Release 1.5.2 (#875 )

* Update release notes * Bump version
add openshift customizations, templates, and test (#871 )
2026-08-26 07:30:14 +00:00 · 2018-11-26 10:31:14 +01:00 · 2018-11-21 18:01:39 +01:00 · 2018-11-21 12:51:52 +01:00 · 2018-11-21 12:03:22 +01:00 · 2018-11-21 12:00:40 +01:00
54 changed files with 2209 additions and 613 deletions
@@ -1,13 +0,0 @@
-# for github.com
-approvals:
-  groups:
-    zalando:
-      minimum: 2
-      from:
-        orgs:
-          - "zalando"
-# team should be valid team id in team service https://teams.auth.zalando.com/api/teams/:id
-X-Zalando-Team: "acid"
-# type should be one of [code, doc, config, tools, secrets]
-# code will be the default value, if X-Zalando-Type is not found in .zappr.yml
-X-Zalando-Type: code
@@ -25,6 +25,19 @@ Bootstrap configuration
        -  **use\_slots**: whether or not to use replication_slots. Must be False for PostgreSQL 9.3. You should comment out max_replication_slots before it becomes ineligible for leader status.
        -  **recovery\_conf**: additional configuration settings written to recovery.conf when configuring follower. 
        -  **parameters**: list of configuration settings for Postgres. Many of these are required for replication to work.
+    -  **standby\_cluster**: if this section is defined, we want to bootstrap a standby cluster.
+        -  **host**: an address of remote master
+        -  **port**: a port of remote master
+        -  **primary\_slot\_name**: which slot on the remote master to use for replication. This parameter is optional, the default value is derived from the instance name (see function `slot_name_from_member_name`).
+        -  **create\_replica\_methods**: an ordered list of methods that can be used to bootstrap standby leader from the remote master, can be different from the list defined in :ref:`postgresql_settings`
+        -  **restore\_command**: command to restore WAL records from the remote master to standby leader, can be different from the list defined in :ref:`postgresql_settings`
+        -  **archive\_cleanup\_command**: cleanup command for standby leader
+        -  **recovery\_min\_apply\_delay**: how long to wait before actually apply WAL records on a standby leader
+    -  **slots**: define permanent replication slots. These slots will be preserved during switchover/failover. Patroni will try to create slots before opening connections to the cluster.
+        -  **my_slot_name**: the name of replication slot. It is the responsibility of the operator to make sure that there are no clashes in names between replication slots automatically created by Patroni for members and permanent replication slots.
+            -  **type**: slot type. Could be ``physical`` or ``logical``. If the slot is logical, you have to additionally define ``database`` and ``plugin``.
+               **database**: the database name where logical slots should be created.
+               **plugin**: the plugin name for the logical slot.
 -  **method**: custom script to use for bootstrapping this cluster.
   See :ref:`custom bootstrap methods documentation <custom_bootstrap>` for details.
   When ``initdb`` is specified revert to the default ``initdb`` command. ``initdb`` is also triggered when no ``method``
@@ -61,6 +74,8 @@ Most of the parameters are optional, but you have to specify one of the **host**
 -  **key**: (optional) file with the client key. Can be empty if the key is part of **cert**.
 -  **dc**: (optional) Datacenter to communicate with. By default the datacenter of the host is used.
 -  **checks**: (optional) list of Consul health checks used for the session. If not specified Consul will use "serfHealth" in additional to the TTL based check created by Patroni. Additional checks, in particular the "serfHealth", may cause the leader lock to expire faster than in `ttl` seconds when the leader instance becomes unavailable
+-  **register\_service**: (optional) whether or not to register a service with the name defined by the scope parameter and the tag master, replica or standby-leader depending on the node's role. Defaults to **false**
+-  **service\_check\_interval**: (optional) how often to perform health check against registered url

 Etcd
 ----
@@ -136,8 +151,10 @@ PostgreSQL

 REST API
 -------- 
-  **connect\_address**: IP address (or hostname) and port, to access the Patroni's REST API. It can serve as a endpoint for HTTP health checks (read below about the "listen" REST API parameter), and also for user queries (either directly or via the REST API), as well as for the health checks done by the cluster members during leader elections (for example, to determine whether the master is still running, or if there is a node which has a WAL position that is ahead of the one doing the query; etc.) The connect_address is put in the member key in DCS, making it possible to translate the member name into the address to connect to its REST API.
-  **listen**: IP address (or hostname) and port that Patroni will listen to for the REST API - to provide also the same health checks and cluster messaging between the participating nodes, as described above. to provide health-check information for HAProxy (or any other load balancer capable of doing a HTTP "OPTION" or "GET" checks)  
+-  **connect\_address**: IP address (or hostname) and port, to access the Patroni's REST API. All the members of the cluster must be able to connect to this address, so unless the Patroni setup is intended for a demo inside the localhost, this address must be a non "localhost" or loopback addres (ie: "localhost" or "127.0.0.1"). It can serve as a endpoint for HTTP health checks (read below about the "listen" REST API parameter), and also for user queries (either directly or via the REST API), as well as for the health checks done by the cluster members during leader elections (for example, to determine whether the master is still running, or if there is a node which has a WAL position that is ahead of the one doing the query; etc.) The connect_address is put in the member key in DCS, making it possible to translate the member name into the address to connect to its REST API.
+
+-  **listen**: IP address (or hostname) and port that Patroni will listen to for the REST API - to provide also the same health checks and cluster messaging between the participating nodes, as described above. to provide health-check information for HAProxy (or any other load balancer capable of doing a HTTP "OPTION" or "GET" checks).
+
 -  **Optional**:
        -  **authentication**:
            -  **username**: Basic-auth username to protect unsafe REST API endpoints.
@@ -146,6 +163,15 @@ REST API
        -  **certfile**: Specifies the file with the certificate in the PEM format. If the certfile is not specified or is left empty, the API server will work without SSL.
        -  **keyfile**: Specifies the file with the secret key in the PEM format.

+.. _patronictl_settings:
+
+CTL
+---
+-  **Optional**:
+    -  **insecure**: Allow connections to REST API without verifying SSL certs. 
+    -  **cacert**: Specifices the file with the CA_BUNDLE file or directory with certificates of trusted CAs to use while verifying REST API SSL certs.
+    -  **certfile**: Specifies the file with the certificate in the PEM format to use while verifying REST API SSL certs. If not provided patronictl will use the value provided for REST API "certfile" parameter.
+
 ZooKeeper
 ----------
 -  **hosts**: list of ZooKeeper cluster members in format: ['host1:port1', 'host2:port2', 'etc...'].
@@ -3,6 +3,109 @@
 Release notes
 =============

+Version 1.5.2
+-------------
+
+Compatibility and bugfix release.
+
+- Compatibility with kazoo-2.6.0 (Alexander Kukushkin)
+
+  In order to make sure that requests are performed with an appropriate timeout, Patroni redefines create_connection method from python-kazoo module. The last release of kazoo slightly changed the way how create_connection method is called.
+
+- Fix Patroni crash when Consul cluster loses the leader (Alexander)
+
+  The crash was happening due to incorrect implementation of touch_member method, it should return boolean and not raise any exceptions.
+
+Version 1.5.1
+-------------
+
+This version implements support of permanent replication slots, adds support of pgBackRest and fixes number of bugs.
+
+**New features**
+
+- Permanent replication slots (Alexander Kukushkin)
+
+  Permanent replication slots are preserved on failover/switchover, that is, Patroni on the new primary will create configured replication slots right after doing promote. Slots could be configured with the help of `patronictl edit-config`. The initial configuration could be also done in the :ref:`bootstrap.dcs <settings>`.
+
+- Add pgbackrest support (Yogesh Sharma)
+
+  pgBackrest can restore in existing $PGDATA folder, this allows speedy restore as files which have not changed since last backup are skipped, to support this feature new parameter `keep_data` has been introduced. See :ref:`replica creation method <custom_replica_creation>` section for additional examples.
+
+**Bug fixes**
+
+- A few bugfixes in the "standby cluster" workflow (Alexander)
+
+  Please see https://github.com/zalando/patroni/pull/823 for more details.
+
+- Fix REST API health check when cluster management is paused and DCS is not accessible (Alexander)
+
+  Regression was introduced in https://github.com/zalando/patroni/commit/90cf930036a9d5249265af15d2b787ec7517cf57
+
+Version 1.5.0
+-------------
+
+This version enables Patroni HA cluster to operate in a standby mode, introduces experimental support for running on Windows, and provides a new configuration parameter to register PostgreSQL service in Consul.
+
+**New features**
+
+- Standby cluster (Dmitry Dolgov)
+
+  One or more Patroni nodes can form a standby cluster that runs alongside the primary one (i.e. in another datacenter) and consists of standby nodes that replicate from the master in the primary cluster. All PostgreSQL nodes in the standby cluster are replicas; one of those replicas elects itself to replicate directly from the remote master, while the others replicate from it in a cascading manner. More detailed description of this feature and some configuration examples can be found at :ref:`here <standby_cluster>`.
+
+- Register Services in Consul (Pavel Kirillov, Alexander Kukushkin)
+
+  If `register_service` parameter in the consul :ref:`configuration <consul_settings>` is enabled, the node will register a service with the name `scope` and the tag `master`, `replica` or `standby-leader`.
+
+- Experimental Windows support (Pavel Golub)
+
+  From now on it is possible to run Patroni on Windows, although Windows support is brand-new and hasn't received as much real-world testing as its Linux counterpart. We welcome your feedback!
+
+**Improvements in patronictl**
+
+- Add patronictl -k/--insecure flag and support for restapi cert (Wilfried Roset)
+
+  In the past if the REST API was protected by the self-signed certificates `patronictl` would fail to verify them. There was no way to  disable that verification. It is now possible to configure `patronictl` to skip the certificate verification altogether or provide CA and client certificates in the :ref:`ctl: <patronictl_settings>` section of configuration.
+
+- Exclude members with nofailover tag from patronictl switchover/failover output (Alexander Anikin)
+
+  Previously, those members were incorrectly proposed as candidates when performing interactive switchover or failover via patronictl.
+
+**Stability improvements**
+
+- Avoid parsing non-key-value output lines of pg_controldata (Alexander Anikin)
+
+  Under certain circuimstances pg_controldata outputs lines without a colon character. That would trigger an error in Patroni code that parsed pg_controldata output, hiding the actual problem; often such lines are emitted in a warning shown by pg_controldata before the regular output, i.e. when the binary major version does not match the one of the PostgreSQL data directory.
+
+- Add member name to the error message during the leader election (Jan Mussler)
+
+  During the leader election, Patroni connects to all known members of the cluster and requests their status. Such status is written to the Patroni log and includes the name of the member. Previously, if the member was not accessible, the error message did not indicate its name, containing only the URL.
+
+- Immediately reserve the WAL position upon creation of the replication slot (Alexander Kukushkin)
+
+  Starting from 9.6, `pg_create_physical_replication_slot` function provides an additional boolean parameter `immediately_reserve`. When it is set to `false`, which is also the default, the slot doesn't reserve the WAL position until it receives the first client connection, potentially losing some segments required by the client in a time window between the slot creation and the intiial client connection.
+
+- Fix bug in strict synchronous replication (Alexander Kukushkin)
+
+  When running with `synchronous_mode_strict: true`, in some cases Patroni puts `*` into the `synchronous_standby_names`, changing the sync state for most of the replication connections to `potential`. Previously, Patroni couldn't pick a synchronous candidate under such curcuimstances, as it only considered those with the state `async`.
+
+
+Version 1.4.6
+-------------
+
+**Bug fixes and stability improvements**
+
+This release fixes a critical issue with Patroni API /master endpoint returning 200 for the non-master node. This is a
+reporting issue, no actual split-brain, but under certain circumstances clients might be directed to the read-only node.
+
+- Reset is_leader status on demote (Alexander Kukushkin, Oleksii Kliukin)
+
+  Make sure demoted cluster member stops responding with code 200 on the /master API call.
+
+- Add new "cluster_unlocked" field to the API output (Dmitry Dolgov)
+
+  This field indicates whether the cluster has the master running. It can be used when it is not possible to query any
+  other node but one of the replicas.
+
 Version 1.4.5
 -------------

@@ -234,8 +337,8 @@ In addition to using Endpoints, Patroni supports ConfigMaps. You can find more i

 - Minimize the amount of SELECT's issued by Patroni on every loop of HA cylce (Alexander Kukushkin)

-  On every iteration of HA loop Patroni needs to know recovery status and absolute wal position. From now on Patroni will run only single SELECT to get this information instead of two on the replica and three on the master. 
-  
+  On every iteration of HA loop Patroni needs to know recovery status and absolute wal position. From now on Patroni will run only single SELECT to get this information instead of two on the replica and three on the master.
+
 - Remove leader key on shutdown only when we have the lock (Ants)

  Unconditional removal was generating unnecessary and missleading exceptions.
@@ -245,7 +348,7 @@ In addition to using Endpoints, Patroni supports ConfigMaps. You can find more i
 - Add version command to patronictl (Ants)

  It will show the version of installed Patroni and versions of running Patroni instances (if the cluster name is specified).
-  
+
 - Make optional specifying cluster_name argument for some of patronictl commands (Alexander, Ants)

  It will work if patronictl is using usual Patroni configuration file with the ``scope`` defined.
@@ -253,11 +356,11 @@ In addition to using Endpoints, Patroni supports ConfigMaps. You can find more i
 - Show information about scheduled switchover and maintenance mode (Alexander)

  Before that it was possible to get this information only from Patroni logs or directly from DCS.
-  
+
 - Improve ``patronictl reinit`` (Alexander)

  Sometimes ``patronictl reinit`` refused to proceed when Patroni was busy with other actions, namely trying to start postgres. `patronictl` didn't provide any commands to cancel such long running actions and the only (dangerous) workarond was removing a data directory manually. The new implementation of `reinit` forcefully cancells other long-running actions before proceeding with reinit.
-  
+
 - Implement ``--wait`` flag in ``patronictl pause`` and ``patronictl resume`` (Alexander)

  It will make ``patronictl`` wait until the requested action is acknowledged by all nodes in the cluster.
@@ -304,7 +407,7 @@ Version 1.3.6
  After a crash that doesn't clean up postmaster.pid there could be a new process with the same pid, resulting in a false positive for is_running(), which will lead to all kinds of bad behavior.

