pg_rewind = ['pg_rewind', '-D', self.data_dir, '--source-server', pc]
         try: