Use pg10 as base image and python3 instead of 2

Merge branch 'master' of github.com:zalando/patroni into feature/demo
Register service in consul (#802 )
2026-08-26 23:50:23 +00:00 · 2018-09-12 16:57:22 +02:00 · 2018-09-12 16:44:02 +02:00 · 2018-09-07 15:17:56 +02:00 · 2018-09-07 10:10:56 +02:00 · 2018-09-06 08:37:26 +02:00
48 changed files with 1411 additions and 361 deletions
@@ -1,13 +0,0 @@
-# for github.com
-approvals:
-  groups:
-    zalando:
-      minimum: 2
-      from:
-        orgs:
-          - "zalando"
-# team should be valid team id in team service https://teams.auth.zalando.com/api/teams/:id
-X-Zalando-Team: "acid"
-# type should be one of [code, doc, config, tools, secrets]
-# code will be the default value, if X-Zalando-Type is not found in .zappr.yml
-X-Zalando-Type: code
@@ -1,45 +1,42 @@
 ## This Dockerfile is meant to aid in the building and debugging patroni whilst developing on your local machine
 ## It has all the necessary components to play/debug with a single node appliance, running etcd
-FROM postgres:9.6
+FROM postgres:10
 MAINTAINER Alexander Kukushkin <[email protected]>

 RUN export DEBIAN_FRONTEND=noninteractive \
    && echo 'APT::Install-Recommends "0";\nAPT::Install-Suggests "0";' > /etc/apt/apt.conf.d/01norecommend \
    && apt-get update -y \
    && apt-get upgrade -y \
-    && apt-get install -y curl jq haproxy python-psycopg2 python-yaml python-requests python-six python-pysocks \
-        python-dateutil python-pip python-setuptools python-prettytable python-wheel python-psutil python locales \
+    # postgres:10 is based on debian, which has patroni package. We will install all required dependencies
+    && apt-get install -s patroni | sed -n -e '/^Inst patroni /d' -e 's/^Inst \([^ ]\+\) .*$/\1/p' \
+            | xargs apt-get install -y curl jq haproxy locales python3-etcd python3-kazoo \

    ## Make sure we have a en_US.UTF-8 locale available
    && localedef -i en_US -c -f UTF-8 -A /usr/share/locale/locale.alias en_US.UTF-8 \

-    && pip install 'python-etcd>=0.4.3,<0.5' click tzlocal cdiff \
-
    && mkdir -p /home/postgres \
    && chown postgres:postgres /home/postgres \

    # Clean up
-    && apt-get remove -y python-pip python-setuptools \
+    && apt-get purge -y libpython2.7-stdlib libpython2.7-minimal \
    && apt-get autoremove -y \
    && apt-get clean -y \
    && rm -rf /var/lib/apt/lists/* /root/.cache

-ENV ETCDVERSION 3.2.3
+ENV ETCDVERSION 3.2.23
 RUN curl -L https://github.com/coreos/etcd/releases/download/v${ETCDVERSION}/etcd-v${ETCDVERSION}-linux-amd64.tar.gz \
    | tar xz -C /usr/local/bin --strip=1 --wildcards --no-anchored etcd etcdctl

-ENV CONFDVERSION 0.11.0
+ENV CONFDVERSION 0.16.0
 RUN curl -L https://github.com/kelseyhightower/confd/releases/download/v${CONFDVERSION}/confd-${CONFDVERSION}-linux-amd64 > /usr/local/bin/confd \
    && chmod +x /usr/local/bin/confd

 ADD patronictl.py patroni.py docker/entrypoint.sh /
 ADD patroni /patroni/
 ADD extras/confd /etc/confd
-RUN ln -s /patronictl.py /usr/local/bin/patronictl

-### Setting up a simple script that will serve as an entrypoint
-RUN mkdir /data/ && touch /pgpass /patroni.yml \
-    && chown postgres:postgres -R /patroni/ /data/ /pgpass /patroni.yml /etc/haproxy /var/run/ /var/lib/ /var/log/
+RUN sed -i 's/env python/&3/' patroni*.py && ln -s /patronictl.py /usr/local/bin/patronictl && mkdir /data/ /run/haproxy \
+    && touch /pgpass /patroni.yml && chown postgres:postgres -R /patroni/ /data/ /pgpass /patroni.yml /etc/haproxy /var/run/ /var/lib/ /var/log/

 EXPOSE 2379 5432 8008

@@ -15,7 +15,7 @@ dbnode1:
        - ./patroni:/patroni
    env_file: docker/patroni-secrets.env
    environment:
-        PATRONI_ETCD_HOST: patroni_etcd:2379
+        PATRONI_ETCD_URL: http://patroni_etcd:2379
        PATRONI_NAME: dbnode1
        PATRONI_SCOPE: testcluster

@@ -28,7 +28,7 @@ dbnode2:
        - ./patroni:/patroni
    env_file: docker/patroni-secrets.env
    environment:
-        PATRONI_ETCD_HOST: patroni_etcd:2379
+        PATRONI_ETCD_URL: http://patroni_etcd:2379
        PATRONI_NAME: dbnode2
        PATRONI_SCOPE: testcluster

@@ -41,7 +41,7 @@ dbnode3:
        - ./patroni:/patroni
    env_file: docker/patroni-secrets.env
    environment:
-        PATRONI_ETCD_HOST: patroni_etcd:2379
+        PATRONI_ETCD_URL: http://patroni_etcd:2379
        PATRONI_NAME: dbnode3
        PATRONI_SCOPE: testcluster

@@ -53,6 +53,6 @@ haproxy:
        - "5000:5000"
        - "5001:5001"
    environment:
-        PATRONI_ETCD_HOST: patroni_etcd:2379
+        PATRONI_ETCD_URL: http://patroni_etcd:2379
        PATRONI_SCOPE: testcluster
    command: --confd
@@ -84,7 +84,7 @@ function docker_run()
 ETCD_CONTAINER="${PATRONI_SCOPE}_etcd"
 docker_run ${ETCD_CONTAINER} ${DOCKER_IMAGE} --etcd

-DOCKER_ARGS="--link=${ETCD_CONTAINER}:${ETCD_CONTAINER} -e PATRONI_SCOPE=${PATRONI_SCOPE} -e PATRONI_ETCD_HOST=${ETCD_CONTAINER}:2379"
+DOCKER_ARGS="--link=${ETCD_CONTAINER}:${ETCD_CONTAINER} -e PATRONI_SCOPE=${PATRONI_SCOPE} -e PATRONI_ETCD_URL=http://${ETCD_CONTAINER}:2379"
 PATRONI_ENV=$(sed 's/#.*//g' docker/patroni-secrets.env | sed -n 's/^PATRONI_.*$/-e &/p' | tr '\n' ' ')
 PATRONI_VOLUME="-v $(dirname $(dirname $(realpath $0)))/patroni:/patroni"

@@ -38,10 +38,10 @@ while getopts "$optspec" optchar; do
                        done
                        exec $CONFD zookeeper -node ${PATRONI_ZOOKEEPER_HOSTS}
                    else
-                        while ! curl -s ${PATRONI_ETCD_HOST}/v2/members | jq -r '.members[0].clientURLs[0]' | grep -q http; do
+                        while ! curl -s ${PATRONI_ETCD_URL}/v2/members | jq -r '.members[0].clientURLs[0]' | grep -q http; do
                            sleep 1
                        done
-                        exec $CONFD etcd -node $PATRONI_ETCD_HOST
+                        exec $CONFD etcd -node $PATRONI_ETCD_URL
                    fi
                    ;;
                etcd)
@@ -74,9 +74,9 @@ while getopts "$optspec" optchar; do
 done

 ## We start an etcd
-if [[ -z ${PATRONI_ETCD_HOST} && -z ${PATRONI_ZOOKEEPER_HOSTS} ]]; then
+if [[ -z ${PATRONI_ETCD_URL} && -z ${PATRONI_ZOOKEEPER_HOSTS} ]]; then
    etcd $ETCD_ARGS > /var/log/etcd.log 2> /var/log/etcd.err &
-    export PATRONI_ETCD_HOST="127.0.0.1:2379"
+    export PATRONI_ETCD_URL="http://127.0.0.1:2379"
 fi

 export PATRONI_SCOPE
@@ -108,7 +108,7 @@ __EOF__
 mkdir -p "$HOME/.config/patroni"
 [ -h "$HOME/.config/patroni/patronictl.yaml" ] || ln -s /patroni.yml "$HOME/.config/patroni/patronictl.yaml"

-[ -z $CHEAT ] && exec python /patroni.py /patroni.yml
+[ -z $CHEAT ] && exec python3 /patroni.py /patroni.yml

 while true; do
    sleep 60
@@ -19,11 +19,20 @@ Bootstrap configuration
    -  **maximum\_lag\_on\_failover**: the maximum bytes a follower may lag to be able to participate in leader election.
    -  **master\_start\_timeout**: the amount of time a master is allowed to recover from failures before failover is triggered. Default is 300 seconds. When set to 0 failover is done immediately after a crash is detected if possible. When using asynchronous replication a failover can cause lost transactions. Best worst case failover time for master failure is: loop\_wait + master\_start\_timeout + loop\_wait, unless master\_start\_timeout is zero, in which case it's just loop\_wait. Set the value according to your durability/availability tradeoff.
    -  **synchronous\_mode**: turns on synchronous replication mode. In this mode a replica will be chosen as synchronous and only the latest leader and synchronous replica are able to participate in leader election. Synchronous mode makes sure that successfully committed transactions will not be lost at failover, at the cost of losing availability for writes when Patroni cannot ensure transaction durability. See :ref:`replication modes documentation <replication_modes>` for details.
+    -  **synchronous\_mode\_strict**: prevents disabling synchronous replication if no synchronous replicas are available, blocking all client writes to the master. See :ref:`replication modes documentation <replication_modes>` for details.
    -  **postgresql**:
        -  **use\_pg\_rewind**: whether or not to use pg_rewind
        -  **use\_slots**: whether or not to use replication_slots. Must be False for PostgreSQL 9.3. You should comment out max_replication_slots before it becomes ineligible for leader status.
        -  **recovery\_conf**: additional configuration settings written to recovery.conf when configuring follower. 
        -  **parameters**: list of configuration settings for Postgres. Many of these are required for replication to work.
+    -  **standby\_cluster**: if this section is defined, we want to bootstrap a standby cluster.
+        -  **host**: an address of remote master
+        -  **port**: a port of remote master
+        -  **primary\_slot\_name**: which slot on the remote master to use for replication. This parameter is optional, the default value is derived from the instance name (see function `slot_name_from_member_name`).
+        -  **create\_replica\_methods**: an ordered list of methods that can be used to bootstrap standby leader from the remote master, can be different from the list defined in :ref:`postgresql_settings`
+        -  **restore\_command**: command to restore WAL records from the remote master to standby leader, can be different from the list defined in :ref:`postgresql_settings`
+        -  **archive\_cleanup\_command**: cleanup command for standby leader
+        -  **recovery\_min\_apply\_delay**: how long to wait before actually apply WAL records on a standby leader
 -  **method**: custom script to use for bootstrapping this cluster.
   See :ref:`custom bootstrap methods documentation <custom_bootstrap>` for details.
   When ``initdb`` is specified revert to the default ``initdb`` command. ``initdb`` is also triggered when no ``method``
@@ -113,7 +122,7 @@ PostgreSQL
        -  **on\_start**: run this script when the cluster starts.
        -  **on\_stop**: run this script when the cluster stops.
 -  **connect\_address**: IP address + port through which Postgres is accessible from other nodes and applications.
-  **create\_replica\_method**: an ordered list of the create methods for turning a Patroni node into a new replica.
+-  **create\_replica\_methods**: an ordered list of the create methods for turning a Patroni node into a new replica.
   "basebackup" is the default method; other methods are assumed to refer to scripts, each of which is configured as its
   own config item. See :ref:`custom replica creation methods documentation <custom_replica_creation>` for further explanation.
 -  **data\_dir**: The location of the Postgres data directory, either existing or to be initialized by Patroni.
@@ -131,12 +140,12 @@ PostgreSQL
 -  **pg\_ctl\_timeout**: How long should pg_ctl wait when doing ``start``, ``stop`` or ``restart``. Default value is 60 seconds.
 -  **use\_pg\_rewind**: try to use pg\_rewind on the former leader when it joins cluster as a replica.
 -  **remove\_data\_directory\_on\_rewind\_failure**: If this option is enabled, Patroni will remove postgres data directory and recreate replica. Otherwise it will try to follow the new leader. Default value is **false**.
-  **replica\_method**: for each create_replica_method other than basebackup, you would add a configuration section of the same name. At a minimum, this should include "command" with a full path to the actual script to be executed. Other configuration parameters will be passed along to the script in the form "parameter=value".
+-  **replica\_method**: for each create_replica_methods other than basebackup, you would add a configuration section of the same name. At a minimum, this should include "command" with a full path to the actual script to be executed. Other configuration parameters will be passed along to the script in the form "parameter=value".

 REST API
 -------- 
-  **connect\_address**: IP address and port to access the REST API.
-  **listen**: IP address and port that Patroni will listen to, to provide health-check information for HAProxy.
+-  **connect\_address**: IP address (or hostname) and port, to access the Patroni's REST API. It can serve as a endpoint for HTTP health checks (read below about the "listen" REST API parameter), and also for user queries (either directly or via the REST API), as well as for the health checks done by the cluster members during leader elections (for example, to determine whether the master is still running, or if there is a node which has a WAL position that is ahead of the one doing the query; etc.) The connect_address is put in the member key in DCS, making it possible to translate the member name into the address to connect to its REST API.
+-  **listen**: IP address (or hostname) and port that Patroni will listen to for the REST API - to provide also the same health checks and cluster messaging between the participating nodes, as described above. to provide health-check information for HAProxy (or any other load balancer capable of doing a HTTP "OPTION" or "GET" checks)  
 -  **Optional**:
        -  **authentication**:
            -  **username**: Basic-auth username to protect unsafe REST API endpoints.
@@ -145,6 +154,13 @@ REST API
        -  **certfile**: Specifies the file with the certificate in the PEM format. If the certfile is not specified or is left empty, the API server will work without SSL.
        -  **keyfile**: Specifies the file with the secret key in the PEM format.

+CTL
+---
+-  **Optional**:
+    -  **insecure**: Allow connections to REST API without verifying SSL certs. 
+    -  **cacert**: Specifices the file with the CA_BUNDLE file or directory with certificates of trusted CAs to use while verifying REST API SSL certs.
+    -  **certfile**: Specifies the file with the certificate in the PEM format to use while verifying REST API SSL certs. If not provided patronictl will use the value provided for REST API "certfile" parameter.
+
 ZooKeeper
 ----------
 -  **hosts**: list of ZooKeeper cluster members in format: ['host1:port1', 'host2:port2', 'etc...'].
@@ -3,6 +3,87 @@
 Release notes
 =============

+Version 1.4.6
+-------------
+
+**Bug fixes and stability improvements**
+
+This release fixes a critical issue with Patroni API /master endpoint returning 200 for the non-master node. This is a
+reporting issue, no actual split-brain, but under certain circumstances clients might be directed to the read-only node.
+
+- Reset is_leader status on demote (Alexander Kukushkin, Oleksii Kliukin)
+
+  Make sure demoted cluster member stops responding with code 200 on the /master API call.
+
+- Add new "cluster_unlocked" field to the API output (Dmitry Dolgov)
+
+  This field indicates whether the cluster has the master running. It can be used when it is not possible to query any
+  other node but one of the replicas.
+
+Version 1.4.5
+-------------
+
+**New features**
+
+- Improve logging when applying new postgres configuration (Don Seiler)
+
+  Patroni logs changed parameter names and values.
+
+- Python 3.7 compatibility (Christoph Berg)
+
+  async is a reserved keyword in python3.7
+
+- Set state to "stopped" in the DCS when a member is shut down (Tony Sorrentino)
+
+  This shows the member state as "stopped" in "patronictl list" command.
+
+- Improve the message logged when stale postmaster.pid matches a running process (Ants Aasma)
+
+  The previous one was beyond confusing.
+
+- Implement patronictl reload functionality (Don Seiler)
+
+  Before that it was only possible to reload configuration by either calling REST API or by sending SIGHUP signal to the Patroni process.
+
+- Take and apply some parameters from controldata when starting as a replica (Alexander Kukushkin)
+
+  The value of `max_connections` and some other parameters set in the global configuration may be lower than the one actually used by the primary; when this happens, the replica cannot start and should be fixed manually. Patroni takes care of that now by reading and applying the value from  `pg_controldata`, starting postgres and setting `pending_restart` flag.
+
+- If set, use LD_LIBRARY_PATH when starting postgres (Chris Fraser)
+
+  When starting up Postgres, Patroni was passing along PATH, LC_ALL and LANG env vars if they are set. Now it is doing the same with LD_LIBRARY_PATH. It should help if somebody installed PostgreSQL to non-standard place.
+
+- Rename create_replica_method to create_replica_methods (Dmitry Dolgov)
+
+  To make it clear that it's actually an array. The old name is still supported for backward compatibility.
+
+**Bug fixes and stability improvements**
+
+- Fix condition for the replica start due to pg_rewind in paused state (Oleksii  Kliukin)
+
+  Avoid starting the replica that had already executed pg_rewind before.
+
+- Respond 200 to the master health-check only if update_lock has been successful (Alexander)
+
+  Prevent Patroni from reporting itself a master on the former (demoted) master if DCS is partitioned.
+
+- Fix compatibility with the new consul module (Alexander)
+
+  Starting from v1.1.0 python-consul changed internal API and started using `list` instead of `dict` to pass query parameters.
+
+- Catch exceptions from Patroni REST API thread during shutdown (Alexander)
+
+  Those uncaught exceptions kept PostgreSQL running at shutdown.
+
+- Do crash recovery only when Postgres runs as the master (Alexander)
+
+  Require `pg_controldata` to report  'in production' or 'shutting down' or 'in crash recovery'. In all other cases no crash recovery is necessary.
+
+- Improve handling of configuration errors (Henning Jacobs, Alexander)
+
+  It is possible to change a lot of parameters in runtime (including `restapi.listen`) by updating Patroni config file and sending SIGHUP to Patroni process. This fix eliminates obscure exceptions from the 'restapi' thread when some of the parameters receive invalid values.
+
+
 Version 1.4.4
 -------------

@@ -68,7 +68,7 @@ scripts to clone a new replica. Those are configured in the ``postgresql`` confi
 .. code:: YAML

    postgresql:
-        create_replica_method:
+        create_replica_methods:
            - wal_e
            - basebackup
        wal_e:
@@ -80,7 +80,7 @@ scripts to clone a new replica. Those are configured in the ``postgresql`` confi
            max-rate: '100M'


-The ``create_replica_method`` defines available replica creation methods and the order of executing them. Patroni will
+The ``create_replica_methods`` defines available replica creation methods and the order of executing them. Patroni will
 stop on the first one that returns 0. Each method should define a separate section in the configuration file, listing the command
 to execute and any custom parameters that should be passed to that command. All parameters will be passed in a
 ``--name=value`` format. Besides user-defined parameters, Patroni supplies a couple of cluster-specific ones:
@@ -99,8 +99,9 @@ A special ``no_master`` parameter, if defined, allows Patroni to call the replic
 running master or replicas. In that case, an empty string will be passed in a connection string. This is useful for
 restoring the formerly running cluster from the binary backup.