 - Shutdown postgresql before bootstrap when we lost data directory (ainlolcat)
-  
+
  When data directory on the master is forcefully removed, postgres process can still stay alive for some time and prevent the replica created in place of that former master from starting or replicating.
  The fix makes Patroni cache the postmaster pid and its start time and let it terminate the old postmaster in case it is still running after the corresponding data directory has been removed.

@@ -374,7 +477,7 @@ Version 1.3.4
 - Pass the consul token as a header (Andrew Colin Kissa)

  Headers are now the prefered way to pass the token to the consul `API <https://www.consul.io/api/index.html#authentication>`__.
-  
+

 - Advanced configuration for Consul (Alexander Kukushkin)

@@ -65,6 +65,19 @@ for outdated backup files. Some people prefer other backup solutions, such as ``
 others, or simply roll their own scripts. In order to accommodate all those use-cases Patroni supports running custom
 scripts to clone a new replica. Those are configured in the ``postgresql`` configuration block:

+.. code:: YAML
+
+    postgresql:
+        create_replica_methods:
+            - <method name>
+        <method name>:
+            command: <command name>
+            keep_data: True
+            no_params: True
+            no_master: 1
+
+example: wal_e
+
 .. code:: YAML

    postgresql:
@@ -79,6 +92,21 @@ scripts to clone a new replica. Those are configured in the ``postgresql`` confi
        basebackup:
            max-rate: '100M'

+example: pgbackrest
+
+.. code:: YAML
+
+    postgresql:
+        create_replica_methods:
+            - pgbackrest
+            - basebackup
+        pgbackrest:
+            command: /usr/bin/pgbackrest --stanza=<scope> --delta restore
+            keep_data: True
+            no_params: True
+        basebackup:
+            max-rate: '100M'
+

 The ``create_replica_methods`` defines available replica creation methods and the order of executing them. Patroni will
 stop on the first one that returns 0. Each method should define a separate section in the configuration file, listing the command
@@ -99,6 +127,10 @@ A special ``no_master`` parameter, if defined, allows Patroni to call the replic
 running master or replicas. In that case, an empty string will be passed in a connection string. This is useful for
 restoring the formerly running cluster from the binary backup.

+A special ``keep_data`` parameter, if defined, will instuct Patroni to  not clean PGDATA folder before calling restore.
+
+A special ``no_params`` parameter, if defined, restricts passing parameters to custom command.
+
 A ``basebackup`` method is a special case: it will be used if
 ``create_replica_methods`` is empty, although it is possible
 to list it explicitly among the ``create_replica_methods`` methods. This method initializes a new replica with the
@@ -129,3 +161,37 @@ and
            - max-rate: '100M'

 If all replica creation methods fail, Patroni will try again all methods in order during the next event loop cycle.
+
+.. _standby_cluster:
+
+Standby cluster
+---------------
+
+Another available option is to run a "standby cluster", that contains only of
+standby nodes replicating from some remote master. This type of clusters has:
+
+* "standby leader", that behaves pretty much like a regular cluster leader,
+  except it replicates from a remote master.
+
+* cascade replicas, that are replicating from standby leader.
+
+Standby leader holds and updates a leader lock in DCS. If the leader lock
+expires, cascade replicas will perform an election to choose another leader
+from the standbys. For the sake of flexibility, you can specify different
+methods of creating a replica and recovery WAL records when a cluster is in the
+"standby mode", and after it was detached to function as a normal cluster.
+
+To configure such cluster you need to specify the section ``standby_cluster``
+in a patroni configuration:
+
+.. code:: YAML
+
+    bootstrap:
+        dcs:
+            standby_cluster:
+                host: 1.2.3.4
+                port: 5432
+                primary_slot_name: patroni
+
+Note, that these options will be applied only once during cluster bootstrap,
+and the only way to change them afterwards is through DCS.
@@ -1,11 +1,11 @@
 ### confd

-`confd` directory contains haproxy template files for the [confd](https://github.com/kelseyhightower/confd) -- lightweight configuration management tool
+`confd` directory contains haproxy and pgbouncer template files for the [confd](https://github.com/kelseyhightower/confd) -- lightweight configuration management tool
 You need to copy content of `confd` directory into /etcd/confd and run confd service:
 ```bash
 $ confd -prefix=/service/$PATRONI_SCOPE -backend etcd -node $PATRONI_ETCD_URL -interval=10
 ```
-It will periodically update haproxy.cfg with the actual list of Patroni nodes from `etcd` and "reload" haproxy when it is necessary.
+It will periodically update haproxy.cfg and pgbouncer.ini with the actual list of Patroni nodes from `etcd` and "reload" haproxy and pgbouncer.ini when it is necessary.


 ### startup-scripts
@@ -0,0 +1,12 @@
+[template]
+prefix = "/service/batman"
+owner = "postgres"
+mode = "0644"
+src = "pgbouncer.tmpl"
+dest = "/etc/pgbouncer/pgbouncer.ini"
+
+reload_cmd = "systemctl reload pgbouncer"
+
+keys = [
+    "/members/","/leader"
+]
@@ -0,0 +1,17 @@
+[databases]
+{{with get "/leader"}}{{$leader := .Value}}{{$leadkey := printf "/members/%s" $leader}}{{with get $leadkey}}{{$data := json .Value}}{{$hostport := base (replace (index (split $data.conn_url "/") 2) "@" "/" -1)}}{{ $host := base (index (split $hostport ":") 0)}}{{ $port := base (index (split $hostport ":") 1)}}* = host={{ $host }} port={{ $port }} pool_size=10{{end}}{{end}}
+
+[pgbouncer]
+logfile = /var/log/postgresql/pgbouncer.log
+pidfile = /var/run/postgresql/pgbouncer.pid
+listen_addr = *
+listen_port = 6432
+unix_socket_dir = /var/run/postgresql
+auth_type = trust
+auth_file = /etc/pgbouncer/userlist.txt
+auth_hba_file = /etc/pgbouncer/pg_hba.txt
+admin_users = pgbouncer
+stats_users = pgbouncer
+pool_mode = session
+max_client_conn = 100
+default_pool_size = 20
@@ -18,8 +18,14 @@ WorkingDirectory=~

 # Where to send early-startup messages from the server
 # This is normally controlled by the global default set by systemd
-# StandardOutput=syslog
+#StandardOutput=syslog

+# Pre-commands to start watchdog device
+# Uncomment if watchdog is part of your patroni setup
+#ExecStartPre=-/usr/bin/sudo /sbin/modprobe softdog
+#ExecStartPre=-/usr/bin/sudo /bin/chown postgres /dev/watchdog
+
+# Start the patroni process
 ExecStart=/bin/patroni /etc/patroni.yml

 # Send HUP to reload from patroni.yml
@@ -14,11 +14,13 @@ Feature: basic replication
    Then table foo is present on postgres2 after 20 seconds

  Scenario: check restart of sync replica
-    Given I run patronictl.py restart batman postgres2 --force
-    And "sync" key in DCS has sync_standby=postgres1 after 2 seconds
-    And I run patronictl.py restart batman postgres1 --force
-    Then I receive a response returncode 0
-    And "sync" key in DCS has sync_standby=postgres2 after 10 seconds
+    Given I shut down postgres2
+    Then "sync" key in DCS has sync_standby=postgres1 after 5 seconds
+    When I start postgres2
+    And I shut down postgres1
+    Then "sync" key in DCS has sync_standby=postgres2 after 10 seconds
+    When I start postgres1
+    And "members/postgres1" key in DCS has state=running after 10 seconds
    And I sleep for 2 seconds
    When I issue a GET request to http://127.0.0.1:8010/sync
    Then I receive a response code 200
@@ -30,7 +32,7 @@ Feature: basic replication
    Then I receive a response returncode 0
    When I sleep for 2 seconds
    And I shut down postgres0
-    And I run patronictl.py resume batman 
+    And I run patronictl.py resume batman
    Then I receive a response returncode 0
    And postgres2 role is the primary after 24 seconds
    When I issue a PATCH request to http://127.0.0.1:8010/config with {"synchronous_mode": null, "master_start_timeout": 0}
@@ -0,0 +1,5 @@
+#!/bin/bash
+
+[[ "$3" == "master" ]] || exit
+
+PGPASSWORD=zalando psql -h localhost -U postgres -p $1 -w -tAc "SELECT slot_name FROM pg_replication_slots WHERE slot_type = 'logical'" >> data/postgres0/label
@@ -182,6 +182,9 @@ class PatroniController(AbstractController):
                        dst[k] = v
            recursive_update(config, custom_config)

+        if config['postgresql'].get('callbacks', {}).get('on_role_change'):
+            config['postgresql']['callbacks']['on_role_change'] += ' ' + str(self.__PORT)
+
        with open(patroni_config_path, 'w') as f:
            yaml.safe_dump(config, f, default_flow_style=False)

@@ -71,6 +71,14 @@ Scenario: check the switchover via the API in the pause mode
 	And postgres1 role is the primary after 10 seconds
 	And postgres0 role is the secondary after 10 seconds
 	And replication works from postgres1 to postgres0 after 20 seconds
+	When I issue a GET request to http://127.0.0.1:8008/master
+	Then I receive a response code 503
+	When I issue a GET request to http://127.0.0.1:8008/replica
+	Then I receive a response code 200
+	When I issue a GET request to http://127.0.0.1:8009/master
+	Then I receive a response code 200
+	When I issue a GET request to http://127.0.0.1:8009/replica
+	Then I receive a response code 503

 Scenario: check the scheduled switchover
 	Given I issue a scheduled switchover from postgres1 to postgres0 in 3 seconds
@@ -84,6 +92,14 @@ Scenario: check the scheduled switchover
 	And postgres0 role is the primary after 10 seconds
 	And postgres1 role is the secondary after 10 seconds
 	And replication works from postgres0 to postgres1 after 25 seconds
+	When I issue a GET request to http://127.0.0.1:8008/master
+	Then I receive a response code 200
+	When I issue a GET request to http://127.0.0.1:8008/replica
+	Then I receive a response code 503
+	When I issue a GET request to http://127.0.0.1:8009/master
+	Then I receive a response code 503
+	When I issue a GET request to http://127.0.0.1:8009/replica
+	Then I receive a response code 200

 Scenario: check the scheduled restart
 	Given I issue a PATCH request to http://127.0.0.1:8008/config with {"postgresql": {"parameters": {"superuser_reserved_connections": "6"}}}
@@ -0,0 +1,33 @@
+Feature: standby cluster
+  Scenario: check permanent logical slots are preserved on failover/switchover
+    Given I start postgres1
+    Then postgres1 is a leader after 10 seconds
+    And I sleep for 2 seconds
+    When I issue a PATCH request to http://127.0.0.1:8009/config with {"slots": {"pm_1": {"type": "physical"}}, "postgresql": {"parameters": {"wal_level": "logical"}}}
+    Then I receive a response code 200
+    And Response on GET http://127.0.0.1:8009/config contains slots after 10 seconds
+    When I issue a PATCH request to http://127.0.0.1:8009/config with {"slots": {"test_logical": {"type": "logical", "database": "postgres", "plugin": "test_decoding"}}}
+    Then I receive a response code 200
+    When I start postgres0 with callback configured
+    Then "members/postgres0" key in DCS has state=running after 10 seconds
+    When I shut down postgres1
+    Then postgres0 is a leader after 10 seconds
+    And I sleep for 2 seconds
+    When I issue a GET request to http://127.0.0.1:8008/
+    Then I receive a response code 200
+    And there is a label with "test_logical" in postgres0 data directory
+
+  Scenario: check replication of a single table in a standby cluster
+    Given I start postgres1 in a standby cluster batman1 as a clone of postgres0
+    Then postgres1 is a leader of batman1 after 10 seconds
+    When I issue a PATCH request to http://127.0.0.1:8009/config with {"ttl": 20, "loop_wait": 2}
+    And I add the table foo to postgres0
+    Then table foo is present on postgres1 after 20 seconds
+    When I start postgres2 in a cluster batman1
+    Then postgres2 role is the replica after 24 seconds
+    And table foo is present on postgres2 after 20 seconds
+
+  Scenario: check failover
+    When I kill postgres1
+    And I kill postmaster on postgres1
+    Then postgres2 is replicating from postgres0 after 20 seconds
@@ -0,0 +1,68 @@
+import os
+import time
+
+from behave import step
+
+
+select_replication_query = """
+SELECT * FROM pg_catalog.pg_stat_replication
+WHERE application_name = '{0}'
+"""
+
+
+@step('I start {name:w} with callback configured')
+def start_patroni_with_callbacks(context, name):
+    return context.pctl.start(name, custom_config={
+        "postgresql": {
+            "callbacks": {
+                "on_role_change": "features/callback.sh"
+            }
+        }
+    })
+
+
+@step('I start {name:w} in a cluster {cluster_name:w}')
+def start_patroni(context, name, cluster_name):
+    return context.pctl.start(name, custom_config={
+        "scope": cluster_name
+    })
+
+
+@step('I start {name:w} in a standby cluster {cluster_name:w} as a clone of {name2:w}')
+def start_patroni_stanby_cluster(context, name, cluster_name, name2):
+    ctl = context.pctl._processes.pop(name, None)
+    # we need to remove patroni.dynamic.json in order to "bootstrap" standby cluster with existing PGDATA
+    if ctl:
+        os.unlink(os.path.join(ctl._data_dir, 'patroni.dynamic.json'))
+    port = context.pctl._processes[name2]._connkwargs.get('port')
+    return context.pctl.start(name, custom_config={
+        "scope": cluster_name,
+        "bootstrap": {
+            "dcs": {
+                "standby_cluster": {
+                    "host": "localhost",
+                    "port": port,
+                    "primary_slot_name": "pm_1",
+                }
+            }
+        }
+    })
+
+
+@step('{pg_name1:w} is replicating from {pg_name2:w} after {timeout:d} seconds')
+def check_replication_status(context, pg_name1, pg_name2, timeout):
+    bound_time = time.time() + timeout
+
+    while time.time() < bound_time:
+        cur = context.pctl.query(
+            pg_name2,
+            select_replication_query.format(pg_name1),
+            fail_ok=True
+        )
+
+        if cur and len(cur.fetchall()) != 0:
+            return True
+
+        time.sleep(1)
+
+    return False
@@ -1,32 +1,39 @@
-FROM postgres:9.6
+FROM postgres:10
 MAINTAINER Alexander Kukushkin <[email protected]>

 RUN export DEBIAN_FRONTEND=noninteractive \
    && echo 'APT::Install-Recommends "0";\nAPT::Install-Suggests "0";' > /etc/apt/apt.conf.d/01norecommend \
    && apt-get update -y \
    && apt-get upgrade -y \
-    && apt-get install -y git curl jq python-psycopg2 python-yaml python-requests python-six python-pysocks \
-        python-dateutil python-pip python-prettytable python-wheel python-psutil python locales \
+    && apt-cache depends patroni | sed -n -e 's/.* Depends: \(python3-.\+\)$/\1/p' \
+            | grep -Ev '^python3-(sphinx|etcd|consul|kazoo|kubernetes)' \
+            | xargs apt-get install -y curl jq locales git python3-pip python3-wheel \

    ## Make sure we have a en_US.UTF-8 locale available
    && localedef -i en_US -c -f UTF-8 -A /usr/share/locale/locale.alias en_US.UTF-8 \

-    && pip install setuptools pip --upgrade \
-    && pip install 'git+https://github.com/zalando/patroni.git#egg=patroni[kubernetes]' \
+    && pip3 install setuptools \
+    && pip3 install 'git+https://github.com/zalando/patroni.git#egg=patroni[kubernetes]' \

-    && mkdir -p /home/postgres \
-    && chown postgres:postgres /home/postgres \
+    && PGHOME=/home/postgres \
+    && mkdir -p $PGHOME \
+    && chown postgres $PGHOME \
+    && sed -i "s|/var/lib/postgresql.*|$PGHOME:/bin/bash|" /etc/passwd \
+
+    # Set permissions for OpenShift
+    && chmod 775 $PGHOME \
+    && chmod 664 /etc/passwd \

    # Clean up
-    && apt-get remove -y git python-pip python-setuptools \
+    && apt-get remove -y git python3-pip python3-wheel \
    && apt-get autoremove -y \
    && apt-get clean -y \
    && rm -rf /var/lib/apt/lists/* /root/.cache

-ADD entrypoint.sh callback.py /
+ADD entrypoint.sh /

 EXPOSE 5432 8008
 ENV LC_ALL=en_US.UTF-8 LANG=en_US.UTF-8
 USER postgres
 WORKDIR /home/postgres
-CMD ["/bin/bash", "/entrypoint.sh"]
+CMD ["/bin/bash", "/entrypoint.sh"]
@@ -1,62 +0,0 @@
-#!/usr/bin/env python
-
-import logging
-import os
-import socket
-import sys
-import time
-
-from kubernetes import client as k8s_client, config as k8s_config
-from urllib3.exceptions import HTTPError
-from six.moves.http_client import HTTPException
-
-logger = logging.getLogger(__name__)
-
-
-class CoreV1Api(k8s_client.CoreV1Api):
-
-    def retry(func):
-        def wrapped(*args, **kwargs):
-            count = 0
-            while True:
-                try:
-                    return func(*args, **kwargs)
-                except (HTTPException, HTTPError, socket.error, socket.timeout):
-                    if count >= 10:
-                        raise
-                    logger.info('Throttling API requests...')
-                    time.sleep(2 ** count * 0.5)
-                    count += 1
-        return wrapped
-
-    @retry
-    def patch_namespaced_endpoints(self, *args, **kwargs):
-        return super(CoreV1Api, self).patch_namespaced_endpoints(*args, **kwargs)
-
-
-def patch_master_endpoint(api, namespace, cluster):
-    addresses = [k8s_client.V1EndpointAddress(ip=os.environ['POD_IP'])]
-    ports = [k8s_client.V1EndpointPort(port=5432)]
-    subsets = [k8s_client.V1EndpointSubset(addresses=addresses, ports=ports)]
-    body = k8s_client.V1Endpoints(subsets=subsets)
-    return api.patch_namespaced_endpoints(cluster, namespace, body)
-
-
-def main():
-    logging.basicConfig(format='%(asctime)s %(levelname)s: %(message)s', level=logging.INFO)
-    if len(sys.argv) != 4 or sys.argv[1] not in ('on_start', 'on_stop', 'on_role_change'):
-        sys.exit('Usage: %s <action> <role> <cluster_name>', sys.argv[0])
-
-    action, role, cluster = sys.argv[1:4]
-
-    k8s_config.load_incluster_config()
-    k8s_api = CoreV1Api()
-
-    namespace = os.environ['KUBERNETES_NAMESPACE']
-
-    if role == 'master' and action in ('on_start', 'on_role_change'):
-        patch_master_endpoint(k8s_api, namespace, cluster)
-
-
-if __name__ == '__main__':
-    main()
@@ -1,5 +1,12 @@
 #!/bin/bash

+if [[ $UID -ge 10000 ]]; then
+    GID=$(id -g)
+    sed -e "s/^postgres:x:[^:]*:[^:]*:/postgres:x:$UID:$GID:/" /etc/passwd > /tmp/passwd
+    cat /tmp/passwd > /etc/passwd
+    rm /tmp/passwd
+fi
+
 cat > /home/postgres/patroni.yml <<__EOF__
 bootstrap:
  dcs:
@@ -23,14 +30,10 @@ postgresql:
      password: '${PATRONI_SUPERUSER_PASSWORD}'
    replication:
      password: '${PATRONI_REPLICATION_PASSWORD}'
-  callbacks:
-    on_start: /callback.py
-    on_stop: /callback.py
-    on_role_change: /callback.py
 __EOF__

 unset PATRONI_SUPERUSER_PASSWORD PATRONI_REPLICATION_PASSWORD
 export KUBERNETES_NAMESPACE=$PATRONI_KUBERNETES_NAMESPACE
 export POD_NAME=$PATRONI_NAME