-A ``basebackup`` method is a special case: it will be used if ``create_replica_method`` is empty, although it is possible
-to list it explicitly among the ``create_replica_method`` methods. This method initializes a new replica with the
+A ``basebackup`` method is a special case: it will be used if
+``create_replica_methods`` is empty, although it is possible
+to list it explicitly among the ``create_replica_methods`` methods. This method initializes a new replica with the
 ``pg_basebackup``, the base backup is taken from the master unless there are replicas with ``clonefrom`` tag, in which case one
 of such replicas will be used as the origin for pg_basebackup. It works without any configuration; however, it is
 possible to specify a ``basebackup`` configuration section. Same rules as with the other method configuration apply,
@@ -128,3 +129,35 @@ and
            - max-rate: '100M'

 If all replica creation methods fail, Patroni will try again all methods in order during the next event loop cycle.
+
+Standby cluster
+---------------
+
+Another available option is to run a "standby cluster", that contains only of
+standby nodes replicating from some remote master. This type of clusters has:
+
+* "standby leader", that behaves pretty much like a regular cluster leader,
+  except it replicates from a remote master.
+
+* cascade replicas, that are replicating from standby leader.
+
+Standby leader holds and updates a leader lock in DCS. If the leader lock
+expires, cascade replicas will perform an election to choose another leader
+from the standbys. For the sake of flexibility, you can specify different
+methods of creating a replica and recovery WAL records when a cluster is in the
+"standby mode", and after it was detached to function as a normal cluster.
+
+To configure such cluster you need to specify the section ``standby_cluster``
+in a patroni configuration:
+
+.. code:: YAML
+
+    bootstrap:
+        dcs:
+            standby_cluster:
+                host: 1.2.3.4
+                port: 5432
+                primary_slot_name: patroni
+
+Note, that these options will be applied only once during cluster bootstrap,
+and the only way to change them afterwards is through DCS.
@@ -42,6 +42,15 @@ Turning on ``synchronous_mode`` does not guarantee multi node durability of comm

 When ``synchronous_mode`` is on and a standby crashes, commits will block until next iteration of Patroni runs and switches the primary to standalone mode (worst case delay for writes ``ttl`` seconds, average case ``loop_wait``/2 seconds). Manually shutting down or restarting a standby will not cause a commit service interruption. Standby will signal the primary to release itself from synchronous standby duties before PostgreSQL shutdown is initiated.

+When it is absolutely necessary to guarantee that each write is stored durably
+on at least two nodes, enable ``synchronous_mode_strict`` in addition to the
+``synchronous_node``. This parameter prevents Patroni from switching off the
+synchronous replication on the primary when no synchronous standby candidates
+are available. As a downside, the primary is not be available for writes
+(unless the Postgres transaction explicitly turns of ``synchronous_mode``),
+blocking all client write requests until at least one synchronous replica comes
+up.
+
 You can ensure that a standby never becomes the synchronous standby by setting ``nosync`` tag to true. This is recommended to set for standbys that are behind slow network connections and would cause performance degradation when becoming a synchronous standby.

 Synchronous mode can be switched on and off via Patroni REST interface. See :ref:`dynamic configuration <dynamic_configuration>` for instructions.
@@ -3,7 +3,7 @@
 `confd` directory contains haproxy template files for the [confd](https://github.com/kelseyhightower/confd) -- lightweight configuration management tool
 You need to copy content of `confd` directory into /etcd/confd and run confd service:
 ```bash
-$ confd -prefix=/service/$PATRONI_SCOPE -backend etcd -node $PATRONI_ETCD_HOST -interval=10
+$ confd -prefix=/service/$PATRONI_SCOPE -backend etcd -node $PATRONI_ETCD_URL -interval=10
 ```
 It will periodically update haproxy.cfg with the actual list of Patroni nodes from `etcd` and "reload" haproxy when it is necessary.

@@ -11,12 +11,20 @@ Type=simple
 User=postgres
 Group=postgres

+# Read in configuration file if it exists, otherwise proceed
+EnvironmentFile=-/etc/patroni_env.conf
+
+WorkingDirectory=~
+
 # Where to send early-startup messages from the server
 # This is normally controlled by the global default set by systemd
 # StandardOutput=syslog

 ExecStart=/bin/patroni /etc/patroni.yml

+# Send HUP to reload from patroni.yml
+ExecReload=/bin/kill -s HUP $MAINPID
+
 # only kill the patroni process, not it's children, so it will gracefully stop postgres
 KillMode=process

@@ -14,11 +14,13 @@ Feature: basic replication
    Then table foo is present on postgres2 after 20 seconds

  Scenario: check restart of sync replica
-    Given I run patronictl.py restart batman postgres2 --force
-    And "sync" key in DCS has sync_standby=postgres1 after 2 seconds
-    And I run patronictl.py restart batman postgres1 --force
-    Then I receive a response returncode 0
-    And "sync" key in DCS has sync_standby=postgres2 after 10 seconds
+    Given I shut down postgres2
+    Then "sync" key in DCS has sync_standby=postgres1 after 5 seconds
+    When I start postgres2
+    And I shut down postgres1
+    Then "sync" key in DCS has sync_standby=postgres2 after 10 seconds
+    When I start postgres1
+    And "members/postgres1" key in DCS has state=running after 10 seconds
    And I sleep for 2 seconds
    When I issue a GET request to http://127.0.0.1:8010/sync
    Then I receive a response code 200
@@ -30,7 +32,7 @@ Feature: basic replication
    Then I receive a response returncode 0
    When I sleep for 2 seconds
    And I shut down postgres0
-    And I run patronictl.py resume batman 
+    And I run patronictl.py resume batman
    Then I receive a response returncode 0
    And postgres2 role is the primary after 24 seconds
    When I issue a PATCH request to http://127.0.0.1:8010/config with {"synchronous_mode": null, "master_start_timeout": 0}
@@ -612,6 +612,13 @@ class PatroniPoolController(object):
                'method': 'pg_basebackup',
                'pg_basebackup': {
                    'command': self.BACKUP_SCRIPT + ' --walmethod=stream --dbname=' + f.backup_source
+                },
+                'dcs': {
+                    'postgresql': {
+                        'parameters': {
+                            'max_connections': 101
+                        }
+                    }
                }
            },
            'postgresql': {
@@ -71,6 +71,14 @@ Scenario: check the switchover via the API in the pause mode
 	And postgres1 role is the primary after 10 seconds
 	And postgres0 role is the secondary after 10 seconds
 	And replication works from postgres1 to postgres0 after 20 seconds
+	When I issue a GET request to http://127.0.0.1:8008/master
+	Then I receive a response code 503
+	When I issue a GET request to http://127.0.0.1:8008/replica
+	Then I receive a response code 200
+	When I issue a GET request to http://127.0.0.1:8009/master
+	Then I receive a response code 200
+	When I issue a GET request to http://127.0.0.1:8009/replica
+	Then I receive a response code 503

 Scenario: check the scheduled switchover
 	Given I issue a scheduled switchover from postgres1 to postgres0 in 3 seconds
@@ -84,6 +92,14 @@ Scenario: check the scheduled switchover
 	And postgres0 role is the primary after 10 seconds
 	And postgres1 role is the secondary after 10 seconds
 	And replication works from postgres0 to postgres1 after 25 seconds
+	When I issue a GET request to http://127.0.0.1:8008/master
+	Then I receive a response code 200
+	When I issue a GET request to http://127.0.0.1:8008/replica
+	Then I receive a response code 503
+	When I issue a GET request to http://127.0.0.1:8009/master
+	Then I receive a response code 503
+	When I issue a GET request to http://127.0.0.1:8009/replica
+	Then I receive a response code 200

 Scenario: check the scheduled restart
 	Given I issue a PATCH request to http://127.0.0.1:8008/config with {"postgresql": {"parameters": {"superuser_reserved_connections": "6"}}}
@@ -0,0 +1,16 @@
+Feature: standby cluster
+
+  Scenario: check replication of a single table in a standby cluster
+    Given I start postgres0 without slots sync
+    And I create a replication slot postgres1 on postgres0
+    And I start postgres1 in a standby cluster batman1 as a clone of postgres0
+    Then postgres1 is a leader of batman1 after 10 seconds
+    When I add the table foo to postgres0
+    Then table foo is present on postgres1 after 20 seconds
+    When I start postgres2 in a cluster batman1
+    Then postgres2 role is the replica after 24 seconds
+    And table foo is present on postgres2 after 20 seconds
+
+  Scenario: check failover
+    When I kill postgres1
+	Then postgres2 is replicating from postgres0 after 20 seconds
@@ -0,0 +1,78 @@
+import time
+
+from behave import step
+
+
+select_replication_query = """
+SELECT * FROM pg_catalog.pg_stat_replication
+WHERE application_name = '{0}'
+"""
+
+create_replication_slot_query = """
+SELECT pg_create_physical_replication_slot('{0}')
+"""
+
+
+@step('I start {name:w} without slots sync')
+def start_patroni_without_slots_sync(context, name):
+    return context.pctl.start(name, custom_config={
+        "bootstrap": {
+            "dcs": {
+                "postgresql": {
+                    "use_slots": False
+                }
+            }
+        }
+    })
+
+
+@step('I start {name:w} in a cluster {cluster_name:w}')
+def start_patroni(context, name, cluster_name):
+    return context.pctl.start(name, custom_config={
+        "scope": cluster_name
+    })
+
+
+@step('I start {name:w} in a standby cluster {cluster_name:w} as a clone of {name2:w}')
+def start_patroni_stanby_cluster(context, name, cluster_name, name2):
+    port = context.pctl._processes[name2]._connkwargs.get('port')
+    return context.pctl.start(name, custom_config={
+        "scope": cluster_name,
+        "bootstrap": {
+            "dcs": {
+                "standby_cluster": {
+                    "host": "localhost",
+                    "port": port,
+                    "primary_slot_name": "postgres1",
+                }
+            }
+        }
+    })
+
+
+@step('{pg_name1:w} is replicating from {pg_name2:w} after {timeout:d} seconds')
+def check_replication_status(context, pg_name1, pg_name2, timeout):
+    bound_time = time.time() + timeout
+
+    while time.time() < bound_time:
+        cur = context.pctl.query(
+            pg_name2,
+            select_replication_query.format(pg_name1),
+            fail_ok=True
+        )
+
+        if cur and len(cur.fetchall()) != 0:
+            return True
+
+        time.sleep(1)
+
+    return False
+
+
+@step('I create a replication slot {slot_name:w} on {pg_name:w}')
+def create_replication_slot(context, slot_name, pg_name):
+    return context.pctl.query(
+        pg_name,
+        create_replication_slot_query.format(slot_name),
+        fail_ok=True
+    )
@@ -1,29 +1,29 @@
-FROM postgres:9.6
+FROM postgres:10
 MAINTAINER Alexander Kukushkin <[email protected]>

 RUN export DEBIAN_FRONTEND=noninteractive \
    && echo 'APT::Install-Recommends "0";\nAPT::Install-Suggests "0";' > /etc/apt/apt.conf.d/01norecommend \
    && apt-get update -y \
    && apt-get upgrade -y \
-    && apt-get install -y git curl jq python-psycopg2 python-yaml python-requests python-six python-pysocks \
-        python-dateutil python-pip python-prettytable python-wheel python-psutil python locales \
+    && apt-get install -s patroni | sed -n -e '/^Inst patroni /d' -e 's/^Inst \([^ ]\+\) .*$/\1/p' \
+           | xargs apt-get install -y curl jq locales git python3-pip python3-wheel \

    ## Make sure we have a en_US.UTF-8 locale available
    && localedef -i en_US -c -f UTF-8 -A /usr/share/locale/locale.alias en_US.UTF-8 \

-    && pip install setuptools pip --upgrade \
-    && pip install 'git+https://github.com/zalando/patroni.git#egg=patroni[kubernetes]' \
+    && pip3 install setuptools \
+    && pip3 install 'git+https://github.com/zalando/patroni.git#egg=patroni[kubernetes]' \

    && mkdir -p /home/postgres \
    && chown postgres:postgres /home/postgres \

    # Clean up
-    && apt-get remove -y git python-pip python-setuptools \
+    && apt-get remove -y git python3-pip python3-wheel \
    && apt-get autoremove -y \
    && apt-get clean -y \
    && rm -rf /var/lib/apt/lists/* /root/.cache

-ADD entrypoint.sh callback.py /
+ADD entrypoint.sh /

 EXPOSE 5432 8008
 ENV LC_ALL=en_US.UTF-8 LANG=en_US.UTF-8
@@ -1,62 +0,0 @@
-#!/usr/bin/env python
-
-import logging
-import os
-import socket
-import sys
-import time
-
-from kubernetes import client as k8s_client, config as k8s_config
-from urllib3.exceptions import HTTPError
-from six.moves.http_client import HTTPException
-
-logger = logging.getLogger(__name__)
-
-
-class CoreV1Api(k8s_client.CoreV1Api):
-
-    def retry(func):
-        def wrapped(*args, **kwargs):
-            count = 0
-            while True:
-                try:
-                    return func(*args, **kwargs)
-                except (HTTPException, HTTPError, socket.error, socket.timeout):
-                    if count >= 10:
-                        raise
-                    logger.info('Throttling API requests...')
-                    time.sleep(2 ** count * 0.5)
-                    count += 1
-        return wrapped
-
-    @retry
-    def patch_namespaced_endpoints(self, *args, **kwargs):
-        return super(CoreV1Api, self).patch_namespaced_endpoints(*args, **kwargs)
-
-
-def patch_master_endpoint(api, namespace, cluster):
-    addresses = [k8s_client.V1EndpointAddress(ip=os.environ['POD_IP'])]
-    ports = [k8s_client.V1EndpointPort(port=5432)]
-    subsets = [k8s_client.V1EndpointSubset(addresses=addresses, ports=ports)]
-    body = k8s_client.V1Endpoints(subsets=subsets)
-    return api.patch_namespaced_endpoints(cluster, namespace, body)
-
-
-def main():
-    logging.basicConfig(format='%(asctime)s %(levelname)s: %(message)s', level=logging.INFO)
-    if len(sys.argv) != 4 or sys.argv[1] not in ('on_start', 'on_stop', 'on_role_change'):
-        sys.exit('Usage: %s <action> <role> <cluster_name>', sys.argv[0])
-
-    action, role, cluster = sys.argv[1:4]
-
-    k8s_config.load_incluster_config()
-    k8s_api = CoreV1Api()
-
-    namespace = os.environ['KUBERNETES_NAMESPACE']
-
-    if role == 'master' and action in ('on_start', 'on_role_change'):
-        patch_master_endpoint(k8s_api, namespace, cluster)
-
-
-if __name__ == '__main__':
-    main()
@@ -0,0 +1,189 @@
+#!/bin/bash
+
+# here you can defind your own alias to minikube
+lkubectl='kubectl --context=local'
+
+shopt -s expand_aliases
+
+alias lkubectl="$lkubectl"
+labels=application=patroni,cluster-name=patronidemo
+
+# clean up objects from previous attempts
+lkubectl delete statefulset,pods,service,endpoints -l $labels
+
+# clear old panes
+for pane in {3..1}; do
+    tmux send-keys -t 0.$pane C-c
+    tmux kill-pane -t 0.$pane
+done
+
+tmux send-keys -t 0.0 C-c
+tmux send-keys -t 0.0 C-l
+
+# split window into 3 panes
+tmux split-window -h -t 0.0
+tmux split-window -v -t 0.0
+tmux split-window -v -t 0.1
+
+tmux send-keys -t 0.3 "export PGPASSWORD=zalando" Enter
+tmux send-keys -t 0.3 "export PGCONNECT_TIMEOUT=1" Enter
+
+for pane in {0..3}; do
+    tmux send-keys -t 0.$pane "shopt -s expand_aliases" Enter
+    tmux send-keys -t 0.$pane "alias lkubectl='$lkubectl'" Enter
+    tmux send-keys -t 0.$pane C-l
+done
+
+# run 
+tmux resize-pane -Z -t 0.3
+
+tmux send-keys -t 0.3 "lkubectl apply -f patroni_k8s.yaml" Enter
+
+tmux send-keys -t 0.3 "lkubectl get pods -w -l $labels -L role -o wide" Enter
+
+read
+
+tmux send-keys -t 0.3 C-c
+#tmux send-keys -t 0.3 C-l
+#
+#tmux send-keys -t 0.3 "lkubectl get pods -l $labels -L role -o wide" Enter
+#
+#read
+
+# tail logs from patroni pods
+for pane in {0..2}; do
+    tmux send-keys -t 0.$pane "lkubectl logs patronidemo-$pane -f" Enter
+done
+
+tmux resize-pane -Z -t 0.3
+
+read
+
+tmux resize-pane -Z -t 0.0
+
+read
+
+tmux resize-pane -Z -t 0.0
+
+read
+
+tmux resize-pane -Z -t 0.1
+
+read
+
+tmux resize-pane -Z -t 0.1
+
+read
+
+tmux resize-pane -Z -t 0.3
+tmux send-keys -t 0.3 C-l
+
+tmux send-keys -t 0.3 "lkubectl get pods -l $labels -L role -o wide" Enter
+
+read
+
+tmux send-keys -t 0.3 Enter
+tmux send-keys -t 0.3 "lkubectl get services -l $labels" Enter
+
+read
+
+tmux send-keys -t 0.3 Enter
+tmux send-keys -t 0.3 "lkubectl get endpoints -l $labels" Enter
+
+read
+
+tmux send-keys -t 0.3 C-l
+tmux send-keys -t 0.3 "lkubectl get pods -l $labels -L role -o wide" Enter
+tmux send-keys -t 0.3 Enter
+tmux send-keys -t 0.3 "lkubectl get endpoints patronidemo -o yaml" Enter
+
+read
+
+tmux send-keys -t 0.3 C-l
+tmux send-keys -t 0.3 "lkubectl get pods -l $labels -L role -o wide" Enter
+tmux send-keys -t 0.3 Enter
+tmux send-keys -t 0.3 "lkubectl describe service patronidemo-repl" Enter
+
+read
+
+tmux send-keys -t 0.3 C-l
+tmux send-keys -t 0.3 "lkubectl get endpoints patronidemo-config -o yaml" Enter
+
+read
+
+MASTERIP=$(lkubectl get service patronidemo -o jsonpath='{.spec.clusterIP}')
+
+tmux resize-pane -Z -t 0.3
+
+tmux send-keys -t 0.3 "watch -n 1 \"psql -h $MASTERIP -U postgres -c \\\"select txid_current(), array_agg(application_name||'=>'|| sync_state) AS \\\\\\\"array_agg(application_name||'=>'||sync_state)\\\\\\\" from pg_stat_replication\\\"\"" Enter
+
+read
+
+# kill master node
+lkubectl delete pod patronidemo-0
+
+read
+
+tmux resize-pane -Z -t 0.1
+tmux send-keys -t 0.1 C-b PageUp
+
+read
+
+tmux send-keys -t 0.1 Enter
+tmux resize-pane -Z -t 0.1
+
+read
+
+tmux resize-pane -Z -t 0.2
+tmux send-keys -t 0.2 PageUp
+
+read
+
+tmux send-keys -t 0.2 Enter
+tmux resize-pane -Z -t 0.2
+
+read
+
+tmux send-keys -t 0.0 C-c
+tmux send-keys -t 0.0 "lkubectl logs patronidemo-0 -f" Enter
+
+read
+
+tmux resize-pane -Z -t 0.3
+tmux send-keys -t 0.3 C-c 
+tmux send-keys -t 0.3 C-l
+tmux send-keys -t 0.3 "lkubectl get pods -l $labels -L role -o wide" Enter
+tmux send-keys -t 0.3 Enter
+tmux send-keys -t 0.3 "lkubectl get endpoints -l $labels" Enter
+
+read
+
+tmux send-keys -t 0.3 C-l
+tmux send-keys -t 0.3 "lkubectl get endpoints patronidemo -o yaml" Enter
+
+read
+
+tmux resize-pane -Z -t 0.3
+tmux send-keys -t 0.3 C-c 
+tmux send-keys -t 0.3 C-l
+tmux send-keys -t 0.3 "lkubectl exec -ti patronidemo-0 patronictl switchover patronidemo" Enter
+
+read
+
+tmux send-keys -t 0.3 Enter
+
+read
+
+tmux send-keys -t 0.3 "patronidemo-0" Enter
+
+read
+
+tmux send-keys -t 0.3 Enter
+
+read
+
+tmux send-keys -t 0.3 "y" Enter
+
+read
+
+tmux send-keys -t 0.3 "lkubectl exec -ti patronidemo-0 patronictl list patronidemo" Enter
@@ -13,24 +13,11 @@ bootstrap:
  - data-checksums
  pg_hba:
  - host all all 0.0.0.0/0 md5
-  - host replication ${PATRONI_REPLICATION_USERNAME} ${POD_IP}/16    md5
+  - host replication ${PATRONI_REPLICATION_USERNAME} ${PATRONI_KUBERNETES_POD_IP}/16    md5
 restapi:
-  connect_address: '${POD_IP}:8008'
+  connect_address: '${PATRONI_KUBERNETES_POD_IP}:8008'
 postgresql:
-  connect_address: '${POD_IP}:5432'
-  authentication:
-    superuser:
-      password: '${PATRONI_SUPERUSER_PASSWORD}'
-    replication:
-      password: '${PATRONI_REPLICATION_PASSWORD}'
-  callbacks:
-    on_start: /callback.py
-    on_stop: /callback.py
-    on_role_change: /callback.py
+  connect_address: '${PATRONI_KUBERNETES_POD_IP}:5432'
 __EOF__

-unset PATRONI_SUPERUSER_PASSWORD PATRONI_REPLICATION_PASSWORD
-export KUBERNETES_NAMESPACE=$PATRONI_KUBERNETES_NAMESPACE
-export POD_NAME=$PATRONI_NAME
-
-exec /usr/bin/python /usr/local/bin/patroni /home/postgres/patroni.yml
+exec /usr/bin/python3 /usr/local/bin/patroni /home/postgres/patroni.yml
@@ -1,3 +1,5 @@
+# This manifest (and Docker image) works only with emptyDir volume and are designed for demo purpose.
+# For production usage please take a look at https://github.com/zalando/spilo/tree/master/postgres-appliance
 apiVersion: apps/v1beta1
 kind: StatefulSet
 metadata:
@@ -19,6 +21,9 @@ spec:
      - name: *cluster_name
        image: patroni  # docker build -t patroni .
        imagePullPolicy: IfNotPresent
+#        resources:
+#          limits:
+#            cpu: 100m
        ports:
        - containerPort: 8008
          protocol: TCP
@@ -28,7 +33,7 @@ spec:
        - mountPath: /home/postgres/pgdata
          name: pgdata
        env:
-        - name: POD_IP
+        - name: PATRONI_KUBERNETES_POD_IP
          valueFrom:
            fieldRef:
              fieldPath: status.podIP
@@ -36,6 +41,8 @@ spec:
          valueFrom:
            fieldRef:
              fieldPath: metadata.namespace
+        - name: PATRONI_KUBERNETES_USE_ENDPOINTS
+          value: 'true'
        - name: PATRONI_KUBERNETES_LABELS
          value: '{application: patroni, cluster-name: patronidemo}'
        - name: PATRONI_SUPERUSER_USERNAME
@@ -86,6 +93,7 @@ spec:
 #          storage: 5Gi

 ---
+# Endpoint for leader elections
 apiVersion: v1
 kind: Endpoints
 metadata:
@@ -96,6 +104,7 @@ metadata:
 subsets: []

 ---
+# master Service
 apiVersion: v1
 kind: Service
 metadata:
@@ -110,6 +119,26 @@ spec:
    targetPort: 5432

 ---
+# replica Service
+apiVersion: v1
+kind: Service
+metadata:
+  name: patronidemo-repl
+  labels:
+    application: patroni
+    cluster-name: &cluster_name patronidemo
+spec:
+  type: ClusterIP
+  selector:
+    application: patroni
+    cluster-name: *cluster_name
+    role: replica
+  ports:
+  - port: 5432
+    targetPort: 5432
+
+---
+# Secrets (superuser password and replication passwor)
 apiVersion: v1
 kind: Secret
 metadata:
@@ -145,6 +174,8 @@ rules:
  - patch
  - update
  - watch
+  # delete is required only for 'patronictl remove'
+  - delete
 - apiGroups:
  - ""
  resources:
@@ -157,6 +188,8 @@ rules:
  - create
  - list
  - watch
+  # delete is required only for for 'patronictl remove'
+  - delete
 - apiGroups:
  - ""
  resources:
@@ -129,7 +129,10 @@ class Patroni(object):
        signal.signal(signal.SIGTERM, self.sigterm_handler)

    def shutdown(self):
-        self.api.shutdown()
+        try:
+            self.api.shutdown()
+        except Exception:
+            logger.exception('Exception during RestApi.shutdown')
        self.ha.shutdown()


@@ -185,7 +188,7 @@ def main():
                if ret == (0, 0):
                    break
                elif ret[0] != pid:
-                    logging.info('Reaped pid=%s, exit status=%s', *ret)
+                    logger.info('Reaped pid=%s, exit status=%s', *ret)
        except OSError:
            pass

@@ -8,7 +8,8 @@ import dateutil.parser
 import datetime

 from patroni.postgresql import PostgresConnectionException, PostgresException, Postgresql
-from patroni.utils import deep_compare, parse_bool, patch_config, Retry, RetryFailedError, parse_int, tzutc
+from patroni.utils import deep_compare, parse_bool, patch_config, Retry, \
+    RetryFailedError, parse_int, split_host_port, tzutc
 from six.moves.BaseHTTPServer import BaseHTTPRequestHandler, HTTPServer
 from six.moves.socketserver import ThreadingMixIn
 from threading import Thread
@@ -83,35 +84,20 @@ class RestApiHandler(BaseHTTPRequestHandler):
        patroni = self.server.patroni
        cluster = patroni.dcs.cluster

-        def is_synchronous():
-            return (cluster.is_synchronous_mode() and cluster.sync
-                    and cluster.sync.sync_standby == patroni.postgresql.name)
+        replica_status_code = 200 if not patroni.noloadbalance and response.get('role') == 'replica' else 503
+        status_code = 503

-        def is_balanceable_replica():
-            return response.get('role') == 'replica' and not patroni.noloadbalance
-
-        if cluster:  # dcs available
-            if cluster.leader and cluster.leader.name == patroni.postgresql.name:  # is_leader
-                status_code = 200 if 'master' in path else 503
-            elif 'role' not in response:
-                status_code = 503
-            elif response['role'] == 'master':  # running as master but without leader lock!!!!
-                status_code = 503
-            elif path in ('/sync', '/synchronous'):
-                status_code = 200 if is_balanceable_replica() and is_synchronous() else 503
-            elif path in ('/async', '/asynchronous'):
-                status_code = 200 if is_balanceable_replica() and not is_synchronous() else 503
-            elif response['role'] in path:  # response['role'] != 'master'
-                status_code = 503 if patroni.noloadbalance else 200
-            else:
-                status_code = 503
-        elif 'role' in response and response['role'] in path:
-            status_code = 503 if response['role'] != 'master' and patroni.noloadbalance else 200
-        elif patroni.ha.restart_scheduled() and patroni.postgresql.role == 'master' and 'master' in path:
-            # exceptional case for master node when the postgres is being restarted via API
-            status_code = 200
-        else:
-            status_code = 503
+        if 'master' in path:
+            status_code = 200 if patroni.ha.is_leader() else 503
+        elif 'replica' in path:
+            status_code = replica_status_code
+        elif cluster:  # dcs is available
+            is_synchronous = cluster.is_synchronous_mode() and cluster.sync \
+                    and cluster.sync.sync_standby == patroni.postgresql.name
+            if path in ('/sync', '/synchronous') and is_synchronous:
+                status_code = replica_status_code
+            elif path in ('/async', '/asynchronous') and not is_synchronous:
+                status_code = replica_status_code

        if write_status_code_only:  # when haproxy sends OPTIONS request it reads only status code and nothing more
            message = self.responses[status_code][0]
@@ -414,6 +400,8 @@ class RestApiHandler(BaseHTTPRequestHandler):

    def get_postgresql_status(self, retry=False):
        try:
+            cluster = self.server.patroni.dcs.cluster
+
            if self.server.patroni.postgresql.state not in ('running', 'restarting', 'starting'):
                raise RetryFailedError('')
            stmt = ("WITH replication_info AS ("
@@ -438,6 +426,7 @@ class RestApiHandler(BaseHTTPRequestHandler):
                'postmaster_start_time': row[0],
                'role': 'replica' if row[1] == 0 else 'master',
                'server_version': self.server.patroni.postgresql.server_version,
+                'cluster_unlocked': bool(not cluster or cluster.is_unlocked()),
                'xlog': ({
                    'received_location': row[3],
                    'replayed_location': row[4],
@@ -450,7 +439,6 @@ class RestApiHandler(BaseHTTPRequestHandler):
            if row[1] > 0:
                result['timeline'] = row[1]
            else:
-                cluster = self.server.patroni.dcs.cluster
                leader_timeline = None if not cluster or cluster.is_unlocked() else cluster.leader.timeline
                result['timeline'] = self.server.patroni.postgresql.replica_cached_timeline(leader_timeline)

@@ -473,6 +461,7 @@ class RestApiServer(ThreadingMixIn, HTTPServer, Thread):

    def __init__(self, patroni, config):
        self.patroni = patroni
+        self.__listen = None
        self.__initialize(config)
        self.__set_config_parameters(config)
        self.daemon = True
@@ -507,18 +496,25 @@ class RestApiServer(ThreadingMixIn, HTTPServer, Thread):
    def __get_ssl_options(config):
        return {option: config[option] for option in ['certfile', 'keyfile'] if option in config}

-    def __set_connection_string(self, connect_address):
-        self.connection_string = '{0}://{1}/patroni'.format(self.__protocol, connect_address or self.__listen)
-
    def __set_config_parameters(self, config):
        self.__auth_key = base64.b64encode(config['auth'].encode('utf-8')).decode('utf-8') if 'auth' in config else None
-        self.__set_connection_string(config.get('connect_address'))
+        self.connection_string = '{0}://{1}/patroni'.format(self.__protocol,
+                                                            config.get('connect_address') or self.__listen)

    def __initialize(self, config):
-        self.__ssl_options = self.__get_ssl_options(config)
+        try:
+            host, port = split_host_port(config['listen'], None)
+        except Exception:
+            raise ValueError('Invalid "restapi" config: expected <HOST>:<PORT> for "listen", but got "{0}"'
+                             .format(config['listen']))
+
+        if self.__listen is not None:  # changing config in runtime
+            self.shutdown()
+
        self.__listen = config['listen']
-        host, port = config['listen'].rsplit(':', 1)
-        HTTPServer.__init__(self, (host, int(port)), RestApiHandler)
+        self.__ssl_options = self.__get_ssl_options(config)
+
+        HTTPServer.__init__(self, (host, port), RestApiHandler)
        Thread.__init__(self, target=self.serve_forever)
        self._set_fd_cloexec(self.socket)

@@ -530,11 +526,13 @@ class RestApiServer(ThreadingMixIn, HTTPServer, Thread):
            import ssl
            self.socket = ssl.wrap_socket(self.socket, server_side=True, **self.__ssl_options)
            self.__protocol = 'https'
-        self.__set_connection_string(config.get('connect_address'))
+        return True

    def reload_config(self, config):
-        self.__set_config_parameters(config)
-        if self.__listen != config['listen'] or self.__ssl_options != self.__get_ssl_options(config):
-            self.shutdown()
-            self.__initialize(config)
+        if 'listen' not in config:  # changing config in runtime
+            raise ValueError('Can not find "restapi.listen" config')
+
+        elif (self.__listen != config['listen'] or self.__ssl_options != self.__get_ssl_options(config)) \
+                and self.__initialize(config):
            self.start()
+        self.__set_config_parameters(config)
@@ -1,13 +1,14 @@
 import json
 import logging
 import os
+import six
 import sys
 import tempfile
 import yaml

 from collections import defaultdict
 from copy import deepcopy
-from patroni.dcs import ClusterConfig
+from patroni.dcs import ClusterConfig, is_standby_cluster
 from patroni.postgresql import Postgresql
 from patroni.utils import deep_compare, parse_bool, parse_int, patch_config
 from requests.structures import CaseInsensitiveDict
@@ -45,6 +46,15 @@ class Config(object):
        'master_start_timeout': 300,
        'synchronous_mode': False,
        'synchronous_mode_strict': False,
+        'standby_cluster': {
+            'create_replica_methods': '',
+            'host': '',
+            'port': '',
+            'primary_slot_name': '',
+            'restore_command': '',
+            'archive_cleanup_command': '',
+            'recovery_min_apply_delay': ''
+        },
        'postgresql': {
            'bin_dir': '',
            'use_slots': True,
@@ -88,6 +98,10 @@ class Config(object):
    def dynamic_configuration(self):
        return deepcopy(self._dynamic_configuration)

+    @property
+    def is_standby_cluster(self):
+        return is_standby_cluster(self._dynamic_configuration.get('standby_cluster'))
+
    def check_mode(self, mode):
        return bool(parse_bool(self._dynamic_configuration.get(mode)))

@@ -158,6 +172,8 @@ class Config(object):
                    self._local_configuration = configuration
                    self.__effective_configuration = new_configuration
                    return True
+                else:
+                    logger.info('No configuration items changed, nothing to reload.')
            except Exception:
                logger.exception('Exception when reloading local configuration from %s', self.config_file)
                if dry_run:
@@ -181,6 +197,13 @@ class Config(object):
                        config['postgresql'][name].update(self._process_postgresql_parameters(value))
                    elif name not in ('connect_address', 'listen', 'data_dir', 'pgpass', 'authentication'):
                        config['postgresql'][name] = deepcopy(value)
+            elif name == 'standby_cluster':
+                allowed_keys = self.__DEFAULT_CONFIG['standby_cluster'].keys()
+                expected = {
+                    k: v for k, v in (value or {}).items()
+                    if (k in allowed_keys and isinstance(v, six.string_types))
+                }
+                config['standby_cluster'].update(expected)
            elif name in config:  # only variables present in __DEFAULT_CONFIG allowed to be overriden from DCS
                if name in ('synchronous_mode', 'synchronous_mode_strict'):
                    config[name] = value
@@ -315,8 +338,15 @@ class Config(object):
        if 'name' not in config and 'name' in pg_config:
            config['name'] = pg_config['name']

-        pg_config.update({p: config[p] for p in ('name', 'scope', 'retry_timeout',
-                          'synchronous_mode', 'maximum_lag_on_failover') if p in config})
+        updated_fields = (
+            'name',
+            'scope',
+            'retry_timeout',
+            'synchronous_mode',
+            'maximum_lag_on_failover'
+        )
+
+        pg_config.update({p: config[p] for p in updated_fields if p in config})

        return config

@@ -103,15 +103,20 @@ option_watch = click.option('-W', is_flag=True, help='Auto update the screen eve
 option_force = click.option('--force', is_flag=True, help='Do not ask for confirmation at any point')
 arg_cluster_name = click.argument('cluster_name', required=False,
                                  default=lambda: click.get_current_context().obj.get('scope'))
+option_insecure = click.option('-k', '--insecure', is_flag=True, help='Allow connections to SSL sites without certs')


@click.group()
@click.option('--config-file', '-c', help='Configuration file', default=CONFIG_FILE_PATH)
@click.option('--dcs', '-d', help='Use this DCS', envvar='DCS')
+@option_insecure
@click.pass_context
-def ctl(ctx, config_file, dcs):
+def ctl(ctx, config_file, dcs, insecure):
    logging.basicConfig(format='%(asctime)s - %(levelname)s - %(message)s', level=os.environ.get('LOGLEVEL', 'WARNING'))
+    logging.captureWarnings(True)  # Capture eventual SSL warning
    ctx.obj = load_config(config_file, dcs)
+    # backward compatibility for configuration file where ctl section is not define
+    ctx.obj.setdefault('ctl', {})['insecure'] = ctx.obj.get('ctl', {}).get('insecure') or insecure


 def get_dcs(config, scope):
@@ -129,6 +134,7 @@ def auth_header(config):


 def request_patroni(member, request_type, endpoint, content=None, headers=None):
+    ctx = click.get_current_context()  # the current click context
    headers = headers or {}
    url_parts = urlparse(member.api_url)
    logging.debug(url_parts)
@@ -137,8 +143,21 @@ def request_patroni(member, request_type, endpoint, content=None, headers=None):

    url = '{0}://{1}/{2}'.format(url_parts.scheme, url_parts.netloc, endpoint)

+    insecure = ctx.obj.get('ctl', {}).get('insecure', False)
+    # Get certfile if any from several configuration namespace
+    cert = ctx.obj.get('ctl', {}).get('cacert') or \
+        ctx.obj.get('restapi', {}).get('cacert') or \
+        ctx.obj.get('restapi', {}).get('certfile')
+    # In the case we specificaly disable SSL cert verification we don't want to have the warning
+    if insecure:
+        verify = False
+    elif cert:
+        verify = cert
+    else:
+        verify = True
    return getattr(requests, request_type)(url, headers=headers,
-                                           data=json.dumps(content) if content else None, timeout=60)
+                                           data=json.dumps(content) if content else None, timeout=60,
+                                           verify=verify)


 def print_output(columns, rows=None, alignment=None, fmt='pretty', header=True, delimiter='\t'):
@@ -445,6 +464,33 @@ def parse_scheduled(scheduled):
    return None


+@ctl.command('reload', help='Reload cluster member configuration')
+@click.argument('cluster_name')
+@click.argument('member_names', nargs=-1)
+@click.option('--role', '-r', help='Reload only members with this role', default='any',
+              type=click.Choice(['master', 'replica', 'any']))
+@option_force
+@click.pass_obj
+def reload(obj, cluster_name, member_names, force, role):
+    cluster = get_dcs(obj, cluster_name).get_cluster()
+
+    members = get_members(cluster, cluster_name, member_names, role, force, 'reload')
+
+    content = {}
+    for member in members:
+        r = request_patroni(member, 'post', 'reload', content, auth_header(obj))
+        if r.status_code == 200:
+            click.echo('No changes to apply on member {0}'.format(member.name))
+        elif r.status_code == 202:
+            click.echo('Reload request received for member {0} and will be processed within {1} seconds'.format(
+                member.name, cluster.config.data.get('loop_wait'))
+            )
+        else:
+            click.echo('Failed: reload for member {0}, status code={1}, ({2})'.format(
+                member.name, r.status_code, r.text)
+            )
+
+
@ctl.command('restart', help='Restart cluster member')
@click.argument('cluster_name')
@click.argument('member_names', nargs=-1)
@@ -558,7 +604,8 @@ def _do_failover_or_switchover(obj, action, cluster_name, master, candidate, for
    if master is not None and cluster.leader and cluster.leader.member.name != master:
        raise PatroniCtlException('Member {0} is not the leader of cluster {1}'.format(master, cluster_name))