-exec /usr/bin/python /usr/local/bin/patroni /home/postgres/patroni.yml
+exec /usr/bin/python3 /usr/local/bin/patroni /home/postgres/patroni.yml
@@ -0,0 +1,49 @@
+# Patroni OpenShift Configuration
+Patroni can be run in OpenShift. Based on the kubernetes configuration, the Dockerfile and Entrypoint has been modified to support the dynamic UID/GID configuration that is applied in OpenShift. This can be run under the standard `restricted` SCC. 
+
+# Examples
+
+## Create test project
+
+```
+oc new-project patroni-test
+```
+
+## Build the image
+
+Note: Update the references when merged upstream. 
+Note: If deploying as a template for multiple users, the following commands should be performed in a shared namespace like `openshift`. 
+
+```
+oc import-image postgres:10 --confirm -n openshift
+oc new-build https://github.com/zalando/patroni --context-dir=kubernetes -n openshift
+```
+
+## Deploy the Image 
+Two configuration templates exist in [templates](templates) directory: 
+- Patroni Ephemeral
+- Patroni Persistent
+
+The only difference is whether or not the statefulset requests persistent storage. 
+
+## Create the Template
+Install the template into the `openshift` namespace if this should be shared across projects: 
+
+```
+oc create -f templates/template_patroni_ephemeral.yml -n openshift
+```
+
+Then, from your own project: 
+
+```
+oc new-app patroni-pgsql-ephemeral
+```
+
+Once the pods are running, two configmaps should be available: 
+
+```
+$ oc get configmap
+NAME                DATA      AGE
+patroniocp-config   0         1m
+patroniocp-leader   0         1m
+```
@@ -0,0 +1,287 @@
+apiVersion: v1
+kind: Template
+metadata:
+  name: patroni-pgsql-ephemeral
+  annotations:
+    description: |-
+      Patroni Postgresql database cluster, without persistent storage.
+
+      WARNING: Any data stored will be lost upon pod destruction. Only use this template for testing.
+    iconClass: icon-postgresql
+    openshift.io/display-name: Patroni Postgresql (Ephemeral)
+    openshift.io/long-description: This template deploys a a patroni postgresql HA cluster without persistent storage.
+    tags: postgresql
+objects:
+- apiVersion: v1
+  kind: Service
+  metadata:
+    creationTimestamp: null
+    labels:
+      application: ${APPLICATION_NAME}
+      cluster-name: ${PATRONI_CLUSTER_NAME}
+    name: ${PATRONI_CLUSTER_NAME}
+  spec:
+    ports:
+    - port: 5432
+      protocol: TCP
+      targetPort: 5432
+    sessionAffinity: None
+    type: ClusterIP
+  status:
+    loadBalancer: {}
+- apiVersion: v1
+  kind: Service
+  metadata:
+    creationTimestamp: null
+    labels:
+      application: ${APPLICATION_NAME}
+      cluster-name: ${PATRONI_CLUSTER_NAME}
+    name: ${PATRONI_MASTER_SERVICE_NAME}
+  spec:
+    ports:
+    - port: 5432
+      protocol: TCP
+      targetPort: 5432
+    selector:
+      application: ${APPLICATION_NAME}
+      cluster-name: ${PATRONI_CLUSTER_NAME}
+      role: master
+    sessionAffinity: None
+    type: ClusterIP
+  status:
+    loadBalancer: {}
+- apiVersion: v1
+  kind: Secret
+  metadata:
+    name: ${PATRONI_CLUSTER_NAME}
+    labels:
+      application: ${APPLICATION_NAME}
+      cluster-name: ${PATRONI_CLUSTER_NAME}
+  stringData:
+    superuser-password: ${PATRONI_SUPERUSER_PASSWORD}
+    replication-password: ${PATRONI_REPLICATION_PASSWORD}
+- apiVersion: v1
+  kind: Service
+  metadata:
+    creationTimestamp: null
+    labels:
+      application: ${APPLICATION_NAME}
+      cluster-name: ${PATRONI_CLUSTER_NAME}
+    name: ${PATRONI_REPLICA_SERVICE_NAME}
+  spec:
+    ports:
+    - port: 5432
+      protocol: TCP
+      targetPort: 5432
+    selector:
+      application: ${APPLICATION_NAME}
+      cluster-name: ${PATRONI_CLUSTER_NAME}
+      role: replica
+    sessionAffinity: None
+    type: ClusterIP
+  status:
+    loadBalancer: {}
+- apiVersion: apps/v1
+  kind: StatefulSet
+  metadata:
+    creationTimestamp: null
+    generation: 3
+    labels:
+      application: ${APPLICATION_NAME}
+      cluster-name: ${PATRONI_CLUSTER_NAME}
+    name: ${APPLICATION_NAME}
+  spec:
+    podManagementPolicy: OrderedReady
+    replicas: 3
+    revisionHistoryLimit: 10
+    selector:
+      matchLabels:
+        application: ${APPLICATION_NAME}
+        cluster-name: ${PATRONI_CLUSTER_NAME}
+    serviceName: ${APPLICATION_NAME}
+    template:
+      metadata:
+        creationTimestamp: null
+        labels:
+          application: ${APPLICATION_NAME}
+          cluster-name: ${PATRONI_CLUSTER_NAME}
+      spec:
+        containers:
+        - env:
+          - name: POD_IP
+            valueFrom:
+              fieldRef:
+                apiVersion: v1
+                fieldPath: status.podIP
+          - name: PATRONI_KUBERNETES_NAMESPACE
+            valueFrom:
+              fieldRef:
+                apiVersion: v1
+                fieldPath: metadata.namespace
+          - name: PATRONI_KUBERNETES_LABELS
+            value: '{application: ${APPLICATION_NAME}, cluster-name: ${PATRONI_CLUSTER_NAME}}'
+          - name: PATRONI_SUPERUSER_USERNAME
+            value: ${PATRONI_SUPERUSER_USERNAME}
+          - name: PATRONI_SUPERUSER_PASSWORD
+            valueFrom:
+              secretKeyRef:
+                key: superuser-password
+                name: ${PATRONI_CLUSTER_NAME}
+          - name: PATRONI_REPLICATION_USERNAME
+            value: ${PATRONI_REPLICATION_USERNAME}
+          - name: PATRONI_REPLICATION_PASSWORD
+            valueFrom:
+              secretKeyRef:
+                key: replication-password
+                name: ${PATRONI_CLUSTER_NAME}
+          - name: PATRONI_SCOPE
+            value: ${PATRONI_CLUSTER_NAME}
+          - name: PATRONI_NAME
+            valueFrom:
+              fieldRef:
+                apiVersion: v1
+                fieldPath: metadata.name
+          - name: PATRONI_POSTGRESQL_DATA_DIR
+            value: /home/postgres/pgdata/pgroot/data
+          - name: PATRONI_POSTGRESQL_PGPASS
+            value: /tmp/pgpass
+          - name: PATRONI_POSTGRESQL_LISTEN
+            value: 0.0.0.0:5432
+          - name: PATRONI_RESTAPI_LISTEN
+            value: 0.0.0.0:8008
+          image: docker-registry.default.svc:5000/${NAMESPACE}/patroni:latest
+          imagePullPolicy: IfNotPresent
+          name: ${APPLICATION_NAME}
+          ports:
+          - containerPort: 8008
+            protocol: TCP
+          - containerPort: 5432
+            protocol: TCP
+          resources: {}
+          terminationMessagePath: /dev/termination-log
+          terminationMessagePolicy: File
+          volumeMounts:
+          - mountPath: /home/postgres/pgdata
+            name: pgdata
+        dnsPolicy: ClusterFirst
+        restartPolicy: Always
+        schedulerName: default-scheduler
+        securityContext: {}
+        serviceAccount: ${SERVICE_ACCOUNT}
+        serviceAccountName: ${SERVICE_ACCOUNT}
+        terminationGracePeriodSeconds: 0
+        volumes:
+        - name: pgdata
+          emptyDir: {}
+    updateStrategy:
+      type: OnDelete
+- apiVersion: v1
+  kind: Endpoints
+  metadata:
+    name: ${APPLICATION_NAME}
+    labels:
+      application: ${APPLICATION_NAME}
+      cluster-name: ${PATRONI_CLUSTER_NAME}
+  subsets: []
+- apiVersion: v1
+  kind: ServiceAccount
+  metadata:
+    name: ${SERVICE_ACCOUNT}
+- apiVersion: rbac.authorization.k8s.io/v1
+  kind: Role
+  metadata:
+    name: ${SERVICE_ACCOUNT}
+  rules:
+  - apiGroups:
+    - ""
+    resources:
+    - configmaps
+    verbs:
+    - create
+    - get
+    - list
+    - patch
+    - update
+    - watch
+    # delete is required only for 'patronictl remove'
+    - delete
+  - apiGroups:
+    - ""
+    resources:
+    - endpoints
+    verbs:
+    - get
+    - patch
+    - update
+    # the following three privileges are necessary only when using endpoints
+    - create
+    - list
+    - watch
+    # delete is required only for for 'patronictl remove'
+    - delete
+  - apiGroups:
+    - ""
+    resources:
+    - pods
+    verbs:
+    - get
+    - list
+    - patch
+    - update
+    - watch
+- apiVersion: rbac.authorization.k8s.io/v1
+  kind: RoleBinding
+  metadata:
+    name: ${SERVICE_ACCOUNT}
+  roleRef:
+    apiGroup: rbac.authorization.k8s.io
+    kind: Role
+    name: ${SERVICE_ACCOUNT}
+  subjects:
+  - kind: ServiceAccount
+    name: ${SERVICE_ACCOUNT}
+parameters:
+- description: The name of the application for labelling all artifacts.
+  displayName: Application Name
+  name: APPLICATION_NAME
+  value: patroni-ephemeral
+- description: The name of the patroni-pgsql cluster.
+  displayName: Cluster Name
+  name: PATRONI_CLUSTER_NAME
+  value: patroni-ephemeral
+- description: The name of the OpenShift Service exposed for the patroni-ephemeral-master container.
+  displayName: Master service name.  
+  name: PATRONI_MASTER_SERVICE_NAME
+  value: patroni-ephemeral-master
+- description: The name of the OpenShift Service exposed for the patroni-ephemeral-replica containers.
+  displayName: Replica service name. 
+  name: PATRONI_REPLICA_SERVICE_NAME
+  value: patroni-ephemeral-replica
+- description: Maximum amount of memory the container can use.
+  displayName: Memory Limit
+  name: MEMORY_LIMIT
+  value: 512Mi
+- description: The OpenShift Namespace where the patroni and postgresql ImageStream resides.
+  displayName: ImageStream Namespace
+  name: NAMESPACE
+  value: openshift
+- description: Username of the superuser account for initialization.
+  displayName: Superuser Username
+  name: PATRONI_SUPERUSER_USERNAME
+  value: postgres
+- description: Password of the superuser account for initialization.
+  displayName: Superuser Passsword
+  name: PATRONI_SUPERUSER_PASSWORD
+  value: postgres
+- description: Username of the replication account for initialization.
+  displayName: Replication Username
+  name: PATRONI_REPLICATION_USERNAME
+  value: postgres
+- description: Password of the replication account for initialization.
+  displayName: Repication Passsword
+  name: PATRONI_REPLICATION_PASSWORD
+  value: postgres
+- description: Service account name used for pods and rolebindings to form a cluster in the project. 
+  displayName: Service Account
+  name: SERVICE_ACCOUNT
+  value: patroniocp
@@ -0,0 +1,303 @@
+apiVersion: v1
+kind: Template
+metadata:
+  name: patroni-pgsql-persistent
+  annotations:
+    description: |-
+      Patroni Postgresql database cluster, with persistent storage.
+
+      WARNING: Any data stored will be lost upon pod destruction. Only use this template for testing.
+    iconClass: icon-postgresql
+    openshift.io/display-name: Patroni Postgresql (Persistent)
+    openshift.io/long-description: This template deploys a a patroni postgresql HA cluster without persistent storage.
+    tags: postgresql
+objects:
+- apiVersion: v1
+  kind: Service
+  metadata:
+    creationTimestamp: null
+    labels:
+      application: ${APPLICATION_NAME}
+      cluster-name: ${PATRONI_CLUSTER_NAME}
+    name: ${PATRONI_CLUSTER_NAME}
+  spec:
+    ports:
+    - port: 5432
+      protocol: TCP
+      targetPort: 5432
+    sessionAffinity: None
+    type: ClusterIP
+  status:
+    loadBalancer: {}
+- apiVersion: v1
+  kind: Service
+  metadata:
+    creationTimestamp: null
+    labels:
+      application: ${APPLICATION_NAME}
+      cluster-name: ${PATRONI_CLUSTER_NAME}
+    name: ${PATRONI_MASTER_SERVICE_NAME}
+  spec:
+    ports:
+    - port: 5432
+      protocol: TCP
+      targetPort: 5432
+    selector:
+      application: ${APPLICATION_NAME}
+      cluster-name: ${PATRONI_CLUSTER_NAME}
+      role: master
+    sessionAffinity: None
+    type: ClusterIP
+  status:
+    loadBalancer: {}
+- apiVersion: v1
+  kind: Secret
+  metadata:
+    name: ${PATRONI_CLUSTER_NAME}
+    labels:
+      application: ${APPLICATION_NAME}
+      cluster-name: ${PATRONI_CLUSTER_NAME}
+  stringData:
+    superuser-password: ${PATRONI_SUPERUSER_PASSWORD}
+    replication-password: ${PATRONI_REPLICATION_PASSWORD}
+- apiVersion: v1
+  kind: Service
+  metadata:
+    creationTimestamp: null
+    labels:
+      application: ${APPLICATION_NAME}
+      cluster-name: ${PATRONI_CLUSTER_NAME}
+    name: ${PATRONI_REPLICA_SERVICE_NAME}
+  spec:
+    ports:
+    - port: 5432
+      protocol: TCP
+      targetPort: 5432
+    selector:
+      application: ${APPLICATION_NAME}
+      cluster-name: ${PATRONI_CLUSTER_NAME}
+      role: replica
+    sessionAffinity: None
+    type: ClusterIP
+  status:
+    loadBalancer: {}
+- apiVersion: apps/v1
+  kind: StatefulSet
+  metadata:
+    creationTimestamp: null
+    generation: 3
+    labels:
+      application: ${APPLICATION_NAME}
+      cluster-name: ${PATRONI_CLUSTER_NAME}
+    name: ${APPLICATION_NAME}
+  spec:
+    podManagementPolicy: OrderedReady
+    replicas: 3
+    revisionHistoryLimit: 10
+    selector:
+      matchLabels:
+        application: ${APPLICATION_NAME}
+        cluster-name: ${PATRONI_CLUSTER_NAME}
+    serviceName: ${APPLICATION_NAME}
+    template:
+      metadata:
+        creationTimestamp: null
+        labels:
+          application: ${APPLICATION_NAME}
+          cluster-name: ${PATRONI_CLUSTER_NAME}
+      spec:
+        containers:
+        - env:
+          - name: POD_IP
+            valueFrom:
+              fieldRef:
+                apiVersion: v1
+                fieldPath: status.podIP
+          - name: PATRONI_KUBERNETES_NAMESPACE
+            valueFrom:
+              fieldRef:
+                apiVersion: v1
+                fieldPath: metadata.namespace
+          - name: PATRONI_KUBERNETES_LABELS
+            value: '{application: ${APPLICATION_NAME}, cluster-name: ${PATRONI_CLUSTER_NAME}}'
+          - name: PATRONI_SUPERUSER_USERNAME
+            value: ${PATRONI_SUPERUSER_USERNAME}
+          - name: PATRONI_SUPERUSER_PASSWORD
+            valueFrom:
+              secretKeyRef:
+                key: superuser-password
+                name: ${PATRONI_CLUSTER_NAME}
+          - name: PATRONI_REPLICATION_USERNAME
+            value: ${PATRONI_REPLICATION_USERNAME}
+          - name: PATRONI_REPLICATION_PASSWORD
+            valueFrom:
+              secretKeyRef:
+                key: replication-password
+                name: ${PATRONI_CLUSTER_NAME}
+          - name: PATRONI_SCOPE
+            value: ${PATRONI_CLUSTER_NAME}
+          - name: PATRONI_NAME
+            valueFrom:
+              fieldRef:
+                apiVersion: v1
+                fieldPath: metadata.name
+          - name: PATRONI_POSTGRESQL_DATA_DIR
+            value: /home/postgres/pgdata/pgroot/data
+          - name: PATRONI_POSTGRESQL_PGPASS
+            value: /tmp/pgpass
+          - name: PATRONI_POSTGRESQL_LISTEN
+            value: 0.0.0.0:5432
+          - name: PATRONI_RESTAPI_LISTEN
+            value: 0.0.0.0:8008
+          image: docker-registry.default.svc:5000/${NAMESPACE}/patroni:latest
+          imagePullPolicy: IfNotPresent
+          name: ${APPLICATION_NAME}
+          ports:
+          - containerPort: 8008
+            protocol: TCP
+          - containerPort: 5432
+            protocol: TCP
+          resources: {}
+          terminationMessagePath: /dev/termination-log
+          terminationMessagePolicy: File
+          volumeMounts:
+          - mountPath: /home/postgres/pgdata
+            name: ${APPLICATION_NAME}
+        dnsPolicy: ClusterFirst
+        restartPolicy: Always
+        schedulerName: default-scheduler
+        securityContext: {}
+        serviceAccount: ${SERVICE_ACCOUNT}
+        serviceAccountName: ${SERVICE_ACCOUNT}
+        terminationGracePeriodSeconds: 0
+        volumes:
+        - name: ${APPLICATION_NAME}
+          persistentVolumeClaim: 
+            claimName: ${APPLICATION_NAME}
+    volumeClaimTemplates:
+    - metadata:
+        labels:
+          application: ${APPLICATION_NAME}
+        name: ${APPLICATION_NAME}
+      spec:
+        accessModes:
+        - ReadWriteOnce
+        resources:
+          requests:
+            storage: ${PVC_SIZE}
+    updateStrategy:
+      type: OnDelete
+- apiVersion: v1
+  kind: Endpoints
+  metadata:
+    name: ${APPLICATION_NAME}
+    labels:
+      application: ${APPLICATION_NAME}
+      cluster-name: ${PATRONI_CLUSTER_NAME}
+  subsets: []
+- apiVersion: v1
+  kind: ServiceAccount
+  metadata:
+    name: ${SERVICE_ACCOUNT}
+- apiVersion: rbac.authorization.k8s.io/v1
+  kind: Role
+  metadata:
+    name: ${SERVICE_ACCOUNT}
+  rules:
+  - apiGroups:
+    - ""
+    resources:
+    - configmaps
+    verbs:
+    - create
+    - get
+    - list
+    - patch
+    - update
+    - watch
+    # delete is required only for 'patronictl remove'
+    - delete
+  - apiGroups:
+    - ""
+    resources:
+    - endpoints
+    verbs:
+    - get
+    - patch
+    - update
+    # the following three privileges are necessary only when using endpoints
+    - create
+    - list
+    - watch
+    # delete is required only for for 'patronictl remove'
+    - delete
+  - apiGroups:
+    - ""
+    resources:
+    - pods
+    verbs:
+    - get
+    - list
+    - patch
+    - update
+    - watch
+- apiVersion: rbac.authorization.k8s.io/v1
+  kind: RoleBinding
+  metadata:
+    name: ${SERVICE_ACCOUNT}
+  roleRef:
+    apiGroup: rbac.authorization.k8s.io
+    kind: Role
+    name: ${SERVICE_ACCOUNT}
+  subjects:
+  - kind: ServiceAccount
+    name: ${SERVICE_ACCOUNT}
+parameters:
+- description: The name of the application for labelling all artifacts.
+  displayName: Application Name
+  name: APPLICATION_NAME
+  value: patroni-persistent
+- description: The name of the patroni-pgsql cluster.
+  displayName: Cluster Name
+  name: PATRONI_CLUSTER_NAME
+  value: patroni-persistent
+- description: The name of the OpenShift Service exposed for the patroni-persistent-master container.
+  displayName: Master service name.  
+  name: PATRONI_MASTER_SERVICE_NAME
+  value: patroni-persistent-master
+- description: The name of the OpenShift Service exposed for the patroni-persistent-replica containers.
+  displayName: Replica service name. 
+  name: PATRONI_REPLICA_SERVICE_NAME
+  value: patroni-persistent-replica
+- description: Maximum amount of memory the container can use.
+  displayName: Memory Limit
+  name: MEMORY_LIMIT
+  value: 512Mi
+- description: The OpenShift Namespace where the patroni and postgresql ImageStream resides.
+  displayName: ImageStream Namespace
+  name: NAMESPACE
+  value: openshift
+- description: Username of the superuser account for initialization.
+  displayName: Superuser Username
+  name: PATRONI_SUPERUSER_USERNAME
+  value: postgres
+- description: Password of the superuser account for initialization.
+  displayName: Superuser Passsword
+  name: PATRONI_SUPERUSER_PASSWORD
+  value: postgres
+- description: Username of the replication account for initialization.
+  displayName: Replication Username
+  name: PATRONI_REPLICATION_USERNAME
+  value: postgres
+- description: Password of the replication account for initialization.
+  displayName: Repication Passsword
+  name: PATRONI_REPLICATION_PASSWORD
+  value: postgres
+- description: Service account name used for pods and rolebindings to form a cluster in the project. 
+  displayName: Service Account
+  name: SERVICE_ACCOUNT
+  value: patroni-persistent
+- description: The size of the persistent volume to create. 
+  displayName: Persistent Volume Size
+  name: PVC_SIZE
+  value: 5Gi
@@ -0,0 +1,43 @@
+pipeline {
+  agent any
+  stages {
+    stage ('Deploy test pod'){
+      when {
+          expression {
+            openshift.withCluster() {
+              openshift.withProject() {
+                return !openshift.selector( "dc", "pgbench" ).exists()
+              }
+            }
+          }
+        }
+      steps {
+        script {
+            openshift.withCluster() {
+                openshift.withProject() {
+                  def pgbench = openshift.newApp( "https://github.com/stewartshea/docker-pgbench/", "--name=pgbench", "-e PGPASSWORD=postgres", "-e PGUSER=postgres", "-e PGHOST=patroni-persistent-master", "-e PGDATABASE=postgres", "-e TEST_CLIENT_COUNT=20", "-e TEST_DURATION=120" )
+                  def pgbenchdc = openshift.selector( "dc", "pgbench" )
+                  timeout(5) { 
+                    pgbenchdc.rollout().status()
+                    }
+                  }
+                }
+            }
+        }
+    }
+    stage ('Run benchmark Test'){
+      steps {
+          sh '''
+          oc exec $(oc get pods -l app=pgbench | grep Running | awk '{print $1}')  ./test.sh
+          '''
+      }
+    }
+    stage ('Clean up pgtest pod'){
+      steps {
+          sh '''
+          oc delete all -l app=pgbench
+          '''
+      }
+    }
+  }
+}
@@ -0,0 +1,2 @@
+# Jenkins Test
+This pipeline test will create a separate deployment config for a pgbench pod and execute a test against the patroni cluster. This is a sample and should be customized. 
@@ -36,6 +36,8 @@ spec:
          valueFrom:
            fieldRef:
              fieldPath: metadata.namespace
+        - name: PATRONI_KUBERNETES_USE_ENDPOINTS
+          value: 'true'
        - name: PATRONI_KUBERNETES_LABELS
          value: '{application: patroni, cluster-name: patronidemo}'
        - name: PATRONI_SUPERUSER_USERNAME
@@ -125,7 +125,8 @@ class Patroni(object):
    def setup_signal_handlers(self):
        self._received_sighup = False
        self._received_sigterm = False
-        signal.signal(signal.SIGHUP, self.sighup_handler)
+        if os.name != 'nt':
+            signal.signal(signal.SIGHUP, self.sighup_handler)
        signal.signal(signal.SIGTERM, self.sigterm_handler)