-    candidate_names = [str(m.name) for m in cluster.members if m.name != master]
+    # excluding members with nofailover tag
+    candidate_names = [str(m.name) for m in cluster.members if m.name != master and not m.nofailover]
    # We sort the names for consistent output to the client
    candidate_names.sort()

@@ -875,7 +922,8 @@ def toggle_pause(config, cluster_name, paused, wait):
    for member in members:
        try:
            r = request_patroni(member, 'patch', 'config', {'pause': paused or None}, auth_header(config))
-        except Exception:
+        except Exception as err:
+            logging.warning(str(err))
            logging.warning('Member %s is not accessible', member.name)
            continue

@@ -108,12 +108,29 @@ class Member(namedtuple('Member', 'index,name,session,data')):

    @property
    def conn_url(self):
-        return self.data.get('conn_url')
+        conn_url = self.data.get('conn_url')
+        conn_kwargs = self.data.get('conn_kwargs')
+        if conn_url:
+            return conn_url
+
+        if conn_kwargs:
+            conn_url = 'postgresql://{host}:{port}'.format(
+                host=conn_kwargs.get('host'),
+                port=conn_kwargs.get('port'),
+            )
+            self.data['conn_url'] = conn_url
+            return conn_url

    def conn_kwargs(self, auth=None):
+        defaults = {
+            "host": "",
+            "port": "",
+            "database": ""
+        }
        ret = self.data.get('conn_kwargs')
        if ret:
-            ret = ret.copy()
+            defaults.update(ret)
+            ret = defaults
        else:
            r = urlparse(self.conn_url)
            ret = {
@@ -159,6 +176,27 @@ class Member(namedtuple('Member', 'index,name,session,data')):
        return self.state == 'running'


+class RemoteMember(Member):
+    """ Represents a remote master for a standby cluster
+    """
+    def __new__(cls, name, data):
+        return super(RemoteMember, cls).__new__(cls, None, name, None, data)
+
+    @staticmethod
+    def allowed_keys():
+        return ('primary_slot_name',
+                'create_replica_methods',
+                'restore_command',
+                'archive_cleanup_command',
+                'recovery_min_apply_delay')
+
+    def __getattr__(self, name):
+        if name not in RemoteMember.allowed_keys():
+            return
+
+        return self.data.get(name)
+
+
 class Leader(namedtuple('Leader', 'index,session,member')):

    """Immutable object (namedtuple) which represents leader key.
@@ -359,6 +397,9 @@ class Cluster(namedtuple('Cluster', 'initialize,config,leader,last_leader_operat
    def is_synchronous_mode(self):
        return self.check_mode('synchronous_mode')

+    def is_standby_cluster(self):
+        return is_standby_cluster(self.config and self.config.data.get('standby_cluster'))
+

@six.add_metaclass(abc.ABCMeta)
 class AbstractDCS(object):
@@ -612,3 +653,14 @@ class AbstractDCS(object):

        self.event.wait(timeout)
        return self.event.isSet()
+
+
+def is_standby_cluster(config):
+    """ Check whether or not provided configuration describes a standby cluster.
+        Config can be both patroni config or cluster.config.data
+    """
+    return isinstance(config, dict) and (
+        config.get('host') or
+        config.get('port') or
+        config.get('restore_command')
+    )
@@ -2,6 +2,7 @@ from __future__ import absolute_import
 import json
 import logging
 import os
+import re
 import socket
 import ssl
 import time
@@ -12,7 +13,7 @@ from patroni.dcs import AbstractDCS, ClusterConfig, Cluster, Failover, Leader, M
 from patroni.exceptions import DCSError
 from patroni.utils import deep_compare, parse_bool, Retry, RetryFailedError, split_host_port
 from urllib3.exceptions import HTTPError
-from six.moves.urllib.parse import urlencode, urlparse
+from six.moves.urllib.parse import urlencode, urlparse, quote
 from six.moves.http_client import HTTPException

 logger = logging.getLogger(__name__)
@@ -91,6 +92,8 @@ class HTTPClient(object):
                    data = '{' + ttl + '}'
                else:
                    data = data[:-1] + ', ' + ttl + '}'
+            if isinstance(params, list):  # starting from v1.1.0 python-consul switched from `dict` to `list` for params
+                params = {k: v for k, v in params}
            kwargs = {'retries': 0, 'preload_content': False, 'body': data}
            if method == 'get' and isinstance(params, dict) and 'index' in params:
                kwargs['timeout'] = (float(params['wait'][:-1]) if 'wait' in params else 300) + 1
@@ -131,6 +134,31 @@ def catch_consul_errors(func):
    return wrapper


+def force_if_last_failed(func):
+    def wrapper(*args, **kwargs):
+        if wrapper.last_result is False:
+            kwargs['force'] = True
+        wrapper.last_result = func(*args, **kwargs)
+        return wrapper.last_result
+
+    wrapper.last_result = None
+    return wrapper
+
+
+def service_name_from_scope_name(scope_name):
+    """Translate scope name to service name which can be used in dns.
+
+    230 = 253 - len('replica.') - len('.service.consul')
+    """
+
+    def replace_char(match):
+        c = match.group(0)
+        return '-' if c in '. _' else "u{:04d}".format(ord(c))
+
+    service_name = re.sub(r'[^a-z0-9\-]', replace_char, scope_name.lower())
+    return service_name[0:230]
+
+
 class Consul(AbstractDCS):

    def __init__(self, config):
@@ -142,7 +170,6 @@ class Consul(AbstractDCS):
                            retry_exceptions=(ConsulInternalError, HTTPException,
                                              HTTPError, socket.error, socket.timeout))

-        self._my_member_data = {}
        kwargs = {}
        if 'url' in config:
            r = urlparse(config['url'])
@@ -173,6 +200,13 @@ class Consul(AbstractDCS):
        self.set_ttl(config.get('ttl') or 30)
        self._last_session_refresh = 0
        self.__session_checks = config.get('checks')
+        self._register_service = config.get('register_service', False)
+        if self._register_service:
+            self._service_name = service_name_from_scope_name(self._scope)
+            if self._scope != self._service_name:
+                logger.warning('Using %s as consul service name instead of scope name %s', self._service_name,
+                               self._scope)
+        self._service_check_interval = config.get('service_check_interval', '5s')
        if not self._ctl:
            self.create_session()

@@ -316,18 +350,71 @@ class Consul(AbstractDCS):
            except Exception:
                return False

-        if not create_member and member and deep_compare(data, self._my_member_data):
+        if not create_member and member and deep_compare(data, member.data):
            return True

        try:
            args = {} if permanent else {'acquire': self._session}
            self._client.kv.put(self.member_path, json.dumps(data, separators=(',', ':')), **args)
-            self._my_member_data = data
+            if self._register_service:
+                self.update_service(not create_member and member and member.data or {}, data)
            return True
        except Exception:
            logger.exception('touch_member')
        return False

+    @catch_consul_errors
+    def register_service(self, service_name, **kwargs):
+        logger.info('Register service %s, params %s', service_name, kwargs)
+        return self._client.agent.service.register(service_name, **kwargs)
+
+    @catch_consul_errors
+    def deregister_service(self, service_id):
+        logger.info('Deregister service %s', service_id)
+        # service_id can contain special characters, but is used as part of uri in deregister request
+        service_id = quote(service_id)
+        return self._client.agent.service.deregister(service_id)
+
+    def _update_service(self, data):
+        service_name = self._service_name
+        role = data['role']
+        state = data['state']
+        api_parts = urlparse(data['api_url'])
+        api_parts = api_parts._replace(path='/{0}'.format(role))
+        conn_parts = urlparse(data['conn_url'])
+        check = base.Check.http(api_parts.geturl(), self._service_check_interval, deregister=self._client.http.ttl * 10)
+        params = {
+            'service_id': '{0}/{1}'.format(self._scope, self._name),
+            'address': conn_parts.hostname,
+            'port': conn_parts.port,
+            'check': check,
+            'tags': [role]
+        }
+
+        if state == 'stopped':
+            return self.deregister_service(params['service_id'])
+
+        if role in ['master', 'replica']:
+            if state != 'running':
+                return
+            return self.register_service(service_name, **params)
+
+        logger.warning('Could not register service: unknown role type %s', role)
+
+    @force_if_last_failed
+    def update_service(self, old_data, new_data, force=False):
+        update = False
+
+        for key in ['role', 'api_url', 'conn_url', 'state']:
+            if key not in new_data:
+                logger.warning('Could not register service: not enough params in member data')
+                return
+            if old_data.get(key) != new_data[key]:
+                update = True
+
+        if force or update:
+            return self._update_service(new_data)
+
    @catch_consul_errors
    def _do_attempt_to_acquire_leader(self, kwargs):
        return self.retry(self._client.kv.put, self.leader_path, self._name, **kwargs)
@@ -339,6 +426,7 @@ class Consul(AbstractDCS):
        ret = self._do_attempt_to_acquire_leader({} if permanent else {'acquire': self._session})
        if not ret:
            logger.info('Could not take out TTL lock')
+
        return ret

    def take_leader(self):
@@ -406,7 +494,7 @@ class Consul(AbstractDCS):
                    idx, _ = self._client.kv.get(self.leader_path, index=leader_index, wait=str(timeout) + 's')
                    return str(idx) != str(leader_index)
                except (ConsulException, HTTPException, HTTPError, socket.error, socket.timeout):
-                    logging.exception('watch')
+                    logger.exception('watch')

                timeout = end_time - time.time()

@@ -496,7 +496,7 @@ class Etcd(AbstractDCS):
    @catch_etcd_errors
    def touch_member(self, data, ttl=None, permanent=False):
        data = json.dumps(data, separators=(',', ':'))
-        return self.retry(self._client.set, self.member_path, data, None if permanent else ttl or self._ttl)
+        return self._client.set(self.member_path, data, None if permanent else ttl or self._ttl)

    @catch_etcd_errors
    def take_leader(self):
@@ -399,7 +399,7 @@ class Kubernetes(AbstractDCS):
                except KeyboardInterrupt:
                    raise
                except Exception:
-                    logging.exception('watch')
+                    logger.exception('watch')

                timeout = end_time - time.time()

@@ -59,7 +59,6 @@ class ZooKeeper(AbstractDCS):
                                   max_delay=1, max_tries=-1, sleep_func=time.sleep))
        self._client.add_listener(self.session_listener)

-        self._my_member_data = {}
        self._fetch_cluster = True

        self._orig_kazoo_connect = self._client._connection._connect
@@ -208,45 +207,52 @@ class ZooKeeper(AbstractDCS):
                self.cluster_watcher(None)
                raise ZooKeeperError('ZooKeeper in not responding properly')

-    def _create(self, path, value, **kwargs):
+    def _create(self, path, value, retry=False, ephemeral=False):
        try:
-            self._client.retry(self._client.create, path, value.encode('utf-8'), **kwargs)
+            if retry:
+                self._client.retry(self._client.create, path, value, makepath=True, ephemeral=ephemeral)
+            else:
+                self._client.create_async(path, value, makepath=True, ephemeral=ephemeral).get(timeout=1)
            return True
        except Exception:
-            return False
+            logger.exception('Failed to create %s', path)
+        return False

    def attempt_to_acquire_leader(self, permanent=False):
-        ret = self._create(self.leader_path, self._name, makepath=True, ephemeral=not permanent)
+        ret = self._create(self.leader_path, self._name.encode('utf-8'), retry=True, ephemeral=not permanent)
        if not ret:
            logger.info('Could not take out TTL lock')
        return ret

-    def __set_failover_or_sync_state_value(self, key, value, index=None):
+    def _set_or_create(self, key, value, index=None, retry=False, do_not_create_empty=False):
+        value = value.encode('utf-8')
        try:
-            self._client.retry(self._client.set, key, value.encode('utf-8'), version=index or -1)
+            if retry:
+                self._client.retry(self._client.set, key, value, version=index or -1)
+            else:
+                self._client.set_async(key, value, version=index or -1).get(timeout=1)
            return True
        except NoNodeError:
-            return value == '' or (index is None and self._create(key, value))
+            if do_not_create_empty and not value:
+                return True
+            elif index is None:
+                return self._create(key, value, retry)
+            else:
+                return False
        except Exception:
-            logging.exception('set_failover_value')
-            return False
+            logger.exception('Failed to update %s', key)
+        return False

    def set_failover_value(self, value, index=None):
-        return self.__set_failover_or_sync_state_value(self.failover_path, value, index)
+        return self._set_or_create(self.failover_path, value, index)

    def set_config_value(self, value, index=None):
-        try:
-            self._client.retry(self._client.set, self.config_path, value.encode('utf-8'), version=index or -1)
-            return True
-        except NoNodeError:
-            return index is None and self._create(self.config_path, value)
-        except Exception:
-            logging.exception('set_config_value')
-            return False
+        return self._set_or_create(self.config_path, value, index, retry=True)

    def initialize(self, create_new=True, sysid=""):
-        return self._create(self.initialize_path, sysid, makepath=True) if create_new \
-            else self._client.retry(self._client.set, self.initialize_path, sysid.encode("utf-8"))
+        sysid = sysid.encode('utf-8')
+        return self._create(self.initialize_path, sysid, retry=True) if create_new \
+            else self._client.retry(self._client.set, self.initialize_path, sysid)

    def touch_member(self, data, ttl=None, permanent=False):
        cluster = self.cluster
@@ -262,13 +268,12 @@ class ZooKeeper(AbstractDCS):
            member = None

        if member:
-            if deep_compare(data, self._my_member_data):
+            if deep_compare(data, member.data):
                return True
        else:
            try:
                self._client.create_async(self.member_path, encoded_data, makepath=True,
                                          ephemeral=not permanent).get(timeout=1)
-                self._my_member_data = data
                return True
            except Exception as e:
                if not isinstance(e, NodeExistsError):
@@ -276,7 +281,6 @@ class ZooKeeper(AbstractDCS):
                    return False
        try:
            self._client.set_async(self.member_path, encoded_data).get(timeout=1)
-            self._my_member_data = data
            return True
        except Exception:
            logger.exception('touch_member')
@@ -286,30 +290,14 @@ class ZooKeeper(AbstractDCS):
    def take_leader(self):
        return self.attempt_to_acquire_leader()

-    def __write_leader_optime_or_history_value(self, key, value):
-        value = value.encode('utf-8')
-        try:
-            self._client.set_async(key, value).get(timeout=1)
-            return True
-        except NoNodeError:
-            try:
-                self._client.create_async(key, value, makepath=True).get(timeout=1)
-                return True
-            except Exception:
-                logger.exception('Failed to create %s', key)
-        except Exception:
-            logger.exception('Failed to update %s', key)
-        return False
-
    def _write_leader_optime(self, last_operation):
-        return self.__write_leader_optime_or_history_value(self.leader_optime_path, last_operation)
+        return self._set_or_create(self.leader_optime_path, last_operation)

    def _update_leader(self):
        return True

    def delete_leader(self):
        self._client.restart()
-        self._my_member_data = None
        return True

    def _cancel_initialization(self):
@@ -330,10 +318,10 @@ class ZooKeeper(AbstractDCS):
            return True

    def set_history_value(self, value):
-        return self.__write_leader_optime_or_history_value(self.history_path, value)
+        return self._set_or_create(self.history_path, value)

    def set_sync_state_value(self, value, index=None):
-        return self.__set_failover_or_sync_state_value(self.sync_path, value, index)
+        return self._set_or_create(self.sync_path, value, index, retry=True, do_not_create_empty=True)

    def delete_sync_state(self, index=None):
        return self.set_sync_state_value("{}", index)
@@ -6,6 +6,7 @@ import psycopg2
 import requests
 import sys
 import time
+import uuid

 from collections import namedtuple
 from multiprocessing.pool import ThreadPool
@@ -13,6 +14,7 @@ from patroni.async_executor import AsyncExecutor, CriticalTask
 from patroni.exceptions import DCSError, PostgresConnectionException, PatroniException
 from patroni.postgresql import ACTION_ON_START
 from patroni.utils import polling_loop, tzutc
+from patroni.dcs import RemoteMember
 from threading import RLock

 logger = logging.getLogger(__name__)
@@ -57,6 +59,8 @@ class Ha(object):
        self.dcs = patroni.dcs
        self.cluster = None
        self.old_cluster = None
+        self._is_leader = False
+        self._is_leader_lock = RLock()
        self._was_paused = False
        self._leader_timeline = None
        self.recovering = False
@@ -87,6 +91,14 @@ class Ha(object):
    def is_paused(self):
        return self.check_mode('pause')

+    def is_leader(self):
+        with self._is_leader_lock:
+            return self._is_leader
+
+    def set_is_leader(self, value):
+        with self._is_leader_lock:
+            self._is_leader = value
+
    def load_cluster_from_dcs(self):
        cluster = self.dcs.get_cluster()

@@ -95,10 +107,15 @@ class Ha(object):
            self.old_cluster = cluster
        self.cluster = cluster

+        if self.cluster.is_unlocked() or self.cluster.leader.name != self.state_handler.name:
+            self.set_is_leader(False)
+
        self._leader_timeline = None if cluster.is_unlocked() else cluster.leader.timeline

    def acquire_lock(self):
-        return self.dcs.attempt_to_acquire_leader()
+        ret = self.dcs.attempt_to_acquire_leader()
+        self.set_is_leader(ret)
+        return ret

    def update_lock(self, write_leader_optime=False):
        last_operation = None
@@ -108,6 +125,7 @@ class Ha(object):
            except Exception:
                logger.exception('Exception when called state_handler.last_operation()')
        ret = self.dcs.update_leader(last_operation)
+        self.set_is_leader(ret)
        if ret:
            self.watchdog.keepalive()
        return ret
@@ -177,14 +195,24 @@ class Ha(object):
            self._async_executor.schedule('bootstrap {0}'.format(msg))
            self._async_executor.run_async(self.clone, args=(clone_member, msg))
            return 'trying to bootstrap {0}'.format(msg)
+
        # no initialize key and node is allowed to be master and has 'bootstrap' section in a configuration file
        elif self.cluster.initialize is None and not self.patroni.nofailover and 'bootstrap' in self.patroni.config:
            if self.dcs.initialize(create_new=True):  # race for initialization
                self.state_handler.bootstrapping = True
                self._post_bootstrap_task = CriticalTask()
-                self._async_executor.schedule('bootstrap')
-                self._async_executor.run_async(self.state_handler.bootstrap, args=(self.patroni.config['bootstrap'],))
-                return 'trying to bootstrap a new cluster'
+
+                if self.patroni.config.is_standby_cluster:
+                    self._async_executor.schedule('bootstrap_standby_leader')
+                    self._async_executor.run_async(self.bootstrap_standby_leader)
+                    return 'trying to bootstrap a new standby leader'
+                else:
+                    self._async_executor.schedule('bootstrap')
+                    self._async_executor.run_async(
+                        self.state_handler.bootstrap,
+                        args=(self.patroni.config['bootstrap'],)
+                    )
+                    return 'trying to bootstrap a new cluster'
            else:
                return 'failed to acquire initialize lock'
        else:
@@ -195,17 +223,27 @@ class Ha(object):
                return 'trying to ' + msg
            return 'waiting for leader to bootstrap'

+    def bootstrap_standby_leader(self):
+        """ If we found 'standby' key in the configuration, we need to bootstrap
+            not a real master, but a 'standby leader', that will take base backup
+            from a remote master and start follow it.
+        """
+        patroni_config = self.patroni.config.dynamic_configuration
+        clone_source = self.get_remote_master(patroni_config)
+        msg = 'clone from remote master {0}'.format(clone_source.conn_url)
+        result = self.clone(clone_source, msg)
+        self._post_bootstrap_task.complete(result)
+        if result:
+            self.state_handler.set_role('standby_leader')
+
+        return result
+
    def _handle_rewind(self):
        if self.state_handler.rewind_needed_and_possible(self.cluster.leader):
            self._async_executor.schedule('running pg_rewind from ' + self.cluster.leader.name)
            self._async_executor.run_async(self.state_handler.rewind, (self.cluster.leader,))
            return True

-    def _start_crash_recovery(self, msg):
-        self._async_executor.schedule(msg)
-        self._async_executor.run_async(self.state_handler.fix_cluster_state)
-        return msg
-
    def recover(self):
        # Postgres is not running and we will restart in standby mode. Watchdog is not needed until we promote.
        self.watchdog.disable()
@@ -226,10 +264,12 @@ class Ha(object):
            timeout = None

        data = self.state_handler.controldata()
-        if data.get('Database cluster state') == 'in production' and not self._crash_recovery_executed and \
-                (self.cluster.is_unlocked() or self.state_handler.can_rewind):
+        if data.get('Database cluster state') in ('in production', 'shutting down', 'in crash recovery') and \
+                not self._crash_recovery_executed and (self.cluster.is_unlocked() or self.state_handler.can_rewind):
            self._crash_recovery_executed = True
-            return self._start_crash_recovery('doing crash recovery in a single user mode')
+            self._async_executor.schedule('doing crash recovery in a single user mode')
+            self._async_executor.run_async(self.state_handler.fix_cluster_state)
+            return self._async_executor.scheduled_action

        self.load_cluster_from_dcs()

@@ -244,13 +284,6 @@ class Ha(object):
            msg = "starting as a secondary"
            node_to_follow = self._get_node_to_follow(self.cluster)

-        # once we already tried to start postgres but failed, single user mode is a rescue in this case
-        if self.recovering and not self.state_handler.rewind_executed \
-                and not self._crash_recovery_executed and self.state_handler.can_rewind \
-                and data.get('Database cluster state') not in ('shut down', 'shut down in recovery'):
-            self.recovering = False
-            return self._start_crash_recovery('fixing cluster state in a single user mode')
-
        self.recovering = True

        self._async_executor.schedule('restarting after failure')
@@ -260,12 +293,18 @@ class Ha(object):
    def _get_node_to_follow(self, cluster):
        # determine the node to follow. If replicatefrom tag is set,
        # try to follow the node mentioned there, otherwise, follow the leader.
-        if not self.patroni.replicatefrom or self.patroni.replicatefrom == self.state_handler.name:
-            node_to_follow = cluster.leader
-        else:
-            node_to_follow = cluster.get_member(self.patroni.replicatefrom)
+        is_leader = self.cluster.leader and self.state_handler.name == self.cluster.leader.name

-        return node_to_follow if node_to_follow and node_to_follow.name != self.state_handler.name else None
+        if self.cluster.is_standby_cluster() and is_leader:
+            node_to_follow = self.get_remote_master(cluster.config.data)
+        elif self.patroni.replicatefrom and self.patroni.replicatefrom != self.state_handler.name:
+            node_to_follow = cluster.get_member(self.patroni.replicatefrom)
+        else:
+            node_to_follow = cluster.leader
+
+        return (node_to_follow if
+                node_to_follow and
+                node_to_follow.name != self.state_handler.name else None)

    def follow(self, demote_reason, follow_reason, refresh=True):
        if refresh:
@@ -405,6 +444,12 @@ class Ha(object):
                        line.append(cluster_history[line[0]][3])
                self.dcs.set_history_value(json.dumps(history, separators=(',', ':')))

+    def enforce_follow_remote_master(self, message):
+        self.state_handler.set_role('standby_leader')
+        demote_reason = 'cannot be a real master in standby cluster'
+
+        return self.follow(demote_reason, message)
+
    def enforce_master_role(self, message, promote_message):
        if not self.is_paused() and not self.watchdog.is_running and not self.watchdog.activate():
            if self.state_handler.is_leader():
@@ -449,7 +494,7 @@ class Ha(object):
            logger.info('Got response from %s %s: %s', member.name, member.api_url, response.content)
            return _MemberStatus.from_api_response(member, response.json())
        except Exception as e:
-            logger.warning("request failed: GET %s (%s)", member.api_url, e)
+            logger.warning("Request failed to %s: GET %s (%s)", member.name, member.api_url, e)
        return _MemberStatus.unknown(member)

    def fetch_nodes_statuses(self, members):
@@ -607,16 +652,17 @@ class Ha(object):
                PostgreSQL as quickly as possible without regard for data durability. May only be called synchronously.
        """
        mode_control = {
-            'offline':          dict(stop='fast', checkpoint=False, release=False, offline=True, async=False),
-            'graceful':         dict(stop='fast', checkpoint=True, release=True, offline=False, async=False),
-            'immediate':        dict(stop='immediate', checkpoint=False, release=True, offline=False, async=True),
-            'immediate-nolock': dict(stop='immediate', checkpoint=False, release=False, offline=False, async=True),
+            'offline':          dict(stop='fast', checkpoint=False, release=False, offline=True, async_req=False),
+            'graceful':         dict(stop='fast', checkpoint=True, release=True, offline=False, async_req=False),
+            'immediate':        dict(stop='immediate', checkpoint=False, release=True, offline=False, async_req=True),
+            'immediate-nolock': dict(stop='immediate', checkpoint=False, release=False, offline=False, async_req=True),
        }[mode]

        self.state_handler.trigger_check_diverged_lsn()
        self.state_handler.stop(mode_control['stop'], checkpoint=mode_control['checkpoint'],
                                on_safepoint=self.watchdog.disable if self.watchdog.is_running else None)
        self.state_handler.set_role('demoted')
+        self.set_is_leader(False)

        if mode_control['release']:
            self.release_leader_key_voluntarily()
@@ -630,7 +676,7 @@ class Ha(object):
        # FIXME: with mode offline called from DCS exception handler and handle_long_action_in_progress
        # there could be an async action already running, calling follow from here will lead
        # to racy state handler state updates.
-        if mode_control['async']:
+        if mode_control['async_req']:
            self._async_executor.schedule('starting after demotion')
            self._async_executor.run_async(self.state_handler.follow, (node_to_follow,))
        else:
@@ -733,8 +779,18 @@ class Ha(object):
                        logger.info('Cleaning up failover key after acquiring leader lock...')
                        self.dcs.manual_failover('', '')
                self.load_cluster_from_dcs()
-                return self.enforce_master_role('acquired session lock as a leader',
-                                                'promoted self to leader by acquiring session lock')
+
+                if self.cluster.is_standby_cluster():
+                    # standby leader disappeared, and this is a healthiest
+                    # replica, so it should become a new standby leader.
+                    # This imply that we need to start following a remote master
+                    msg = 'promoted self to a standby leader because i had the session lock'
+                    return self.enforce_follow_remote_master(msg)
+                else:
+                    return self.enforce_master_role(
+                        'acquired session lock as a leader',
+                        'promoted self to leader by acquiring session lock'
+                    )
            else:
                return self.follow('demoted self after trying and failing to obtain lock',
                                   'following new leader after trying and failing to obtain lock')
@@ -766,8 +822,17 @@ class Ha(object):
                if msg is not None:
                    return msg

-                return self.enforce_master_role('no action.  i am the leader with the lock',
-                                                'promoted self to leader because i had the session lock')
+                if self.cluster.is_standby_cluster():
+                    # in case of standby cluster we don't really need to
+                    # enforce anything, since the leader is not a master.
+                    # So just remind the role.
+                    msg = 'no action.  i am the standby leader with the lock'
+                    return self.enforce_follow_remote_master(msg)
+                else:
+                    return self.enforce_master_role(
+                        'no action.  i am the leader with the lock',
+                        'promoted self to leader because i had the session lock'
+                    )
            else:
                # Either there is no connection to DCS or someone else acquired the lock
                logger.error('failed to update leader lock')
@@ -991,8 +1056,10 @@ class Ha(object):
            logger.error('Cancelling bootstrap because watchdog activation failed')
            self.cancel_initialization()
        self.dcs.take_leader()
+        self.set_is_leader(True)
        self.state_handler.call_nowait(ACTION_ON_START)
        self.load_cluster_from_dcs()
+
        return 'initialized a new cluster'

    def handle_starting_instance(self):
@@ -1123,8 +1190,13 @@ class Ha(object):
                        self.dcs.delete_leader()
                        self.dcs.reset_cluster()
                        return 'removed leader lock because postgres is not running'
-                    elif not (self.state_handler.rewind_executed or
-                              self.state_handler.need_rewind and self.state_handler.can_rewind):
+                    # Normally we don't start Postgres in a paused state. We make an exception for the demoted primary
+                    # that needs to be started after it had been stopped by demote. When there is no need to call rewind
+                    # the demote code follows through to starting Postgres right away, however, in the rewind case
+                    # it returns from demote and reaches this point to start PostgreSQL again after rewind. In that
+                    # case it makes no sense to continue to recover() unless rewind has finished successfully.
+                    elif (self.state_handler.rewind_failed or
+                          not (self.state_handler.need_rewind and self.state_handler.can_rewind)):
                        return 'postgres is not running'

                # try to start dead postgres
@@ -1178,6 +1250,7 @@ class Ha(object):
            if not self.state_handler.is_running():
                if self.has_lock():
                    self.dcs.delete_leader()
+                self.touch_member()
            else:
                # XXX: what about when Patroni is started as the wrong user that has access to the watchdog device
                # but cannot shut down PostgreSQL. Root would be the obvious example. Would be nice to not kill the
@@ -1201,3 +1274,27 @@ class Ha(object):
        no "active" leader watch request in progress.
        This usually happens on the master or if the node is running async action"""
        self.dcs.event.set()
+
+    def get_remote_master(self, config):
+        """ In case of standby cluster this will tel us from which remote
+            master to stream. Config can be both patroni config or
+            cluster.config.data
+        """
+        config = config or (self.config is not None and self.config.data)
+
+        if config and config.get('standby_cluster'):
+            cluster_params = config.get('standby_cluster')
+            unique_name = 'remote_master:{}'.format(uuid.uuid1())
+            data = {
+                'conn_kwargs': {
+                    "host": cluster_params.get('host'),
+                    "port": cluster_params.get('port'),
+                },
+                'no_replication_slot': 'primary_slot_name' not in cluster_params,
+            }
+            data.update({
+                k: v for k, v in cluster_params.items()
+                if k in RemoteMember.allowed_keys()
+            })
+
+            return RemoteMember(unique_name, data)
@@ -15,11 +15,13 @@ from patroni.callback_executor import CallbackExecutor
 from patroni.exceptions import PostgresConnectionException, PostgresException
 from patroni.utils import compare_values, parse_bool, parse_int, Retry, RetryFailedError, polling_loop, split_host_port
 from patroni.postmaster import PostmasterProcess
+from patroni.dcs import RemoteMember
 from requests.structures import CaseInsensitiveDict
 from six import string_types
 from six.moves.urllib.parse import quote_plus
 from threading import current_thread, Lock

+
 logger = logging.getLogger(__name__)

 ACTION_ON_START = "on_start"
@@ -179,6 +181,13 @@ class Postgresql(object):
            self._write_postgresql_conf()  # we are "joining" already running postgres
            if self._replace_pg_hba():
                self.reload()
+        elif self.role == 'master':
+            self.set_role('demoted')
+
+    @property
+    def _create_replica_methods(self):
+        return (self.config.get('create_replica_methods', []) or
+                self.config.get('create_replica_method', []))

    @property
    def _configuration_to_save(self):
@@ -330,10 +339,12 @@ class Postgresql(object):
                        if new_value is None or not compare_values(r[3], unit, r[1], new_value):
                            if r[4] == 'postmaster':
                                pending_restart = True
+                                logger.info('Changed %s from %s to %s (restart required)', r[0], r[1], new_value)
                                if config.get('use_unix_socket') and r[0] == 'unix_socket_directories'\
                                        or r[0] in ('listen_addresses', 'port'):
                                    local_connection_address_changed = True
                            else:
+                                logger.info('Changed %s from %s to %s', r[0], r[1], new_value)
                                conf_changed = True
                for param in changes:
                    if param in server_parameters:
@@ -344,11 +355,13 @@ class Postgresql(object):
            if not conf_changed:
                for p, v in server_parameters.items():
                    if '.' in p and (p not in self._server_parameters or str(v) != str(self._server_parameters[p])):
+                        logger.info('Changed %s from %s to %s', p, self._server_parameters.get(p), v)
                        conf_changed = True
                        break
                if not conf_changed:
                    for p, v in self._server_parameters.items():
                        if '.' in p and (p not in server_parameters or str(v) != str(server_parameters[p])):
+                            logger.info('Changed %s from %s to %s', p, v, server_parameters.get(p))
                            conf_changed = True
                            break

@@ -370,7 +383,10 @@ class Postgresql(object):
            self._replace_pg_hba()

        if conf_changed or hba_changed:
+            logger.info('PostgreSQL configuration items changed, reloading configuration.')
            self.reload()
+        elif not pending_restart:
+            logger.info('No PostgreSQL configuration items changed, nothing to reload.')

        self._is_leader_retry.deadline = self.retry.deadline = config['retry_timeout']/2.0

@@ -403,7 +419,7 @@ class Postgresql(object):

    @property
    def sysid(self):
-        if not self._sysid:
+        if not self._sysid and not self.bootstrapping:
            data = self.controldata()
            self._sysid = data.get('Database system identifier', "")
        return self._sysid
@@ -638,7 +654,7 @@ class Postgresql(object):
        """ go through the replication methods to see if there are ones
            that does not require a working replication connection.
        """
-        replica_methods = self.config.get('create_replica_method', [])
+        replica_methods = self._create_replica_methods
        return any(self.replica_method_can_work_without_replication_connection(method) for method in replica_methods)

    def create_replica(self, clone_member):
@@ -651,9 +667,17 @@ class Postgresql(object):
        self.set_state('creating replica')
        self._sysid = None

-        # get list of replica methods from config.
-        # If there is no configuration key, or no value is specified, use basebackup
-        replica_methods = self.config.get('create_replica_method') or ['basebackup']
+        is_remote_master = isinstance(clone_member, RemoteMember)
+        create_replica_methods = is_remote_master and clone_member.create_replica_methods
+
+        # get list of replica methods either from clone member or from
+        # the config. If there is no configuration key, or no value is
+        # specified, use basebackup
+        replica_methods = (
+            create_replica_methods
+            or self._create_replica_methods
+            or ['basebackup']
+        )

        if clone_member and clone_member.conn_url:
            r = clone_member.conn_kwargs(self._replication)
@@ -818,6 +842,36 @@ class Postgresql(object):
        logger.warning("Timed out waiting for PostgreSQL to start")
        return False

+    def _build_effective_configuration(self):
+        """It might happen that the current value of one (or more) below parameters stored in
+        the controldata is higher than the value stored in the global cluster configuration.
+
+        Example: max_connections in global configuration is 100, but in controldata
+        `Current max_connections setting: 200`. If we try to start postgres with
+        max_connections=100, it will immediately exit.
+        As a workaround we will start it with the values from controldata and set `pending_restart`
+        to true as an indicator that current values of parameters are not matching expectations."""
+
+        OPTIONS_MAPPING = {
+            'max_connections': 'max_connections setting',
+            'max_prepared_transactions': 'max_prepared_xacts setting',
+            'max_locks_per_transaction': 'max_locks_per_xact setting'
+        }
+
+        if self._major_version >= 90400:
+            OPTIONS_MAPPING['max_worker_processes'] = 'max_worker_processes setting'
+
+        data = self.controldata()
+        effective_configuration = self._server_parameters.copy()
+
+        for name, cname in OPTIONS_MAPPING.items():
+            value = parse_int(effective_configuration[name])
+            cvalue = parse_int(data[cname])
+            if cvalue > value:
+                effective_configuration[name] = cvalue
+                self._pending_restart = True
+        return effective_configuration
+
    def start(self, timeout=None, block_callbacks=False, task=None):
        """Start PostgreSQL

@@ -843,12 +897,13 @@ class Postgresql(object):
        self.set_state('starting')
        self._pending_restart = False

-        self._write_postgresql_conf()
+        configuration = self._server_parameters if self.role == 'master' else self._build_effective_configuration()
+        self._write_postgresql_conf(configuration)
        self.resolve_connection_addresses()
        self._replace_pg_hba()

-        options = ['--{0}={1}'.format(p, self._server_parameters[p]) for p in self.CMDLINE_OPTIONS
-                   if p in self._server_parameters and p != 'wal_keep_segments']
+        options = ['--{0}={1}'.format(p, configuration[p]) for p in self.CMDLINE_OPTIONS
+                   if p in configuration and p != 'wal_keep_segments']

        with self._cancellable_lock:
            if self._is_cancelled:
@@ -900,7 +955,7 @@ class Postgresql(object):
                        return 'is_in_recovery=true'
                return cur.execute('CHECKPOINT')
        except psycopg2.Error:
-            logging.exception('Exception during CHECKPOINT')
+            logger.exception('Exception during CHECKPOINT')
            return 'not accessible or not healty'

    def stop(self, mode='fast', block_callbacks=False, checkpoint=None, on_safepoint=None):
@@ -1053,7 +1108,7 @@ class Postgresql(object):
            self.set_state('restart failed ({0})'.format(self.state))
        return ret

-    def _write_postgresql_conf(self):
+    def _write_postgresql_conf(self, configuration=None):
        # rename the original configuration if it is necessary
        if 'custom_conf' not in self.config and not os.path.exists(self._postgresql_base_conf):
            os.rename(self._postgresql_conf, self._postgresql_base_conf)
@@ -1061,7 +1116,7 @@ class Postgresql(object):
        with open(self._postgresql_conf, 'w') as f:
            f.write(self._CONFIG_WARNING_HEADER)
            f.write("include '{0}'\n\n".format(self.config.get('custom_conf') or self._postgresql_base_conf_name))
-            for name, value in sorted(self._server_parameters.items()):
+            for name, value in sorted((configuration or self._server_parameters).items()):
                if not self._running_custom_bootstrap or name != 'hba_file':
                    f.write("{0} = '{1}'\n".format(name, value))
            # when we are doing custom bootstrap we assume that we don't know superuser password
@@ -1164,14 +1219,15 @@ class Postgresql(object):
        """ return the contents of pg_controldata, or non-True value if pg_controldata call failed """
        result = {}
        # Don't try to call pg_controldata during backup restore
-        if not self.bootstrapping and self._version_file_exists() and self.state != 'creating replica':
+        if self._version_file_exists() and self.state != 'creating replica':
            try:
                data = subprocess.check_output([self._pgcommand('pg_controldata'), self._data_dir],
                                               env={'LANG': 'C', 'LC_ALL': 'C', 'PATH': os.environ['PATH']})
                if data:
                    data = data.decode('utf-8').splitlines()
                    # pg_controldata output depends on major verion. Some of parameters are prefixed by 'Current '
-                    result = {l.split(':')[0].replace('Current ', '', 1): l.split(':', 1)[1].strip() for l in data if l}
+                    result = {l.split(':')[0].replace('Current ', '', 1): l.split(':', 1)[1].strip() for l in data
+                              if l and ':' in l}
            except subprocess.CalledProcessError:
                logger.exception("Error when calling pg_controldata")
        return result
@@ -1362,7 +1418,17 @@ class Postgresql(object):
    def rewind_executed(self):
        return self._rewind_state > REWIND_STATUS.NOT_NEED