    def shutdown(self):
@@ -154,6 +155,8 @@ def patroni_main():

 def pg_ctl_start(args):
    import subprocess
+    if os.name != 'nt':
+        os.setsid()
    postmaster = subprocess.Popen(args)
    print(postmaster.pid)

@@ -188,7 +191,7 @@ def main():
                if ret == (0, 0):
                    break
                elif ret[0] != pid:
-                    logging.info('Reaped pid=%s, exit status=%s', *ret)
+                    logger.info('Reaped pid=%s, exit status=%s', *ret)
        except OSError:
            pass

@@ -197,11 +200,13 @@ def main():
            os.kill(pid, signo)

    signal.signal(signal.SIGCHLD, sigchld_handler)
-    signal.signal(signal.SIGHUP, passtochild)
+    if os.name != 'nt':
+        signal.signal(signal.SIGHUP, passtochild)
+        signal.signal(signal.SIGQUIT, passtochild)
    signal.signal(signal.SIGINT, passtochild)
    signal.signal(signal.SIGUSR1, passtochild)
    signal.signal(signal.SIGUSR2, passtochild)
-    signal.signal(signal.SIGQUIT, passtochild)
+    signal.signal(signal.SIGABRT, passtochild)
    signal.signal(signal.SIGTERM, passtochild)

    patroni = call_self(sys.argv[1:])
@@ -1,11 +1,11 @@
 import base64
-import fcntl
 import json
 import logging
 import psycopg2
 import time
 import dateutil.parser
 import datetime
+import os

 from patroni.postgresql import PostgresConnectionException, PostgresException, Postgresql
 from patroni.utils import deep_compare, parse_bool, patch_config, Retry, \
@@ -84,35 +84,26 @@ class RestApiHandler(BaseHTTPRequestHandler):
        patroni = self.server.patroni
        cluster = patroni.dcs.cluster

-        def is_synchronous():
-            return (cluster.is_synchronous_mode() and cluster.sync
-                    and cluster.sync.sync_standby == patroni.postgresql.name)
+        replica_status_code = 200 if not patroni.noloadbalance and response.get('role') == 'replica' else 503
+        status_code = 503

-        def is_balanceable_replica():
-            return response.get('role') == 'replica' and not patroni.noloadbalance
-
-        if cluster:  # dcs available
-            if patroni.ha.is_leader():
-                status_code = 200 if 'master' in path else 503
-            elif 'role' not in response:
-                status_code = 503
-            elif response['role'] == 'master':  # running as master but without leader lock!!!!
-                status_code = 503
-            elif path in ('/sync', '/synchronous'):
-                status_code = 200 if is_balanceable_replica() and is_synchronous() else 503
-            elif path in ('/async', '/asynchronous'):
-                status_code = 200 if is_balanceable_replica() and not is_synchronous() else 503
-            elif response['role'] in path:  # response['role'] != 'master'
-                status_code = 503 if patroni.noloadbalance else 200
+        if patroni.ha.is_standby_cluster() and ('standby_leader' in path or 'standby-leader' in path):
+            status_code = 200 if patroni.ha.is_leader() else 503
+        elif 'master' in path or 'leader' in path or 'primary' in path:
+            # Round-robing across all masters in pause mode if DCS is not accessible
+            if not cluster and patroni.ha.is_paused():
+                status_code = 200 if response['role'] == 'master' else 503
            else:
-                status_code = 503
-        elif 'role' in response and response['role'] in path:
-            status_code = 503 if response['role'] != 'master' and patroni.noloadbalance else 200
-        elif patroni.ha.restart_scheduled() and patroni.postgresql.role == 'master' and 'master' in path:
-            # exceptional case for master node when the postgres is being restarted via API
-            status_code = 200
-        else:
-            status_code = 503
+                status_code = 200 if patroni.ha.is_leader() else 503
+        elif 'replica' in path:
+            status_code = replica_status_code
+        elif cluster:  # dcs is available
+            is_synchronous = cluster.is_synchronous_mode() and cluster.sync \
+                    and cluster.sync.sync_standby == patroni.postgresql.name
+            if path in ('/sync', '/synchronous') and is_synchronous:
+                status_code = replica_status_code
+            elif path in ('/async', '/asynchronous') and not is_synchronous:
+                status_code = replica_status_code

        if write_status_code_only:  # when haproxy sends OPTIONS request it reads only status code and nothing more
            message = self.responses[status_code][0]
@@ -415,21 +406,26 @@ class RestApiHandler(BaseHTTPRequestHandler):