+    @property
+    def rewind_failed(self):
+        return self._rewind_state == REWIND_STATUS.FAILED
+
    def follow(self, member, timeout=None):
+        is_remote_master = isinstance(member, RemoteMember)
+        no_replication_slot = is_remote_master and member.no_replication_slot
+        restore_command = is_remote_master and member.restore_command
+        min_apply_delay = is_remote_master and member.recovery_min_apply_delay
+        archive_cleanup = is_remote_master and member.archive_cleanup_command
+
        primary_conninfo = self.primary_conninfo(member)
        change_role = self.role in ('master', 'demoted')

@@ -1370,8 +1436,16 @@ class Postgresql(object):
        recovery_params.update({'standby_mode': 'on', 'recovery_target_timeline': 'latest'})
        if primary_conninfo:
            recovery_params['primary_conninfo'] = primary_conninfo
-        if self.use_slots:
-            recovery_params['primary_slot_name'] = slot_name_from_member_name(self.name)
+        if self.use_slots and not no_replication_slot:
+            required_name = is_remote_master and member.data.get('primary_slot_name')
+            name = required_name or slot_name_from_member_name(self.name)
+            recovery_params['primary_slot_name'] = name
+        if restore_command:
+            recovery_params['restore_command'] = restore_command
+        if min_apply_delay:
+            recovery_params['recovery_min_apply_delay'] = min_apply_delay
+        if archive_cleanup:
+            recovery_params['archive_cleanup_command'] = archive_cleanup

        self.write_recovery_conf(recovery_params)

@@ -1483,7 +1557,7 @@ $$""".format(name, ' '.join(options)), name, password, password)
                # the current master, because that member would replicate from elsewhere. We still create the slot if
                # the replicatefrom destination member is currently not a member of the cluster (fallback to the
                # master), or if replicatefrom destination member happens to be the current master
-                if self.role == 'master':
+                if self.role in ('master', 'standby_leader'):
                    slot_members = [m.name for m in cluster.members if m.name != self.name and
                                    (m.replicatefrom is None or m.replicatefrom == self.name or
                                     not cluster.has_member(m.replicatefrom))]
@@ -1511,11 +1585,13 @@ $$""".format(name, ' '.join(options)), name, password, password)
                    if cursor.rowcount != 1:  # Either slot doesn't exists or it is still active
                        self._schedule_load_slots = True  # schedule load_replication_slots on the next iteration

+                immediately_reserve = ', true' if self._major_version >= 90600 else ''
+
                # create new slots
                for slot in slots - set(self._replication_slots):
-                    self._query("""SELECT pg_create_physical_replication_slot(%s)
+                    self._query("""SELECT pg_create_physical_replication_slot(%s{0})
                                    WHERE NOT EXISTS (SELECT 1 FROM pg_replication_slots
-                                    WHERE slot_name = %s)""", slot, slot)
+                                    WHERE slot_name = %s)""".format(immediately_reserve), slot, slot)

                self._replication_slots = slots
            except Exception:
@@ -1587,9 +1663,12 @@ $$""".format(name, ' '.join(options)), name, password, password)
                        self.restart()
                    else:
                        self._replace_pg_hba()
-                        self.reload()
-                        time.sleep(1)  # give a time to postgres to "reload" configuration files
-                        self.close_connection()  # close connection to reconnect with a new password
+                        if self.pending_restart:
+                            self.restart()
+                        else:
+                            self.reload()
+                            time.sleep(1)  # give a time to postgres to "reload" configuration files
+                            self.close_connection()  # close connection to reconnect with a new password
        except Exception:
            logger.exception('post_bootstrap')
            task.complete(False)
@@ -1622,7 +1701,7 @@ $$""".format(name, ' '.join(options)), name, password, password)

    def basebackup(self, conn_url, env, options):
        # creates a replica data dir using pg_basebackup.
-        # this is the default, built-in create_replica_method
+        # this is the default, built-in create_replica_methods
        # tries twice, then returns failure (as 1)
        # uses "stream" as the xlog-method to avoid sync issues
        # supports additional user-supplied options, those are not validated
@@ -1681,7 +1760,7 @@ $$""".format(name, ' '.join(options)), name, password, password)
            if sync_state == 'potential' and app_name == current:
                # Prefer current even if not the best one any more to avoid indecisivness and spurious swaps.
                return current, False
-            if sync_state == 'async':
+            if sync_state in ('async', 'potential'):
                candidates.append(app_name)

        if candidates:
@@ -42,7 +42,8 @@ class PostmasterProcess(psutil.Process):
        try:
            start_time = int(self._postmaster_pid.get('start_time', 0))
            if start_time and abs(self.create_time() - start_time) > 3:
-                logger.info('Too much difference between %s and %s', self.create_time(), start_time)
+                logger.info('Process %s is not postmaster, too much difference between PID file start time %s and '
+                            'process start time %s', self.pid, self.create_time(), start_time)
                return False
        except ValueError:
            logger.warning('Garbage start time value in pid file: %r', self._postmaster_pid.get('start_time'))
@@ -137,7 +138,7 @@ class PostmasterProcess(psutil.Process):
        # of init process to take care about postmaster.
        # In order to make everything portable we can't use fork&exec approach here, so  we will call
        # ourselves and pass list of arguments which must be used to start postgres.
-        env = {p: os.environ[p] for p in ('PATH', 'LC_ALL', 'LANG') if p in os.environ}
+        env = {p: os.environ[p] for p in ('PATH', 'LD_LIBRARY_PATH', 'LC_ALL', 'LANG') if p in os.environ}
        try:
            proc = PostmasterProcess._from_pidfile(data_dir)
            if proc and not proc._is_postmaster_process():
@@ -148,6 +149,7 @@ class PostmasterProcess(psutil.Process):
                # Important!!! Unlink of postmaster.pid isn't an option, because it has a lot of nasty race conditions.
                # Luckily there is a workaround to this problem, we can pass the pid from postmaster.pid
                # in the `PG_GRANDPARENT_PID` environment variable and postmaster will ignore it.
+                logger.info("Telling pg_ctl that it is safe to ignore postmaster.pid for process %s", proc.pid)
                env['PG_GRANDPARENT_PID'] = str(proc.pid)
        except psutil.NoSuchProcess:
            pass
@@ -1 +1 @@
-__version__ = '1.4.4'
+__version__ = '1.4.6'
@@ -11,6 +11,11 @@ restapi:
 #    username: username
 #    password: password

+# ctl:
+#   insecure: false # Allow connections to SSL sites without certs
+#   certfile: /etc/ssl/certs/ssl-cert-snakeoil.pem
+#   cacert: /etc/ssl/certs/ssl-cacert-snakeoil.pem
+
 etcd:
  host: 127.0.0.1:2379

@@ -24,6 +29,10 @@ bootstrap:
    maximum_lag_on_failover: 1048576
 #    master_start_timeout: 300
 #    synchronous_mode: false
+    #standby_cluster:
+      #host: 127.0.0.1
+      #port: 1111
+      #primary_slot_name: patroni
    postgresql:
      use_pg_rewind: true
 #      use_slots: true
@@ -31,8 +40,8 @@ bootstrap:
 #        wal_level: hot_standby
 #        hot_standby: "on"
 #        wal_keep_segments: 8
-#        max_wal_senders: 5
-#        max_replication_slots: 5
+#        max_wal_senders: 10
+#        max_replication_slots: 10
 #        wal_log_hints: "on"
 #        archive_mode: "on"
 #        archive_timeout: 1800s
@@ -11,6 +11,11 @@ restapi:
 #    username: username
 #    password: password

+# ctl:
+#   insecure: false # Allow connections to SSL sites without certs
+#   certfile: /etc/ssl/certs/ssl-cert-snakeoil.pem
+#   cacert: /etc/ssl/certs/ssl-cacert-snakeoil.pem
+
 etcd:
  host: 127.0.0.1:2379

@@ -29,8 +34,8 @@ bootstrap:
 #        wal_level: hot_standby
 #        hot_standby: "on"
 #        wal_keep_segments: 8
-#        max_wal_senders: 5
-#        max_replication_slots: 5
+#        max_wal_senders: 10
+#        max_replication_slots: 10
 #        wal_log_hints: "on"
 #        archive_mode: "on"
 #        archive_timeout: 1800s
@@ -11,6 +11,11 @@ restapi:
    username: username
    password: password

+# ctl:
+#   insecure: false # Allow connections to SSL sites without certs
+#   certfile: /etc/ssl/certs/ssl-cert-snakeoil.pem
+#   cacert: /etc/ssl/certs/ssl-cacert-snakeoil.pem
+
 etcd:
  host: 127.0.0.1:2379

@@ -29,8 +34,8 @@ bootstrap:
 #        wal_level: hot_standby
 #        hot_standby: "on"
 #        wal_keep_segments: 8
-#        max_wal_senders: 5
-#        max_replication_slots: 5
+#        max_wal_senders: 10
+#        max_replication_slots: 10
 #        wal_log_hints: "on"
 #        archive_mode: "on"
 #        archive_timeout: 1800s
@@ -13,4 +13,4 @@ tzlocal
 python-dateutil
 psutil
 cdiff
-kubernetes==3.0.0
+kubernetes>=2.0.0,<=7.0.0,!=4.0.*,!=5.0.*
@@ -32,9 +32,10 @@ VERSION = read_version(MAIN_PACKAGE)
 DESCRIPTION = 'PostgreSQL High-Available orchestrator and CLI'
 LICENSE = 'The MIT License'
 URL = 'https://github.com/zalando/patroni'
-AUTHOR = 'Alexander Kukushkin, Oleksii Kliukin, Feike Steenbergen'
-AUTHOR_EMAIL = '[email protected], [email protected], [email protected]'
-KEYWORDS = 'etcd governor patroni postgresql postgres ha haproxy confd zookeeper exhibitor consul streaming replication'
+AUTHOR = 'Alexander Kukushkin, Dmitrii Dolgov, Oleksii Kliukin'
+AUTHOR_EMAIL = '[email protected], [email protected], [email protected]'
+KEYWORDS = 'etcd governor patroni postgresql postgres ha haproxy confd' +\
+    ' zookeeper exhibitor consul streaming replication kubernetes k8s'

 COVERAGE_XML = True
 COVERAGE_HTML = False
@@ -43,16 +44,21 @@ JUNIT_XML = True
 # Add here all kinds of additional classifiers as defined under
 # https://pypi.python.org/pypi?%3Aaction=list_classifiers
 CLASSIFIERS = [
-    'Development Status :: 4 - Beta',
+    'Development Status :: 5 - Production/Stable',
    'Environment :: Console',
    'Intended Audience :: Developers',
    'Intended Audience :: System Administrators',
    'License :: OSI Approved :: MIT License',
+    'Operating System :: MacOS',
    'Operating System :: POSIX :: Linux',
+    'Operating System :: POSIX :: BSD :: FreeBSD',
    'Programming Language :: Python',
    'Programming Language :: Python :: 2.7',
+    'Programming Language :: Python :: 3',
    'Programming Language :: Python :: 3.4',
    'Programming Language :: Python :: 3.5',
+    'Programming Language :: Python :: 3.6',
+    'Programming Language :: Python :: 3.7',
    'Programming Language :: Python :: Implementation :: CPython',
 ]

@@ -51,6 +51,10 @@ class MockHa(object):
    state_handler = MockPostgresql()
    watchdog = MockWatchdog()

+    @staticmethod
+    def is_leader():
+        return False
+
    @staticmethod
    def reinitialize(_):
        return 'reinitialize'
@@ -123,16 +127,14 @@ class MockRequest(object):

 class MockRestApiServer(RestApiServer):

-    def __init__(self, Handler, request):
+    def __init__(self, Handler, request, config=None):
        self.socket = 0
        self.serve_forever = Mock()
        BaseHTTPServer.HTTPServer.__init__ = Mock()
        MockRestApiServer._BaseServer__is_shut_down = Mock()
        MockRestApiServer._BaseServer__shutdown_request = True
-        config = {'listen': '127.0.0.1:8008', 'auth': 'test:test'}
+        config = config or {'listen': '127.0.0.1:8008', 'auth': 'test:test', 'certfile': 'dumb'}
        super(MockRestApiServer, self).__init__(MockPatroni(), config)
-        config['certfile'] = 'dumb'
-        self.reload_config(config)
        Handler(MockRequest(request), ('0.0.0.0', 8080), self)


@@ -153,8 +155,9 @@ class TestRestApiHandler(unittest.TestCase):
        with patch.object(RestApiHandler, 'get_postgresql_status', Mock(return_value={'role': 'replica'})):
            MockRestApiServer(RestApiHandler, 'GET /synchronous')
        with patch.object(RestApiHandler, 'get_postgresql_status', Mock(return_value={'role': 'replica'})):
+            MockPatroni.dcs.cluster.sync.sync_standby = ''
            MockRestApiServer(RestApiHandler, 'GET /asynchronous')
-        MockPatroni.dcs.cluster.leader.name = MockPostgresql.name
+        MockPatroni.ha.is_leader = Mock(return_value=True)
        MockRestApiServer(RestApiHandler, 'GET /replica')
        MockPatroni.dcs.cluster = None
        with patch.object(RestApiHandler, 'get_postgresql_status', Mock(return_value={'role': 'master'})):
@@ -380,3 +383,15 @@ class TestRestApiHandler(unittest.TestCase):
        post = 'POST /failover HTTP/1.0' + self._authorization + '\nContent-Length: '
        MockRestApiServer(RestApiHandler, post + '14\n\n{"leader":"1"}')
        MockRestApiServer(RestApiHandler, post + '37\n\n{"candidate":"2","scheduled_at": "1"}')
+
+
+@patch('ssl.wrap_socket', Mock(return_value=0))
+class TestRestApiServer(unittest.TestCase):
+
+    def test_reload_config(self):
+        bad_config = {'listen': 'foo'}
+        self.assertRaises(ValueError, MockRestApiServer, None, '', bad_config)
+        srv = MockRestApiServer(lambda a1, a2, a3: None, '')
+        self.assertRaises(ValueError, srv.reload_config, bad_config)
+        self.assertRaises(ValueError, srv.reload_config, {})
+        srv.reload_config({'listen': '127.0.0.2:8008'})
@@ -23,7 +23,7 @@ class TestConfig(unittest.TestCase):
    def test_set_dynamic_configuration(self):
        with patch.object(Config, '_build_effective_configuration', Mock(side_effect=Exception)):
            self.assertIsNone(self.config.set_dynamic_configuration({'foo': 'bar'}))
-        self.assertTrue(self.config.set_dynamic_configuration({'synchronous_mode': True}))
+        self.assertTrue(self.config.set_dynamic_configuration({'synchronous_mode': True, 'standby_cluster': {}}))

    def test_reload_local_configuration(self):
        os.environ.update({
@@ -70,6 +70,7 @@ class TestConfig(unittest.TestCase):
                self.assertRaises(Exception, config.reload_local_configuration, True)
            self.assertTrue(config.reload_local_configuration(True))
            self.assertTrue(config.reload_local_configuration())
+            self.assertIsNone(config.reload_local_configuration())

    @patch('tempfile.mkstemp', Mock(return_value=[3000, 'blabla']))
    @patch('os.path.exists', Mock(return_value=True))
@@ -62,7 +62,7 @@ class TestHTTPClient(unittest.TestCase):

    def test_put(self):
        self.client.put(Mock(), '/v1/session/create')
-        self.client.put(Mock(), '/v1/session/create', data='{"foo": "bar"}')
+        self.client.put(Mock(), '/v1/session/create', params=[], data='{"foo": "bar"}')


@patch.object(consul.Consul.KV, 'get', kv_get)
@@ -74,10 +74,12 @@ class TestConsul(unittest.TestCase):
    @patch.object(consul.Consul.KV, 'delete', Mock())
    def setUp(self):
        Consul({'ttl': 30, 'scope': 't', 'name': 'p', 'url': 'https://l:1', 'retry_timeout': 10,
-                'verify': 'on', 'key': 'foo', 'cert': 'bar', 'cacert': 'buz', 'token': 'asd', 'dc': 'dc1'})
-        Consul({'ttl': 30, 'scope': 't', 'name': 'p', 'url': 'https://l:1', 'retry_timeout': 10,
-                'verify': 'on', 'cert': 'bar', 'cacert': 'buz'})
-        self.c = Consul({'ttl': 30, 'scope': 'test', 'name': 'postgresql1', 'host': 'localhost:1', 'retry_timeout': 10})
+                'verify': 'on', 'key': 'foo', 'cert': 'bar', 'cacert': 'buz', 'token': 'asd', 'dc': 'dc1',
+                'register_service': True})
+        Consul({'ttl': 30, 'scope': 't_', 'name': 'p', 'url': 'https://l:1', 'retry_timeout': 10,
+                'verify': 'on', 'cert': 'bar', 'cacert': 'buz', 'register_service': True})
+        self.c = Consul({'ttl': 30, 'scope': 'test', 'name': 'postgresql1', 'host': 'localhost:1', 'retry_timeout': 10,
+                         'register_service': True})
        self.c._base_path = '/service/good'
        self.c._load_cluster()

@@ -111,12 +113,14 @@ class TestConsul(unittest.TestCase):
    @patch.object(consul.Consul.KV, 'delete', Mock(side_effect=[ConsulException, True, True]))
    @patch.object(consul.Consul.KV, 'put', Mock(side_effect=[True, ConsulException]))
    def test_touch_member(self):
+        self.c._register_service = True
        self.c.refresh_session = Mock(return_value=True)
        self.c.touch_member({'balbla': 'blabla'})
        self.c.touch_member({'balbla': 'blabla'})
        self.c.touch_member({'balbla': 'blabla'})
        self.c.refresh_session = Mock(return_value=False)
-        self.c.touch_member({'balbla': 'blabla'})
+        self.c.touch_member({'conn_url': 'postgres://replicator:[email protected]:5433/postgres',
+                             'api_url': 'http://127.0.0.1:8009/patroni'})

    @patch.object(consul.Consul.KV, 'put', Mock(return_value=False))
    def test_take_leader(self):
@@ -176,3 +180,19 @@ class TestConsul(unittest.TestCase):
    @patch.object(consul.Consul.KV, 'put', Mock(return_value=True))
    def test_set_history_value(self):
        self.assertTrue(self.c.set_history_value('{}'))
+
+    @patch.object(consul.Consul.Agent.Service, 'register', Mock(side_effect=(False, True)))
+    @patch.object(consul.Consul.Agent.Service, 'deregister', Mock(return_value=True))
+    def test_update_service(self):
+        d = {'role': 'replica', 'api_url': 'http://a/t', 'conn_url': 'pg://c:1', 'state': 'running'}
+        self.assertIsNone(self.c.update_service({}, {}))
+        self.assertFalse(self.c.update_service({}, d))
+        self.assertTrue(self.c.update_service(d, d))
+        self.assertIsNone(self.c.update_service(d, d))
+        d['state'] = 'stopped'
+        self.assertTrue(self.c.update_service(d, d, force=True))
+        d['state'] = 'unknown'
+        self.assertIsNone(self.c.update_service({}, d))
+        d['state'] = 'running'
+        d['role'] = 'bla'
+        self.assertIsNone(self.c.update_service({}, d))
@@ -225,6 +225,22 @@ class TestCtl(unittest.TestCase):
        result = self.runner.invoke(ctl, ['dsn', 'alpha', '--member', 'dummy'])
        assert result.exit_code == 1