    def get_postgresql_status(self, retry=False):
        try:
+            cluster = self.server.patroni.dcs.cluster
+
            if self.server.patroni.postgresql.state not in ('running', 'restarting', 'starting'):
                raise RetryFailedError('')
            stmt = ("WITH replication_info AS ("
                    "SELECT usename, application_name, client_addr, state, sync_state, sync_priority"
-                    " FROM pg_stat_replication) SELECT"
-                    " to_char(pg_postmaster_start_time(), 'YYYY-MM-DD HH24:MI:SS.MS TZ'),"
-                    " CASE WHEN pg_is_in_recovery() THEN 0"
-                    " ELSE ('x' || SUBSTR(pg_{0}file_name(pg_current_{0}_{1}()), 1, 8))::bit(32)::int END,"
-                    " CASE WHEN pg_is_in_recovery() THEN 0"
-                    " ELSE pg_{0}_{1}_diff(pg_current_{0}_{1}(), '0/0')::bigint END,"
-                    " pg_{0}_{1}_diff(COALESCE(pg_last_{0}_receive_{1}(), pg_last_{0}_replay_{1}()), '0/0')::bigint,"
-                    " pg_{0}_{1}_diff(pg_last_{0}_replay_{1}(), '0/0')::bigint,"
-                    " to_char(pg_last_xact_replay_timestamp(), 'YYYY-MM-DD HH24:MI:SS.MS TZ'),"
-                    " pg_is_in_recovery() AND pg_is_{0}_replay_paused(),"
-                    " (SELECT array_to_json(array_agg(row_to_json(ri))) FROM replication_info ri)")
+                    " FROM pg_catalog.pg_stat_replication) SELECT"
+                    " pg_catalog.to_char(pg_catalog.pg_postmaster_start_time(), 'YYYY-MM-DD HH24:MI:SS.MS TZ'),"
+                    " CASE WHEN pg_catalog.pg_is_in_recovery() THEN 0"
+                    " ELSE ('x' || pg_catalog.substr(pg_catalog.pg_{0}file_name("
+                    "pg_catalog.pg_current_{0}_{1}()), 1, 8))::bit(32)::int END,"
+                    " CASE WHEN pg_catalog.pg_is_in_recovery() THEN 0"
+                    " ELSE pg_catalog.pg_{0}_{1}_diff(pg_catalog.pg_current_{0}_{1}(), '0/0')::bigint END,"
+                    " pg_catalog.pg_{0}_{1}_diff(COALESCE(pg_catalog.pg_last_{0}_receive_{1}(),"
+                    " pg_catalog.pg_last_{0}_replay_{1}()), '0/0')::bigint,"
+                    " pg_catalog.pg_{0}_{1}_diff(pg_catalog.pg_last_{0}_replay_{1}(), '0/0')::bigint,"
+                    " pg_catalog.to_char(pg_catalog.pg_last_xact_replay_timestamp(), 'YYYY-MM-DD HH24:MI:SS.MS TZ'),"
+                    " pg_catalog.pg_is_in_recovery() AND pg_catalog.pg_is_{0}_replay_paused(), "
+                    "(SELECT pg_catalog.array_to_json(pg_catalog.array_agg("
+                    "pg_catalog.row_to_json(ri))) FROM replication_info ri)")

            row = self.query(stmt.format(self.server.patroni.postgresql.wal_name,
                                         self.server.patroni.postgresql.lsn_name), retry=retry)[0]
@@ -439,6 +435,7 @@ class RestApiHandler(BaseHTTPRequestHandler):
                'postmaster_start_time': row[0],
                'role': 'replica' if row[1] == 0 else 'master',
                'server_version': self.server.patroni.postgresql.server_version,
+                'cluster_unlocked': bool(not cluster or cluster.is_unlocked()),
                'xlog': ({
                    'received_location': row[3],
                    'replayed_location': row[4],
@@ -451,7 +448,6 @@ class RestApiHandler(BaseHTTPRequestHandler):
            if row[1] > 0:
                result['timeline'] = row[1]
            else:
-                cluster = self.server.patroni.dcs.cluster
                leader_timeline = None if not cluster or cluster.is_unlocked() else cluster.leader.timeline
                result['timeline'] = self.server.patroni.postgresql.replica_cached_timeline(leader_timeline)

@@ -492,8 +488,10 @@ class RestApiServer(ThreadingMixIn, HTTPServer, Thread):

    @staticmethod
    def _set_fd_cloexec(fd):
-        flags = fcntl.fcntl(fd, fcntl.F_GETFD)
-        fcntl.fcntl(fd, fcntl.F_SETFD, flags | fcntl.FD_CLOEXEC)
+        if os.name != 'nt':
+            import fcntl
+            flags = fcntl.fcntl(fd, fcntl.F_GETFD)
+            fcntl.fcntl(fd, fcntl.F_SETFD, flags | fcntl.FD_CLOEXEC)

    def check_basic_auth_key(self, key):
        return self.__auth_key == key
@@ -1,6 +1,8 @@
 import json
 import logging
 import os
+import shutil
+import six
 import sys
 import tempfile
 import yaml
@@ -45,6 +47,15 @@ class Config(object):
        'master_start_timeout': 300,
        'synchronous_mode': False,
        'synchronous_mode_strict': False,
+        'standby_cluster': {
+            'create_replica_methods': '',
+            'host': '',
+            'port': '',
+            'primary_slot_name': '',
+            'restore_command': '',
+            'archive_cleanup_command': '',
+            'recovery_min_apply_delay': ''
+        },
        'postgresql': {
            'bin_dir': '',
            'use_slots': True,
@@ -114,7 +125,7 @@ class Config(object):
                with os.fdopen(fd, 'w') as f:
                    fd = None
                    json.dump(self.dynamic_configuration, f)
-                tmpfile = os.rename(tmpfile, self._cache_file)
+                tmpfile = shutil.move(tmpfile, self._cache_file)
                self._cache_needs_saving = False
            except Exception:
                logger.exception('Exception when saving file: %s', self._cache_file)
@@ -183,6 +194,13 @@ class Config(object):
                        config['postgresql'][name].update(self._process_postgresql_parameters(value))
                    elif name not in ('connect_address', 'listen', 'data_dir', 'pgpass', 'authentication'):
                        config['postgresql'][name] = deepcopy(value)
+            elif name == 'standby_cluster':
+                allowed_keys = self.__DEFAULT_CONFIG['standby_cluster'].keys()
+                expected = {
+                    k: v for k, v in (value or {}).items()
+                    if (k in allowed_keys and isinstance(v, six.string_types))
+                }
+                config['standby_cluster'].update(expected)
            elif name in config:  # only variables present in __DEFAULT_CONFIG allowed to be overriden from DCS
                if name in ('synchronous_mode', 'synchronous_mode_strict'):
                    config[name] = value
@@ -317,8 +335,15 @@ class Config(object):
        if 'name' not in config and 'name' in pg_config:
            config['name'] = pg_config['name']

-        pg_config.update({p: config[p] for p in ('name', 'scope', 'retry_timeout',
-                          'synchronous_mode', 'maximum_lag_on_failover') if p in config})
+        updated_fields = (
+            'name',
+            'scope',
+            'retry_timeout',
+            'synchronous_mode',
+            'maximum_lag_on_failover'
+        )
+
+        pg_config.update({p: config[p] for p in updated_fields if p in config})

        return config

@@ -103,15 +103,20 @@ option_watch = click.option('-W', is_flag=True, help='Auto update the screen eve
 option_force = click.option('--force', is_flag=True, help='Do not ask for confirmation at any point')
 arg_cluster_name = click.argument('cluster_name', required=False,
                                  default=lambda: click.get_current_context().obj.get('scope'))
+option_insecure = click.option('-k', '--insecure', is_flag=True, help='Allow connections to SSL sites without certs')


@click.group()
@click.option('--config-file', '-c', help='Configuration file', default=CONFIG_FILE_PATH)
@click.option('--dcs', '-d', help='Use this DCS', envvar='DCS')
+@option_insecure
@click.pass_context
-def ctl(ctx, config_file, dcs):
+def ctl(ctx, config_file, dcs, insecure):
    logging.basicConfig(format='%(asctime)s - %(levelname)s - %(message)s', level=os.environ.get('LOGLEVEL', 'WARNING'))
+    logging.captureWarnings(True)  # Capture eventual SSL warning
    ctx.obj = load_config(config_file, dcs)
+    # backward compatibility for configuration file where ctl section is not define
+    ctx.obj.setdefault('ctl', {})['insecure'] = ctx.obj.get('ctl', {}).get('insecure') or insecure


 def get_dcs(config, scope):
@@ -129,6 +134,7 @@ def auth_header(config):


 def request_patroni(member, request_type, endpoint, content=None, headers=None):
+    ctx = click.get_current_context()  # the current click context
    headers = headers or {}
    url_parts = urlparse(member.api_url)
    logging.debug(url_parts)
@@ -137,8 +143,21 @@ def request_patroni(member, request_type, endpoint, content=None, headers=None):

    url = '{0}://{1}/{2}'.format(url_parts.scheme, url_parts.netloc, endpoint)

+    insecure = ctx.obj.get('ctl', {}).get('insecure', False)
+    # Get certfile if any from several configuration namespace
+    cert = ctx.obj.get('ctl', {}).get('cacert') or \
+        ctx.obj.get('restapi', {}).get('cacert') or \
+        ctx.obj.get('restapi', {}).get('certfile')
+    # In the case we specificaly disable SSL cert verification we don't want to have the warning
+    if insecure:
+        verify = False
+    elif cert:
+        verify = cert
+    else:
+        verify = True
    return getattr(requests, request_type)(url, headers=headers,
-                                           data=json.dumps(content) if content else None, timeout=60)
+                                           data=json.dumps(content) if content else None, timeout=60,
+                                           verify=verify)


 def print_output(columns, rows=None, alignment=None, fmt='pretty', header=True, delimiter='\t'):
@@ -233,7 +252,7 @@ def get_cursor(cluster, connect_parameters, role='master', member=None):
    if role == 'any':
        return cursor

-    cursor.execute('SELECT pg_is_in_recovery()')
+    cursor.execute('SELECT pg_catalog.pg_is_in_recovery()')
    in_recovery = cursor.fetchone()[0]

    if in_recovery and role == 'replica' or not in_recovery and role == 'master':
@@ -373,7 +392,7 @@ def query_member(cluster, cursor, member, role, command, connect_parameters):
            logging.debug(message)
            return [[timestamp(0), message]], None

-        cursor.execute('SELECT pg_is_in_recovery()')
+        cursor.execute('SELECT pg_catalog.pg_is_in_recovery()')
        in_recovery = cursor.fetchone()[0]

        if in_recovery and role == 'master' or not in_recovery and role == 'replica':
@@ -585,7 +604,8 @@ def _do_failover_or_switchover(obj, action, cluster_name, master, candidate, for
    if master is not None and cluster.leader and cluster.leader.member.name != master:
        raise PatroniCtlException('Member {0} is not the leader of cluster {1}'.format(master, cluster_name))

-    candidate_names = [str(m.name) for m in cluster.members if m.name != master]
+    # excluding members with nofailover tag
+    candidate_names = [str(m.name) for m in cluster.members if m.name != master and not m.nofailover]
    # We sort the names for consistent output to the client
    candidate_names.sort()

@@ -902,7 +922,8 @@ def toggle_pause(config, cluster_name, paused, wait):
    for member in members:
        try:
            r = request_patroni(member, 'patch', 'config', {'pause': paused or None}, auth_header(config))
-        except Exception:
+        except Exception as err:
+            logging.warning(str(err))
            logging.warning('Member %s is not accessible', member.name)
            continue

@@ -6,19 +6,38 @@ import json
 import logging
 import os
 import pkgutil
+import re
 import six
 import sys

-from collections import namedtuple
+from collections import defaultdict, namedtuple
+from copy import deepcopy
 from patroni.exceptions import PatroniException
 from patroni.utils import parse_bool
 from random import randint
 from six.moves.urllib_parse import urlparse, urlunparse, parse_qsl
 from threading import Event, Lock

+slot_name_re = re.compile('^[a-z0-9_]{1,63}$')
 logger = logging.getLogger(__name__)