+    @patch('requests.post')
+    @patch('patroni.ctl.get_dcs')
+    def test_reload(self, mock_get_dcs, mock_post):
+        mock_get_dcs.return_value.get_cluster = get_cluster_initialized_with_leader
+
+        result = self.runner.invoke(ctl, ['reload', 'alpha'], input='y')
+        assert 'Failed: reload for member' in result.output
+
+        mock_post.return_value.status_code = 200
+        result = self.runner.invoke(ctl, ['reload', 'alpha'], input='y')
+        assert 'No changes to apply on member' in result.output
+
+        mock_post.return_value.status_code = 202
+        result = self.runner.invoke(ctl, ['reload', 'alpha'], input='y')
+        assert 'Reload request received for member' in result.output
+
    @patch('requests.post', requests_get)
    @patch('patroni.ctl.get_dcs')
    def test_restart_reinit(self, mock_get_dcs):
@@ -328,8 +344,14 @@ class TestCtl(unittest.TestCase):
        assert result.exit_code == 0

    @patch('requests.post', Mock(side_effect=requests.exceptions.ConnectionError('foo')))
-    def test_request_patroni(self):
+    @patch('click.get_current_context')
+    def test_request_patroni(self, mock_context):
        member = get_cluster_initialized_with_leader().leader.member
+
+        mock_context.return_value.obj = {'ctl': {'cacert': 'cert.pem'}}
+        self.assertRaises(requests.exceptions.ConnectionError, request_patroni, member, 'post', 'dummy', {})
+
+        mock_context.return_value.obj = {'ctl': {'insecure': True}}
        self.assertRaises(requests.exceptions.ConnectionError, request_patroni, member, 'post', 'dummy', {})

    def test_ctl(self):
@@ -2,8 +2,10 @@ import datetime
 import etcd
 import os
 import unittest
+import sys

 from mock import Mock, MagicMock, PropertyMock, patch
+from patroni.async_executor import CriticalTask
 from patroni.config import Config
 from patroni.dcs import Cluster, ClusterConfig, Failover, Leader, Member, get_dcs, SyncState, TimelineHistory
 from patroni.dcs.etcd import Client
@@ -15,9 +17,9 @@ from patroni.utils import tzutc
 from test_etcd import socket_getaddrinfo, etcd_read, etcd_write, requests_get
 from test_postgresql import psycopg2_connect, MockPostmaster

-
 SYSID = '12345678901'

+
 def true(*args, **kwargs):
    return True

@@ -26,16 +28,17 @@ def false(*args, **kwargs):
    return False


-def get_cluster(initialize, leader, members, failover, sync):
+def get_cluster(initialize, leader, members, failover, sync, cluster_config=None):
    history = TimelineHistory(1, [(1, 67197376, 'no recovery target specified', datetime.datetime.now().isoformat())])
-    return Cluster(initialize, ClusterConfig(1, {1: 2}, 1), leader, 10, members, failover, sync, history)
+    cluster_config = cluster_config or ClusterConfig(1, {1: 2}, 1)
+    return Cluster(initialize, cluster_config, leader, 10, members, failover, sync, history)


-def get_cluster_not_initialized_without_leader():
-    return get_cluster(None, None, [], None, SyncState(None, None, None))
+def get_cluster_not_initialized_without_leader(cluster_config=None):
+    return get_cluster(None, None, [], None, SyncState(None, None, None), cluster_config)


-def get_cluster_initialized_without_leader(leader=False, failover=None, sync=None):
+def get_cluster_initialized_without_leader(leader=False, failover=None, sync=None, cluster_config=None):
    m1 = Member(0, 'leader', 28, {'conn_url': 'postgres://replicator:[email protected]:5435/postgres',
                                  'api_url': 'http://127.0.0.1:8008/patroni', 'xlog_location': 4})
    leader = Leader(0, 0, m1) if leader else None
@@ -47,16 +50,38 @@ def get_cluster_initialized_without_leader(leader=False, failover=None, sync=Non
                                 'scheduled_restart': {'schedule': "2100-01-01 10:53:07.560445+00:00",
                                                       'postgres_version': '99.0.0'}})
    syncstate = SyncState(0 if sync else None, sync and sync[0], sync and sync[1])
-    return get_cluster(SYSID, leader, [m1, m2], failover, syncstate)
+    return get_cluster(SYSID, leader, [m1, m2], failover, syncstate, cluster_config)


 def get_cluster_initialized_with_leader(failover=None, sync=None):
    return get_cluster_initialized_without_leader(leader=True, failover=failover, sync=sync)


-def get_cluster_initialized_with_only_leader(failover=None):
+def get_cluster_initialized_with_only_leader(failover=None, cluster_config=None):
    leader = get_cluster_initialized_without_leader(leader=True, failover=failover).leader
-    return get_cluster(True, leader, [leader], failover, None)
+    return get_cluster(True, leader, [leader], failover, None, cluster_config)
+
+
+def get_cluster_not_initialized_standby(failover=None, sync=None):
+    return get_cluster_not_initialized_without_leader(
+        cluster_config=ClusterConfig(1, {
+            "standby_cluster": {
+                "host": "localhost",
+                "port": 5432,
+                "primary_slot_name": "",
+            }}, 1)
+    )
+
+
+def get_standby_cluster_initialized_with_only_leader(failover=None, sync=None):
+    return get_cluster_initialized_with_only_leader(
+        cluster_config=ClusterConfig(1, {
+            "standby_cluster": {
+                "host": "localhost",
+                "port": 5432,
+                "primary_slot_name": "",
+            }}, 1)
+    )


 def get_node_status(reachable=True, in_recovery=True, wal_position=10, nofailover=False, watchdog_failed=False):
@@ -97,6 +122,10 @@ zookeeper:
    hosts: [localhost]
    port: 8181
 """
+        # We rely on sys.argv in Config, so it's necessary to reset
+        # all the extra values that are coming from py.test
+        sys.argv = sys.argv[:1]
+
        self.config = Config()
        self.postgresql = p
        self.dcs = d
@@ -175,10 +204,57 @@ class TestHa(unittest.TestCase):
        self.p.replica_cached_timeline = Mock(side_effect=Exception)
        self.ha.touch_member()

+    def test_is_leader(self):
+        self.assertFalse(self.ha.is_leader())
+
    def test_start_as_replica(self):
        self.p.is_healthy = false
        self.assertEquals(self.ha.run_cycle(), 'starting as a secondary')

+    @patch('patroni.dcs.etcd.Etcd.initialize', return_value=True)
+    def test_start_as_standby_leader(self, initialize):
+        self.p.data_directory_empty = true
+        self.ha.cluster = get_cluster_not_initialized_standby()
+        self.ha.cluster.is_unlocked = true
+        self.ha.patroni.config._dynamic_configuration = {"standby_cluster": {
+            "host": "localhost",
+            "port": 5432,
+            "primary_slot_name": "",
+        }}
+        self.assertEquals(
+            self.ha.run_cycle(),
+            'trying to bootstrap a new standby leader'
+        )
+
+    @patch.object(Cluster, 'get_clone_member',
+                  Mock(return_value=Member(0, 'test', 1, {'api_url': 'http://127.0.0.1:8011/patroni'})))
+    @patch.object(Postgresql, 'create_replica', Mock(return_value=0))
+    def test_start_as_cascade_replica_in_standby_cluster(self):
+        self.p.data_directory_empty = true
+        self.ha.cluster = get_standby_cluster_initialized_with_only_leader()
+        self.ha.cluster.is_unlocked = false
+        self.ha.patroni.config._dynamic_configuration = {"standby_cluster": {
+            "host": "localhost",
+            "port": 5432,
+            "primary_slot_name": "",
+        }}
+        self.assertEquals(
+            self.ha.run_cycle(),
+            "trying to bootstrap from replica 'test'"
+        )
+
+    @patch.object(Postgresql, 'create_replica', Mock(return_value=0))
+    def test_bootstrap_standby_leader(self):
+        self.ha.cluster = get_cluster_not_initialized_standby()
+        self.ha.cluster.is_unlocked = true
+        self.ha.patroni.config._dynamic_configuration = {"standby_cluster": {
+            "host": "localhost",
+            "port": 5432,
+            "primary_slot_name": "",
+        }}
+        self.ha._post_bootstrap_task = CriticalTask()
+        self.assertEquals(self.ha.bootstrap_standby_leader(), True)
+
    def test_recover_replica_failed(self):
        self.p.controldata = lambda: {'Database cluster state': 'in recovery', 'Database system identifier': SYSID}
        self.p.is_running = false
@@ -207,15 +283,6 @@ class TestHa(unittest.TestCase):
        self.ha.cluster = get_cluster_initialized_with_leader()
        self.assertEquals(self.ha.run_cycle(), 'running pg_rewind from leader')

-    @patch.object(Postgresql, 'can_rewind', PropertyMock(return_value=True))
-    @patch.object(Postgresql, 'fix_cluster_state', Mock())
-    def test_single_user_after_recover_failed(self):
-        self.p.controldata = lambda: {'Database cluster state': 'in recovery', 'Database system identifier': SYSID}
-        self.p.is_running = false
-        self.p.follow = false
-        self.assertEquals(self.ha.run_cycle(), 'starting as a secondary')
-        self.assertEquals(self.ha.run_cycle(), 'fixing cluster state in a single user mode')
-
    @patch('sys.exit', return_value=1)
    @patch('patroni.ha.Ha.sysid_valid', MagicMock(return_value=True))
    def test_sysid_no_match(self, exit_mock):
@@ -622,6 +689,61 @@ class TestHa(unittest.TestCase):
        self.ha.cluster = get_cluster_initialized_with_leader(Failover(0, '', self.p.name, None))
        self.assertEquals(self.ha.run_cycle(), 'PAUSE: waiting to become master after promote...')

+    def test_process_healthy_standby_cluster_as_standby_leader(self):
+        self.p.is_leader = false
+        self.p.name = 'leader'
+        self.ha.patroni.config._dynamic_configuration = {"standby_cluster": {
+            "host": "localhost",
+            "port": 5432,
+            "primary_slot_name": "",
+        }}
+        self.ha.cluster = get_standby_cluster_initialized_with_only_leader()
+        msg = 'no action.  i am the standby leader with the lock'
+        self.assertEquals(self.ha.run_cycle(), msg)
+
+    def test_process_healthy_standby_cluster_as_cascade_replica(self):
+        self.p.is_leader = false
+        self.p.name = 'replica'
+        self.ha.patroni.config._dynamic_configuration = {"standby_cluster": {
+            "host": "localhost",
+            "port": 5432,
+            "primary_slot_name": "",
+        }}
+        self.ha.cluster = get_standby_cluster_initialized_with_only_leader()
+        msg = 'no action.  i am a secondary and i am following a leader'
+        self.assertEquals(self.ha.run_cycle(), msg)
+
+    @patch('patroni.dcs.etcd.Etcd.initialize', return_value=True)
+    def test_process_unhealthy_standby_cluster_as_standby_leader(self, initialize):
+        self.p.is_leader = false
+        self.p.name = 'leader'
+        self.ha.patroni.config._dynamic_configuration = {"standby_cluster": {
+            "host": "localhost",
+            "port": 5432,
+            "primary_slot_name": "",
+        }}
+        self.ha.cluster = get_standby_cluster_initialized_with_only_leader()
+        self.ha.cluster.is_unlocked = true
+        self.ha.sysid_valid = true
+        self.p._sysid = True
+        msg = 'promoted self to a standby leader because i had the session lock'
+        self.assertEquals(self.ha.run_cycle(), msg)
+
+    @patch.object(Postgresql, 'rewind_needed_and_possible', Mock(return_value=True))
+    @patch('patroni.dcs.etcd.Etcd.initialize', return_value=True)
+    def test_process_unhealthy_standby_cluster_as_cascade_replica(self, initialize):
+        self.p.is_leader = false
+        self.p.name = 'replica'
+        self.ha.patroni.config._dynamic_configuration = {"standby_cluster": {
+            "host": "localhost",
+            "port": 5432,
+            "primary_slot_name": "",
+        }}
+        self.ha.cluster = get_standby_cluster_initialized_with_only_leader()
+        self.ha.is_unlocked = true
+        msg = 'running pg_rewind from leader'
+        self.assertEquals(self.ha.run_cycle(), msg)
+
    def test_failed_to_update_lock_in_pause(self):
        self.ha.update_lock = false
        self.ha.is_paused = true
@@ -103,6 +103,7 @@ class TestPatroni(unittest.TestCase):

    @patch('patroni.config.Config.save_cache', Mock())
    @patch('patroni.config.Config.reload_local_configuration', Mock(return_value=True))
+    @patch('patroni.ha.Ha.is_leader', Mock(return_value=True))
    @patch.object(Postgresql, 'state', PropertyMock(return_value='running'))
    @patch.object(Postgresql, 'data_directory_empty', Mock(return_value=False))
    def test_run(self):
@@ -151,3 +152,7 @@ class TestPatroni(unittest.TestCase):
        self.assertTrue(self.p.nosync)
        self.p.tags['nosync'] = None
        self.assertFalse(self.p.nosync)
+
+    def test_shutdown(self):
+        self.p.api.shutdown = Mock(side_effect=Exception)
+        self.p.shutdown()
@@ -8,13 +8,13 @@ import unittest

 from mock import Mock, MagicMock, PropertyMock, patch, mock_open
 from patroni.async_executor import CriticalTask
-from patroni.dcs import Cluster, Leader, Member, SyncState
+from patroni.dcs import Cluster, Leader, Member, RemoteMember, SyncState
 from patroni.exceptions import PostgresConnectionException, PostgresException
 from patroni.postgresql import Postgresql, STATE_REJECT, STATE_NO_RESPONSE
 from patroni.postmaster import PostmasterProcess
 from patroni.utils import RetryFailedError
 from six.moves import builtins
-from threading import Thread
+from threading import Thread, current_thread


 class MockCursor(object):
@@ -401,7 +401,7 @@ class TestPostgresql(unittest.TestCase):
    @patch.object(Postgresql, 'is_running', Mock(return_value=False))
    @patch.object(Postgresql, 'start', Mock())
    def test_follow(self):
-        self.p.follow(None)
+        self.p.follow(RemoteMember('123', {'recovery_command': 'foo'}))

    @patch('subprocess.check_output', Mock(return_value=0, side_effect=pg_controldata_string))
    def test_can_rewind(self):
@@ -420,14 +420,14 @@ class TestPostgresql(unittest.TestCase):
    def test_create_replica(self, mock_cancellable_subprocess_call):
        self.p.delete_trigger_file = Mock(side_effect=OSError)

-        self.p.config['create_replica_method'] = ['wale', 'basebackup']
+        self.p.config['create_replica_methods'] = ['wale', 'basebackup']
        self.p.config['wale'] = {'command': 'foo'}
        mock_cancellable_subprocess_call.return_value = 0
        self.assertEquals(self.p.create_replica(self.leader), 0)
        del self.p.config['wale']
        self.assertEquals(self.p.create_replica(self.leader), 0)

-        self.p.config['create_replica_method'] = ['basebackup']
+        self.p.config['create_replica_methods'] = ['basebackup']
        self.p.config['basebackup'] = [{'max_rate': '100M'}, 'no-sync']
        self.assertEquals(self.p.create_replica(self.leader), 0)

@@ -448,7 +448,7 @@ class TestPostgresql(unittest.TestCase):
        self.p.config['basebackup'] = {"foo": "bar"}
        self.assertEquals(self.p.create_replica(self.leader), 0)

-        self.p.config['create_replica_method'] = ['wale', 'basebackup']
+        self.p.config['create_replica_methods'] = ['wale', 'basebackup']
        del self.p.config['basebackup']
        mock_cancellable_subprocess_call.return_value = 1
        self.assertEquals(self.p.create_replica(self.leader), 1)
@@ -465,6 +465,31 @@ class TestPostgresql(unittest.TestCase):
        self.p.cancel()
        self.assertEquals(self.p.create_replica(self.leader), 1)

+    @patch('time.sleep', Mock())
+    @patch.object(Postgresql, 'cancellable_subprocess_call')
+    @patch.object(Postgresql, 'remove_data_directory', Mock(return_value=True))
+    def test_create_replica_old_format(self, mock_cancellable_subprocess_call):
+        """ The same test as before but with old 'create_replica_method'
+            to test backward compatibility
+        """
+        self.p.delete_trigger_file = Mock(side_effect=OSError)
+
+        self.p.config['create_replica_method'] = ['wale', 'basebackup']
+        self.p.config['wale'] = {'command': 'foo'}
+        mock_cancellable_subprocess_call.return_value = 0
+        self.assertEquals(self.p.create_replica(self.leader), 0)
+        del self.p.config['wale']
+        self.assertEquals(self.p.create_replica(self.leader), 0)
+
+        self.p.config['create_replica_method'] = ['basebackup']
+        self.p.config['basebackup'] = [{'max_rate': '100M'}, 'no-sync']
+        self.assertEquals(self.p.create_replica(self.leader), 0)
+
+        self.p.config['create_replica_method'] = ['wale', 'basebackup']
+        del self.p.config['basebackup']
+        mock_cancellable_subprocess_call.return_value = 1
+        self.assertEquals(self.p.create_replica(self.leader), 1)
+
    def test_basebackup(self):
        self.p.cancel()
        self.p.basebackup(None, None, {'foo': 'bar'})
@@ -635,6 +660,12 @@ class TestPostgresql(unittest.TestCase):
        self.p.post_bootstrap({}, task)
        self.assertTrue(task.result)