+def slot_name_from_member_name(member_name):
+    """Translate member name to valid PostgreSQL slot name.
+
+    PostgreSQL replication slot names must be valid PostgreSQL names. This function maps the wider space of
+    member names to valid PostgreSQL names. Names are lowercased, dashes and periods common in hostnames
+    are replaced with underscores, other characters are encoded as their unicode codepoint. Name is truncated
+    to 64 characters. Multiple different member names may map to a single slot name."""
+
+    def replace_char(match):
+        c = match.group(0)
+        return '_' if c in '-.' else "u{:04d}".format(ord(c))
+
+    slot_name = re.sub('[^a-z0-9_]', replace_char, member_name.lower())
+    return slot_name[0:63]
+
+
 def parse_connection_string(value):
    """Original Governor stores connection strings for each cluster members if a following format:
        postgres://{username}:{password}@{connect_address}/postgres
@@ -108,12 +127,29 @@ class Member(namedtuple('Member', 'index,name,session,data')):

    @property
    def conn_url(self):
-        return self.data.get('conn_url')
+        conn_url = self.data.get('conn_url')
+        conn_kwargs = self.data.get('conn_kwargs')
+        if conn_url:
+            return conn_url
+
+        if conn_kwargs:
+            conn_url = 'postgresql://{host}:{port}'.format(
+                host=conn_kwargs.get('host'),
+                port=conn_kwargs.get('port'),
+            )
+            self.data['conn_url'] = conn_url
+            return conn_url

    def conn_kwargs(self, auth=None):
+        defaults = {
+            "host": "",
+            "port": "",
+            "database": ""
+        }
        ret = self.data.get('conn_kwargs')
        if ret:
-            ret = ret.copy()
+            defaults.update(ret)
+            ret = defaults
        else:
            r = urlparse(self.conn_url)
            ret = {
@@ -159,6 +195,26 @@ class Member(namedtuple('Member', 'index,name,session,data')):
        return self.state == 'running'


+class RemoteMember(Member):
+    """ Represents a remote master for a standby cluster
+    """
+    def __new__(cls, name, data):
+        return super(RemoteMember, cls).__new__(cls, None, name, None, data)
+
+    @staticmethod
+    def allowed_keys():
+        return ('primary_slot_name',
+                'create_replica_methods',
+                'restore_command',
+                'archive_cleanup_command',
+                'recovery_min_apply_delay',
+                'no_replication_slot')
+
+    def __getattr__(self, name):
+        if name in RemoteMember.allowed_keys():
+            return self.data.get(name)
+
+
 class Leader(namedtuple('Leader', 'index,session,member')):

    """Immutable object (namedtuple) which represents leader key.
@@ -236,14 +292,24 @@ class ClusterConfig(namedtuple('ClusterConfig', 'index,data,modify_index')):
    def from_node(index, data, modify_index=None):
        """
        >>> ClusterConfig.from_node(1, '{') is None
-        True
+        False
        """

        try:
            data = json.loads(data)
        except (TypeError, ValueError):
-            return None
-        return ClusterConfig(index, data, modify_index or index)
+            data = None
+            modify_index = 0
+        if not isinstance(data, dict):
+            data = {}
+        return ClusterConfig(index, data, index if modify_index is None else modify_index)
+
+    @property
+    def permanent_slots(self):
+        return isinstance(self.data, dict) and (
+                self.data.get('permanent_replication_slots') or
+                self.data.get('permanent_slots') or self.data.get('slots')
+        ) or {}


 class SyncState(namedtuple('SyncState', 'index,leader,sync_standby')):
@@ -359,6 +425,65 @@ class Cluster(namedtuple('Cluster', 'initialize,config,leader,last_leader_operat
    def is_synchronous_mode(self):
        return self.check_mode('synchronous_mode')

+    def get_replication_slots(self, name, role):
+        # if the replicatefrom tag is set on the member - we should not create the replication slot for it on
+        # the current master, because that member would replicate from elsewhere. We still create the slot if
+        # the replicatefrom destination member is currently not a member of the cluster (fallback to the
+        # master), or if replicatefrom destination member happens to be the current master
+        if role in ('master', 'standby_leader'):
+            slot_members = [m.name for m in self.members if m.name != name and
+                            (m.replicatefrom is None or m.replicatefrom == name or
+                             not self.has_member(m.replicatefrom))]
+            permanent_slots = (self.config and self.config.permanent_slots or {}).copy()
+        else:
+            # only manage slots for replicas that replicate from this one, except for the leader among them
+            slot_members = [m.name for m in self.members if m.replicatefrom == name and m.name != self.leader.name]
+            permanent_slots = {}
+
+        slots = {slot_name_from_member_name(name): {'type': 'physical'} for name in slot_members}
+
+        if len(slots) < len(slot_members):
+            # Find which names are conflicting for a nicer error message
+            slot_conflicts = defaultdict(list)
+            for name in slot_members:
+                slot_conflicts[slot_name_from_member_name(name)].append(name)
+            logger.error("Following cluster members share a replication slot name: %s",
+                         "; ".join("{} map to {}".format(", ".join(v), k)
+                                   for k, v in slot_conflicts.items() if len(v) > 1))
+
+        # "merge" replication slots for members with permanent_replication_slots
+        for name, value in permanent_slots.items():
+            if not slot_name_re.match(name):
+                logger.error("Invalid permanent replication slot name '%s'", name)
+                logger.error("Slot name may only contain lower case letters, numbers, and the underscore chars")
+                continue
+
+            if name in slots:
+                logger.error("Permanent replication slot {'%s': %s} is conflicting with" +
+                             " physical replication slot for cluster member", name, value)
+                continue
+
+            value = deepcopy(value)
+            if not value:
+                value = {'type': 'physical'}
+
+            if isinstance(value, dict):
+                if 'type' not in value:
+                    value['type'] = 'logical' if value.get('database') and value.get('plugin') else 'physical'
+
+                if value['type'] == 'physical' or value['type'] == 'logical' \
+                        and value.get('database') and value.get('plugin'):
+                    slots[name] = value
+                    continue
+
+            logger.error("Bad value for slot '%s' in permanent_slots: %s", name, permanent_slots[name])
+
+        return slots
+
+    def has_permanent_logical_slots(self, name):
+        slots = self.get_replication_slots(name, 'master').values()
+        return any(v for v in slots if v.get("type") == "logical")
+

@six.add_metaclass(abc.ABCMeta)
 class AbstractDCS(object):
@@ -379,7 +504,7 @@ class AbstractDCS(object):
            i.e.: `zookeeper` for zookeeper, `etcd` for etcd, etc...
        """
        self._name = config['name']
-        self._base_path = os.path.join('/', config.get('namespace', '/service/').strip('/'), config['scope'])
+        self._base_path = re.sub('/+', '/', '/'.join(['', config.get('namespace', 'service'), config['scope']]))
        self._set_loop_wait(config.get('loop_wait', 10))

        self._ctl = bool(config.get('patronictl', False))
@@ -495,7 +620,7 @@ class AbstractDCS(object):
        You have to use CAS (Compare And Swap) operation in order to update leader key,
        for example for etcd `prevValue` parameter must be used."""

-    def update_leader(self, last_operation):
+    def update_leader(self, last_operation, access_is_restricted=False):
        """Update leader key (or session) ttl and optime/leader

        :param last_operation: absolute xlog location in bytes
@@ -2,6 +2,7 @@ from __future__ import absolute_import
 import json
 import logging
 import os
+import re
 import socket
 import ssl
 import time
@@ -12,7 +13,7 @@ from patroni.dcs import AbstractDCS, ClusterConfig, Cluster, Failover, Leader, M
 from patroni.exceptions import DCSError
 from patroni.utils import deep_compare, parse_bool, Retry, RetryFailedError, split_host_port
 from urllib3.exceptions import HTTPError
-from six.moves.urllib.parse import urlencode, urlparse
+from six.moves.urllib.parse import urlencode, urlparse, quote
 from six.moves.http_client import HTTPException

 logger = logging.getLogger(__name__)
@@ -133,6 +134,31 @@ def catch_consul_errors(func):
    return wrapper


+def force_if_last_failed(func):
+    def wrapper(*args, **kwargs):
+        if wrapper.last_result is False:
+            kwargs['force'] = True
+        wrapper.last_result = func(*args, **kwargs)
+        return wrapper.last_result
+
+    wrapper.last_result = None
+    return wrapper
+
+
+def service_name_from_scope_name(scope_name):
+    """Translate scope name to service name which can be used in dns.
+
+    230 = 253 - len('replica.') - len('.service.consul')
+    """
+
+    def replace_char(match):
+        c = match.group(0)
+        return '-' if c in '. _' else "u{:04d}".format(ord(c))
+
+    service_name = re.sub(r'[^a-z0-9\-]', replace_char, scope_name.lower())
+    return service_name[0:230]
+
+
 class Consul(AbstractDCS):

    def __init__(self, config):
@@ -144,7 +170,6 @@ class Consul(AbstractDCS):
                            retry_exceptions=(ConsulInternalError, HTTPException,
                                              HTTPError, socket.error, socket.timeout))

-        self._my_member_data = {}
        kwargs = {}
        if 'url' in config:
            r = urlparse(config['url'])
@@ -175,6 +200,13 @@ class Consul(AbstractDCS):
        self.set_ttl(config.get('ttl') or 30)
        self._last_session_refresh = 0
        self.__session_checks = config.get('checks')
+        self._register_service = config.get('register_service', False)
+        if self._register_service:
+            self._service_name = service_name_from_scope_name(self._scope)
+            if self._scope != self._service_name:
+                logger.warning('Using %s as consul service name instead of scope name %s', self._service_name,
+                               self._scope)
+        self._service_check_interval = config.get('service_check_interval', '5s')
        if not self._ctl:
            self.create_session()

@@ -256,7 +288,7 @@ class Consul(AbstractDCS):
            nodes = {}
            for node in results:
                node['Value'] = (node['Value'] or b'').decode('utf-8')
-                nodes[os.path.relpath(node['Key'], path)] = node
+                nodes[os.path.relpath(node['Key'], path).replace('\\', '/')] = node

            # get initialize flag
            initialize = nodes.get(self._INITIALIZE)
@@ -306,30 +338,81 @@ class Consul(AbstractDCS):
            logger.exception('get_cluster')
            raise ConsulError('Consul is not responding properly')

+    @catch_consul_errors
    def touch_member(self, data, ttl=None, permanent=False):
        cluster = self.cluster
        member = cluster and cluster.get_member(self._name, fallback_to_leader=False)
        create_member = not permanent and self.refresh_session()

        if member and (create_member or member.session != self._session):
-            try:
-                self._client.kv.delete(self.member_path)
-                create_member = True
-            except Exception:
-                return False
+            self._client.kv.delete(self.member_path)
+            create_member = True

-        if not create_member and member and deep_compare(data, self._my_member_data):
+        if not create_member and member and deep_compare(data, member.data):
            return True

        try:
            args = {} if permanent else {'acquire': self._session}
            self._client.kv.put(self.member_path, json.dumps(data, separators=(',', ':')), **args)
-            self._my_member_data = data
+            if self._register_service:
+                self.update_service(not create_member and member and member.data or {}, data)
            return True
        except Exception:
            logger.exception('touch_member')
        return False

+    @catch_consul_errors
+    def register_service(self, service_name, **kwargs):
+        logger.info('Register service %s, params %s', service_name, kwargs)
+        return self._client.agent.service.register(service_name, **kwargs)
+
+    @catch_consul_errors
+    def deregister_service(self, service_id):
+        logger.info('Deregister service %s', service_id)
+        # service_id can contain special characters, but is used as part of uri in deregister request
+        service_id = quote(service_id)
+        return self._client.agent.service.deregister(service_id)
+
+    def _update_service(self, data):
+        service_name = self._service_name
+        role = data['role'].replace('_', '-')
+        state = data['state']
+        api_parts = urlparse(data['api_url'])
+        api_parts = api_parts._replace(path='/{0}'.format(role))
+        conn_parts = urlparse(data['conn_url'])
+        check = base.Check.http(api_parts.geturl(), self._service_check_interval, deregister=self._client.http.ttl * 10)
+        params = {
+            'service_id': '{0}/{1}'.format(self._scope, self._name),
+            'address': conn_parts.hostname,
+            'port': conn_parts.port,
+            'check': check,
+            'tags': [role]
+        }
+
+        if state == 'stopped':
+            return self.deregister_service(params['service_id'])
+
+        if role in ['master', 'replica', 'standby-leader']:
+            if state != 'running':
+                return
+            return self.register_service(service_name, **params)
+
+        logger.warning('Could not register service: unknown role type %s', role)
+
+    @force_if_last_failed
+    def update_service(self, old_data, new_data, force=False):
+        update = False
+
+        for key in ['role', 'api_url', 'conn_url', 'state']:
+            if key not in new_data:
+                logger.warning('Could not register service: not enough params in member data')
+                return
+            if old_data.get(key) != new_data[key]:
+                update = True
+
+        if force or update:
+            return self._update_service(new_data)
+
    @catch_consul_errors
    def _do_attempt_to_acquire_leader(self, kwargs):
        return self.retry(self._client.kv.put, self.leader_path, self._name, **kwargs)
@@ -341,6 +424,7 @@ class Consul(AbstractDCS):
        ret = self._do_attempt_to_acquire_leader({} if permanent else {'acquire': self._session})
        if not ret:
            logger.info('Could not take out TTL lock')
+
        return ret

    def take_leader(self):
@@ -408,7 +492,7 @@ class Consul(AbstractDCS):
                    idx, _ = self._client.kv.get(self.leader_path, index=leader_index, wait=str(timeout) + 's')
                    return str(idx) != str(leader_index)
                except (ConsulException, HTTPException, HTTPError, socket.error, socket.timeout):
-                    logging.exception('watch')
+                    logger.exception('watch')

                timeout = end_time - time.time()