+        self.p.bootstrap(config)
+        with patch.object(Postgresql, 'pending_restart', PropertyMock(return_value=True)), \
+                patch.object(Postgresql, 'restart', Mock()) as mock_restart:
+            self.p.post_bootstrap({}, task)
+            mock_restart.assert_called_once()
+
        self.p.bootstrap(config)
        self.p.set_state('stopped')
        self.p.reload_config({'authentication': {'superuser': {'username': 'p', 'password': 'p'},
@@ -790,10 +821,12 @@ class TestPostgresql(unittest.TestCase):

    def test_wait_for_startup(self):
        state = {'sleeps': 0, 'num_rejects': 0, 'final_return': 0}
+        self.__thread_ident = current_thread().ident

        def increment_sleeps(*args):
-            print("Sleep")
-            state['sleeps'] += 1
+            if current_thread().ident == self.__thread_ident:
+                print("Sleep")
+                state['sleeps'] += 1

        def isready_return(*args):
            ret = 1 if state['sleeps'] < state['num_rejects'] else state['final_return']
@@ -969,3 +1002,14 @@ class TestPostgresql(unittest.TestCase):
        self.p.cancel()
        type(self.p._cancellable).returncode = PropertyMock(side_effect=[None, -15])
        self.p.cancel()
+
+    @patch.object(Postgresql, 'get_postgres_role_from_data_directory', Mock(return_value='replica'))
+    def test__build_effective_configuration(self):
+        with patch.object(Postgresql, 'controldata',
+                          Mock(return_value={'max_connections setting': '200',
+                                             'max_worker_processes setting': '20',
+                                             'max_prepared_xacts setting': '100',
+                                             'max_locks_per_xact setting': '100'})):
+            self.p.cancel()
+            self.assertFalse(self.p.start())
+            self.assertTrue(self.p.pending_restart)
@@ -7,6 +7,7 @@ from patroni.scripts import wale_restore
 from patroni.scripts.wale_restore import WALERestore, main as _main, get_major_version
 from six.moves import builtins
 from test_postgresql import MockConnect, psycopg2_connect
+from threading import current_thread


 wale_output_header = (
@@ -42,6 +43,13 @@ class TestWALERestore(unittest.TestCase):
                                        '/etc', 100, 100, 1, 0, WALE_TEST_RETRIES)

    def test_should_use_s3_to_create_replica(self):
+        self.__thread_ident = current_thread().ident
+        sleeps = [0]
+
+        def mock_sleep(*args):
+            if current_thread().ident == self.__thread_ident:
+                sleeps[0] += 1
+
        self.assertTrue(self.wale_restore.should_use_s3_to_create_replica())
        with patch.object(MockConnect, 'server_version', PropertyMock(return_value=100000)):
            self.assertTrue(self.wale_restore.should_use_s3_to_create_replica())
@@ -55,13 +63,11 @@ class TestWALERestore(unittest.TestCase):

            self.assertFalse(self.wale_restore.should_use_s3_to_create_replica())

-            with patch('time.sleep', Mock(return_value=None)) as mock_sleep:
+            with patch('time.sleep', mock_sleep):
                self.wale_restore.no_master = 1
-                assert self.wale_restore.should_use_s3_to_create_replica()
+                self.assertTrue(self.wale_restore.should_use_s3_to_create_replica())
                # verify retries
-                mock_sleep.assert_has_calls(
-                    [((wale_restore.RETRY_SLEEP_INTERVAL,),)] * WALE_TEST_RETRIES
-                )
+                self.assertEqual(sleeps[0], WALE_TEST_RETRIES)

            self.wale_restore.master_connection = ''
            self.assertTrue(self.wale_restore.should_use_s3_to_create_replica())
@@ -104,13 +110,20 @@ class TestWALERestore(unittest.TestCase):

    @patch('sys.exit', Mock())
    def test_main(self):
+        self.__thread_ident = current_thread().ident
+        sleeps = [0]
+
+        def mock_sleep(*args):
+            if current_thread().ident == self.__thread_ident:
+                sleeps[0] += 1
+
        with patch.object(WALERestore, 'run', Mock(return_value=0)):
            self.assertEqual(_main(), 0)

        with patch.object(WALERestore, 'run', Mock(return_value=1)), \
-                patch('time.sleep', Mock(return_value=None)) as mock_sleep:
+                patch('time.sleep', mock_sleep):
            self.assertEqual(_main(), 1)
-            assert mock_sleep.call_count == WALE_TEST_RETRIES
+            self.assertTrue(sleeps[0], WALE_TEST_RETRIES)

    @patch('os.path.isfile', Mock(return_value=True))
    def test_get_major_version(self):
@@ -156,7 +156,7 @@ class TestZooKeeper(unittest.TestCase):
        self.zk.set_failover_value('Exception')

    def test_set_config_value(self):
-        self.zk.set_config_value('')
+        self.zk.set_config_value('', 1)
        self.zk.set_config_value('ok')
        self.zk.set_config_value('Exception')

@@ -179,7 +179,8 @@ class TestZooKeeper(unittest.TestCase):
        self.zk.touch_member({'retry': 'retry'})
        self.zk._fetch_cluster = True
        self.zk.get_cluster()
-        self.zk.touch_member({'retry': 'retry'})
+        self.zk.touch_member({'conn_url': 'postgres://repuser:rep-pass@localhost:5434/postgres',
+                              'api_url': 'http://127.0.0.1:8009/patroni'})

    def test_take_leader(self):
        self.zk.take_leader()
Author	SHA1	Message	Date
Alexander Kukushkin	4d9720a78d	Use pg10 as base image and python3 instead of 2	2018-09-12 16:57:22 +02:00
Alexander Kukushkin	1f205f8191	Merge branch 'master' of github.com:zalando/patroni into feature/demo	2018-09-12 16:44:02 +02:00
Pavel KirillovandAlexander Kukushkin	2e9cb412e4	Register service in consul (#802 ) Кegister service 'scope_name' with tag 'master' or 'replica' example with scope 'pgsql-pgpi' ```[root@pgpi1 ~]# host -t SRV pgsql-pgpi.service.consul. 127.0.0.1 Using domain server: Name: 127.0.0.1 Address: 127.0.0.1#53 Aliases: pgsql-pgpi.service.consul has SRV record 1 1 5432 pgpi1.node.dc.consul. pgsql-pgpi.service.consul has SRV record 1 1 5432 pgpi2.node.dc.consul. [root@pgpi1 ~]# host -t SRV master.pgsql-pgpi.service.consul. 127.0.0.1 Using domain server: Name: 127.0.0.1 Address: 127.0.0.1#53 Aliases: master.pgsql-pgpi.service.consul has SRV record 1 1 5432 pgpi2.node.dc.consul. [root@pgpi1 ~]# host -t SRV replica.pgsql-pgpi.service.consul. 127.0.0.1 Using domain server: Name: 127.0.0.1 Address: 127.0.0.1#53 Aliases: replica.pgsql-pgpi.service.consul has SRV record 1 1 5432 pgpi1.node.dc.consul.``` Fixes: https://github.com/zalando/patroni/issues/771	2018-09-07 15:17:56 +02:00
Dmitry DolgovandGitHub	dd7c3c349f	[WIP] Standby cluster implementation (#679 ) Implementation of "standby cluster" described in #657. Standby cluster consists of a "standby leader", that replicates from a "remote master" (which is not a part of current patroni cluster and can be anywhere), and cascade replicas, that replicate from the corresponding standby leader. "Standby leader" behaves pretty much like a regular leader, which means that it holds a leader lock in DSC, in case if disappears there will be an election of a new "standby leader". One can define such a cluster using the section "standby_cluster" in patroni config file. This section provides parameters for standby cluster, that will be applied only once during bootstrap and can be changed only through DSC.	2018-09-07 10:10:56 +02:00
Alexander KukushkinandGitHub	4ca8a6e506	Make retries of calls to DCS consistent across implementations (#805 ) in addition to that do a small refactoring of zookeeper and consul and try to improve the stability of AT	2018-09-06 08:37:26 +02:00
wilfriedrosetandAlexander Kukushkin	0136f252ab	Add patronictl -k/--insecure flag and suport for restapi cert (#790 ) Fixes https://github.com/zalando/patroni/issues/785	2018-08-29 16:08:13 +02:00
anikin-aaandAlexander Kukushkin	0e13677880	exclude members with nofailover tag (#798 ) Exclude members with nofailover tag from `patronictl switchover/failover` output. Fixes https://github.com/zalando/patroni/issues/769	2018-08-29 16:07:01 +02:00
anikin-aaandAlexander Kukushkin	68c0d87d42	check if output lines of controldata are possible to split (#797 ) Otherwise it fails with scary stacktrace	2018-08-29 16:06:06 +02:00
Alexander KukushkinandGitHub	90cf930036	Refactor REST API health-checks (#779 ) Make it more readable and easy to understand. Mostly it is needed to implement https://github.com/zalando/patroni/issues/772	2018-08-29 11:35:22 +02:00
Jan MusslerandAlexander Kukushkin	2b87ae0cd0	Add member name to error message. (#792 ) Analog to success message.	2018-08-29 11:30:51 +02:00
Alexander KukushkinandGitHub	5ca5dacaa9	Immediately reserve LSN on upon creation of replication slot (#783 ) This feature is available starting from 9.6	2018-08-29 11:30:01 +02:00
Alexander KukushkinandGitHub	87e9aab04c	Improve tests (#778 ) * Implement missing unit-tests * Add acceptance tests for ISSUE #776 * Update list of classifiers, keywords and authors	2018-08-29 11:29:37 +02:00
Alexander KukushkinandGitHub	518df2bc49	Search new sync candidate amoung potential and async standbys (#794 ) In synchronos_mode_strict we put '*' into synchronos_standby_names, what makes one connection 'sync' and other connections 'potential'. The code picking up the correct sync standby didn't consider 'potential' as a good candidate. Fixes: https://github.com/zalando/patroni/issues/789	2018-08-29 11:28:46 +02:00
Alexander KukushkinandGitHub	a513a7bb68	Improve stability of acceptance tests (#780 ) last time tests were failing due to postgres/patroni slowness in picking sync standby	2018-08-29 11:13:18 +02:00
Alexander KukushkinandGitHub	715caaddf3	Remove .zappr.yaml (#795 ) and switch to github approvals	2018-08-29 11:09:35 +02:00
Oleksii KliukinandAlexander Kukushkin	b165183503	Reset is_leader status on demote (#777 ) Make sure demoted cluster member stops responding with code 200 on the /master API call. Issue a new minor release. Fixes https://github.com/zalando/patroni/issues/776	2018-08-14 17:08:08 +02:00
Dmitry DolgovandGitHub	b282a0f254	Add "cluster_unlocked" field (#764 ) Add a field to an api to figure out if a master is there from patroni point of view. It can be useful, when you have an alert, based on Auto Scaling Groups, and then ASG decided to shutdown the current master, spin up a new instance but the current master shutdown is stuck. In this situation the current master is no longer a part of ASG, but patroni and Postgres are still alive on the instance, which means a new replica will not be promoted yet - this will lead to a false alert, saying that your cluster doesn't have any master node.	2018-08-13 14:02:01 +02:00
Oleksii KliukinandAlexander Kukushkin	5e7345a2ca	Release notes 1.4.5 (#762 ) bump version update release notes	2018-08-03 17:02:11 +02:00
Don SeilerandAlexander Kukushkin	502094ee79	Log config change or not (#731 ) This adds INFO log messages that clearly state if configuration values were seen as changed by Patroni after SIGHUP/reload and warrant reloading (or if nothing was changed an no reloading is necessary). This ended up being a lot simpler than I had imagined once I found postgresql.py:reload_config(). I add a log line in config.py:reload_local_configuration() since that function will short-circuit the process early if the local config wasn't changed. But the final determination of whether or not values have changed and need reloading is in postgresql.py:reload_config().	2018-08-03 17:00:57 +02:00
Alexander KukushkinandGitHub	0c1ae6fbeb	Respond 200 to master health-check only if update_lock was successful (#713 ) If Patroni gets partitioned it starts receiving stale information from DCS. We can't use this information to determine that we have the leader key. Instead, we will record in Ha object the actual state of acquire/update lock and report as a leader only if it was successful. P.S. despite responding with 200 on `GET /master` postgres was still running read-only.	2018-08-03 17:00:01 +02:00
Alexander KukushkinandGitHub	2fd2556050	Set role to demoted if postgres isn't running and no recovery.conf (#757 ) In really rare cases it was causing following behavior: ``` 2018-07-31 10:35:30,302 INFO: starting as a secondary 2018-07-31 10:35:30,309 INFO: Lock owner: postgresql0; I am postgresql1 2018-07-31 10:35:30,310 INFO: Demoting master during restarting after failure 2018-07-31 10:35:30,381 INFO: postmaster pid=17709 2018-07-31 10:35:30,386 INFO: lost leader lock during restarting after failure 2018-07-31 10:35:30,388 ERROR: Exception during CHECKPOINT ```	2018-08-03 16:59:04 +02:00
Oleksii KliukinandAlexander Kukushkin	d47049ce0e	Fix condition for the replica start due to pg_rewind in paused state. (#754 ) Avoid starting the replica that had already executed pg_rewind before. Fixes in #753	2018-08-03 16:45:33 +02:00
Henning JacobsandGitHub	2f7c53031c	Python 3.6 and 3.7 are now supported, too (#752 )	2018-07-24 10:51:25 +02:00
Christoph BergandHenning Jacobs	a2c6ed5504	async is a keyword in python3.7 (#751 ) * async is a keyword in python3.7 Setting up patroni (1.4.4-1) ... File "/usr/lib/python3/dist-packages/patroni/ha.py", line 610 'offline': dict(stop='fast', checkpoint=False, release=False, offline=True, async=False), ^ SyntaxError: invalid syntax Fix #750 by replacing dict member "async" with "async_req". * requirements.txt: Update for new kubernetes version compatible with 3.7	2018-07-23 20:42:33 +02:00
Oleksii KliukinandAlexander Kukushkin	00c2e1c2d0	Grant delete on endpoints and configmaps in RBAC. (#749 ) 'patronictl remove' deletes the cluster configuration (stored either in configmaps or endpoints) and cannot be run from the postgres pod w/o 'delete' on those objects being granted to the pod service account.	2018-07-23 20:39:46 +03:00
Don SeilerandAlexander Kukushkin	f5927bad70	Add EnvironmentFile directive (#746 ) Add an EnvironmentFile directive to read in a configuration file with environment variables. The "-" prefix means it can proceed if the file doesn't exist. This would allow users to keep sensitive information like the SUPERUSER/REPLICATION passwords in the config file separate from a YAML file that might be deployed from source control.	2018-07-23 20:31:47 +03:00
Alexander KukushkinandOleksii Kliukin	26466237b9	Update docker-compose example to postgres 10 (#737 ) Some other changes are related to the new version of confd, which now requires specifying etcd url instead of etcd host.	2018-07-23 16:41:17 +02:00
Tony SorrentinoandOleksii Kliukin	c8f9199988	Added setting state to "stopped" when a member is stopped in Ha.shutdown (#733 ) Changes by @tonys66, review by @CyberDem0n	2018-07-23 14:59:39 +02:00
Alexander KukushkinandOleksii Kliukin	2356af679b	Convert query params from list to dict (#744 ) Patroni is relying on params to determinte timeout and amount of retries when executing api requests to consul. Starting from v1.1.0 python-consul changed internal API and started using `list` instead of `dict` to pass query parameters. Such change broke "watch" functionality. Fixes https://github.com/zalando/patroni/issues/742 and https://github.com/zalando/patroni/issues/734	2018-07-23 14:56:51 +02:00
Ants AasmaandOleksii Kliukin	3b633abd91	Improve logging when stale postmaster.pid matches running process (#738 ) Currently the informational message logged is beyond confusing. This improves the logging so there is some indication what this message is about and that it is somewhat normal. Changes by @ants	2018-07-17 16:46:22 +02:00
alago197andOleksii Kliukin	936a4238fb	Update some descriptions for the REST API endpoints (#729 ) * Update some descriptions for the REST API endpoints By @alago197	2018-07-10 15:40:53 +02:00
Don SeilerandOleksii Kliukin	50a8114d0b	Use enforced minimums in postgresX.yml files (#730 ) Fix the discrepancy for the values of max_wal_senders and max_replication_slots between the sample postgres.yml files and hard-coded defaults in Patroni, bumping the former to 10. Contributed by @dtseiler	2018-07-04 10:08:54 +02:00
Don SeilerandAlexander Kukushkin	4e8709b266	Adding reload functionality (#726 ) This allows the config to be reloaded via `systemctl reload patroni`, sending SIGHUP to the patroni process. Tested on CentOS.	2018-06-30 23:16:42 +02:00
Alexander KukushkinandGitHub	4128cba628	max_worker_processes parameter was introduced only in 9.4 (#724 ) exclude it from the list on 9.3 when building effective configuration	2018-06-26 13:48:16 +01:00
Don SeilerandAlexander Kukushkin	959f254bfb	Adding patronictl reload functionality to reload from yaml config file (#716 ) Fixes https://github.com/zalando/patroni/issues/715	2018-06-20 10:09:10 +02:00
Alexander KukushkinandGitHub	8a3b78ca7b	Rest api thread can raise an exception during shutdown (#711 ) catch it and report	2018-06-14 13:17:50 +02:00
Oleksii KliukinandGitHub	41e5f58f2b	Describe synchronous_mode_strict (#710 ) * Describe synchronous_mode_strict Per https://github.com/zalando/patroni/issues/709	2018-06-13 11:12:22 +02:00
Dmitry DolgovandGitHub	f0d23b0b14	Merge pull request #706 from zalando/feature/rename-create-replica-method Rename create_replica_method to create_replica_methods	2018-06-12 14:16:54 +02:00
Alexander KukushkinandGitHub	cbd0a759c0	Relax kubernetes module version (#701 ) Patroni is proven to work with 2.0.0, 3.0.0 and 6.0.0	2018-06-12 14:11:00 +02:00
Alexander KukushkinandGitHub	aadd39b0a4	Do crash recovery only when we sure that postgres was running as master (#707 ) pg_controldata reports in this case: * 'in production' * 'shutting down' * 'in crash recovery'	2018-06-12 14:09:09 +02:00
Henning JacobsandAlexander Kukushkin	2537147810	#694 handle configuration error (#695 ) It is possible to change a lot of parameters in runtime (including `restapi.listen`) by updating Patroni config file and sending SIGHUP to Patroni process. If something was misconfigured it was throwing a weird exception and breaking `restapi` thread. This PR improves friendliness of error message and avoids breaking of `restapi`.	2018-06-12 14:08:38 +02:00
Alexander KukushkinandGitHub	e939304001	Take and apply some parameters from controldata when starting as replica (#703 ) * Take and apply some parameters from controldata when starting as replica https://www.postgresql.org/docs/10/static/hot-standby.html#HOT-STANDBY-ADMIN There is set of parameters which value on the replica must be not smaller than on the primary, otherwise replica will refuse to start: * max_connections * max_prepared_transactions * max_locks_per_transaction * max_worker_processes It might happen that values of these parameters in the global configuration are not set high enough, what makes impossible to start a replica without human intervention. Usually it happens when we bootstrap a new cluster from the basebackup. As a solution to this problem we will take values of above parameters from the pg_controldata output and in case if the values in the global configuration are not high enough, apply values taken from pg_controldata and set `pending_restart` flag.	2018-06-12 14:04:32 +02:00
Chris FraserandAlexander Kukushkin	aa18f70466	If set, use LD_LIBRARY_PATH when starting postgres (#698 ) Fixes #697	2018-06-12 14:00:48 +02:00
Alexander KukushkinandGitHub	e405e4e03c	Workaround to sporadic unit-test failures (#696 ) Fixes https://github.com/zalando/patroni/issues/691	2018-06-12 14:00:10 +02:00
erthalion	3d80e49b38	Rename also in settings docs	2018-06-12 13:28:30 +02:00
erthalion	d037aa8afd	Rename create_replica_method to create_replica_methods To make it clear that it's actually an array	2018-06-12 11:33:13 +02:00
Björn AlbersandAlexander Kukushkin	e5f2511764	Add WorkingDirectory to systemd sample config. (#686 ) Otherwise `initdb` fails because it tries to create the data directory in the root directory where the postgres user has no permissions.	2018-06-04 16:36:41 +02:00
Alexander Kukushkin	5a56b71946	Add demo.sh script	2018-03-23 07:02:22 +01:00
Alexander Kukushkin	e3b431bf38	Switch to endpoints and remove callback	2018-03-21 14:01:22 +01:00