@@ -448,7 +448,7 @@ class Etcd(AbstractDCS):
    def _load_cluster(self):
        try:
            result = self.retry(self._client.read, self.client_path(''), recursive=True)
-            nodes = {os.path.relpath(node.key, result.key): node for node in result.leaves}
+            nodes = {os.path.relpath(node.key, result.key).replace('\\', '/'): node for node in result.leaves}

            # get initialize flag
            initialize = nodes.get(self._INITIALIZE)
@@ -496,7 +496,7 @@ class Etcd(AbstractDCS):
    @catch_etcd_errors
    def touch_member(self, data, ttl=None, permanent=False):
        data = json.dumps(data, separators=(',', ':'))
-        return self.retry(self._client.set, self.member_path, data, None if permanent else ttl or self._ttl)
+        return self._client.set(self.member_path, data, None if permanent else ttl or self._ttl)

    @catch_etcd_errors
    def take_leader(self):
@@ -152,7 +152,8 @@ class Kubernetes(AbstractDCS):

            # get global dynamic configuration
            config = ClusterConfig.from_node(metadata and metadata.resource_version,
-                                             annotations.get(self._CONFIG) or '{}')
+                                             annotations.get(self._CONFIG) or '{}',
+                                             metadata.resource_version if self._CONFIG in annotations else 0)

            # get timeline history
            history = TimelineHistory.from_node(metadata and metadata.resource_version,
@@ -279,7 +280,7 @@ class Kubernetes(AbstractDCS):
    def _update_leader(self):
        """Unused"""

-    def update_leader(self, last_operation):
+    def update_leader(self, last_operation, access_is_restricted=False):
        now = datetime.datetime.now(tzutc).isoformat()
        annotations = {self._LEADER: self._name, 'ttl': str(self._ttl), 'renewTime': now,
                       'acquireTime': self._leader_observed_record.get('acquireTime') or now,
@@ -287,7 +288,11 @@ class Kubernetes(AbstractDCS):
        if last_operation:
            annotations[self._OPTIME] = last_operation

-        ret = self.patch_or_create(self.leader_path, annotations, self._leader_resource_version, subsets=self.__subsets)
+        subsets = self.__subsets
+        if subsets is not None and access_is_restricted:
+            subsets = []
+
+        ret = self.patch_or_create(self.leader_path, annotations, self._leader_resource_version, subsets=subsets)
        if ret:
            self._leader_resource_version = ret.metadata.resource_version
        return ret
@@ -307,7 +312,8 @@ class Kubernetes(AbstractDCS):
            else:
                annotations['acquireTime'] = self._leader_observed_record.get('acquireTime') or now
            annotations['transitions'] = str(transitions)
-        ret = self.patch_or_create(self.leader_path, annotations, self._leader_resource_version, subsets=self.__subsets)
+        subsets = [] if self.__subsets else None
+        ret = self.patch_or_create(self.leader_path, annotations, self._leader_resource_version, subsets=subsets)
        if ret:
            self._leader_resource_version = ret.metadata.resource_version
        else:
@@ -399,7 +405,7 @@ class Kubernetes(AbstractDCS):
                except KeyboardInterrupt:
                    raise
                except Exception:
-                    logging.exception('watch')
+                    logger.exception('watch')

                timeout = end_time - time.time()

@@ -37,7 +37,9 @@ class PatroniSequentialThreadingHandler(SequentialThreadingHandler):
                     `connect_timeout` (negotiated session timeout) as the second element."""

        args = list(args)
-        if len(args) == 1:
+        if len(args) == 0:  # kazoo 2.6.0 slightly changed the way how it calls create_connection method
+            kwargs['timeout'] = max(self._connect_timeout, kwargs.get('timeout', self._connect_timeout*10)/10.0)
+        elif len(args) == 1:
            args.append(self._connect_timeout)
        else:
            args[1] = max(self._connect_timeout, args[1]/10.0)
@@ -59,7 +61,6 @@ class ZooKeeper(AbstractDCS):
                                   max_delay=1, max_tries=-1, sleep_func=time.sleep))
        self._client.add_listener(self.session_listener)

-        self._my_member_data = {}
        self._fetch_cluster = True

        self._orig_kazoo_connect = self._client._connection._connect
@@ -208,45 +209,52 @@ class ZooKeeper(AbstractDCS):
                self.cluster_watcher(None)
                raise ZooKeeperError('ZooKeeper in not responding properly')

-    def _create(self, path, value, **kwargs):
+    def _create(self, path, value, retry=False, ephemeral=False):
        try:
-            self._client.retry(self._client.create, path, value.encode('utf-8'), **kwargs)
+            if retry:
+                self._client.retry(self._client.create, path, value, makepath=True, ephemeral=ephemeral)
+            else:
+                self._client.create_async(path, value, makepath=True, ephemeral=ephemeral).get(timeout=1)
            return True
        except Exception:
-            return False
+            logger.exception('Failed to create %s', path)
+        return False

    def attempt_to_acquire_leader(self, permanent=False):
-        ret = self._create(self.leader_path, self._name, makepath=True, ephemeral=not permanent)
+        ret = self._create(self.leader_path, self._name.encode('utf-8'), retry=True, ephemeral=not permanent)
        if not ret:
            logger.info('Could not take out TTL lock')
        return ret

-    def __set_failover_or_sync_state_value(self, key, value, index=None):
+    def _set_or_create(self, key, value, index=None, retry=False, do_not_create_empty=False):
+        value = value.encode('utf-8')
        try:
-            self._client.retry(self._client.set, key, value.encode('utf-8'), version=index or -1)
+            if retry:
+                self._client.retry(self._client.set, key, value, version=index or -1)
+            else:
+                self._client.set_async(key, value, version=index or -1).get(timeout=1)
            return True
        except NoNodeError:
-            return value == '' or (index is None and self._create(key, value))
+            if do_not_create_empty and not value:
+                return True
+            elif index is None:
+                return self._create(key, value, retry)
+            else:
+                return False
        except Exception:
-            logging.exception('set_failover_value')
-            return False
+            logger.exception('Failed to update %s', key)
+        return False

    def set_failover_value(self, value, index=None):
-        return self.__set_failover_or_sync_state_value(self.failover_path, value, index)
+        return self._set_or_create(self.failover_path, value, index)

    def set_config_value(self, value, index=None):
-        try:
-            self._client.retry(self._client.set, self.config_path, value.encode('utf-8'), version=index or -1)
-            return True
-        except NoNodeError:
-            return index is None and self._create(self.config_path, value)
-        except Exception:
-            logging.exception('set_config_value')
-            return False
+        return self._set_or_create(self.config_path, value, index, retry=True)

    def initialize(self, create_new=True, sysid=""):
-        return self._create(self.initialize_path, sysid, makepath=True) if create_new \
-            else self._client.retry(self._client.set, self.initialize_path, sysid.encode("utf-8"))
+        sysid = sysid.encode('utf-8')
+        return self._create(self.initialize_path, sysid, retry=True) if create_new \
+            else self._client.retry(self._client.set, self.initialize_path, sysid)

    def touch_member(self, data, ttl=None, permanent=False):
        cluster = self.cluster
@@ -262,13 +270,12 @@ class ZooKeeper(AbstractDCS):
            member = None

        if member:
-            if deep_compare(data, self._my_member_data):
+            if deep_compare(data, member.data):
                return True
        else:
            try:
                self._client.create_async(self.member_path, encoded_data, makepath=True,
                                          ephemeral=not permanent).get(timeout=1)
-                self._my_member_data = data
                return True
            except Exception as e:
                if not isinstance(e, NodeExistsError):
@@ -276,7 +283,6 @@ class ZooKeeper(AbstractDCS):
                    return False
        try:
            self._client.set_async(self.member_path, encoded_data).get(timeout=1)
-            self._my_member_data = data
            return True
        except Exception:
            logger.exception('touch_member')
@@ -286,30 +292,14 @@ class ZooKeeper(AbstractDCS):
    def take_leader(self):
        return self.attempt_to_acquire_leader()

-    def __write_leader_optime_or_history_value(self, key, value):
-        value = value.encode('utf-8')
-        try:
-            self._client.set_async(key, value).get(timeout=1)
-            return True
-        except NoNodeError:
-            try:
-                self._client.create_async(key, value, makepath=True).get(timeout=1)
-                return True
-            except Exception:
-                logger.exception('Failed to create %s', key)
-        except Exception:
-            logger.exception('Failed to update %s', key)
-        return False
-
    def _write_leader_optime(self, last_operation):
-        return self.__write_leader_optime_or_history_value(self.leader_optime_path, last_operation)
+        return self._set_or_create(self.leader_optime_path, last_operation)

    def _update_leader(self):
        return True

    def delete_leader(self):
        self._client.restart()
-        self._my_member_data = None
        return True

    def _cancel_initialization(self):
@@ -330,10 +320,10 @@ class ZooKeeper(AbstractDCS):
            return True

    def set_history_value(self, value):
-        return self.__write_leader_optime_or_history_value(self.history_path, value)
+        return self._set_or_create(self.history_path, value)

    def set_sync_state_value(self, value, index=None):
-        return self.__set_failover_or_sync_state_value(self.sync_path, value, index)
+        return self._set_or_create(self.sync_path, value, index, retry=True, do_not_create_empty=True)

    def delete_sync_state(self, index=None):
        return self.set_sync_state_value("{}", index)
@@ -6,13 +6,15 @@ import psycopg2
 import requests
 import sys
 import time
+import uuid

 from collections import namedtuple
 from multiprocessing.pool import ThreadPool
 from patroni.async_executor import AsyncExecutor, CriticalTask
 from patroni.exceptions import DCSError, PostgresConnectionException, PatroniException
-from patroni.postgresql import ACTION_ON_START
+from patroni.postgresql import ACTION_ON_START, ACTION_ON_ROLE_CHANGE
 from patroni.utils import polling_loop, tzutc
+from patroni.dcs import RemoteMember
 from threading import RLock

 logger = logging.getLogger(__name__)
@@ -59,6 +61,7 @@ class Ha(object):
        self.old_cluster = None
        self._is_leader = False
        self._is_leader_lock = RLock()
+        self._leader_access_is_restricted = False
        self._was_paused = False
        self._leader_timeline = None
        self.recovering = False
@@ -89,14 +92,30 @@ class Ha(object):
    def is_paused(self):
        return self.check_mode('pause')

+    def get_standby_cluster_config(self):
+        if self.cluster and self.cluster.config and self.cluster.config.modify_index:
+            config = self.cluster.config.data
+        else:
+            config = self.patroni.config.dynamic_configuration
+        return config.get('standby_cluster')
+
+    def is_standby_cluster(self):
+        config = self.get_standby_cluster_config()
+        # Check whether or not provided configuration describes a standby cluster
+        return isinstance(config, dict) and (config.get('host') or config.get('port') or config.get('restore_command'))
+
    def is_leader(self):
        with self._is_leader_lock:
-            return self._is_leader
+            return self._is_leader and not self._leader_access_is_restricted

    def set_is_leader(self, value):
        with self._is_leader_lock:
            self._is_leader = value

+    def set_leader_access_is_restricted(self, value):
+        with self._is_leader_lock:
+            self._leader_access_is_restricted = value
+
    def load_cluster_from_dcs(self):
        cluster = self.dcs.get_cluster()

@@ -105,9 +124,13 @@ class Ha(object):
            self.old_cluster = cluster
        self.cluster = cluster

+        if self.cluster.is_unlocked() or self.cluster.leader.name != self.state_handler.name:
+            self.set_is_leader(False)
+
        self._leader_timeline = None if cluster.is_unlocked() else cluster.leader.timeline

    def acquire_lock(self):
+        self.set_leader_access_is_restricted(self.cluster.has_permanent_logical_slots(self.state_handler.name))
        ret = self.dcs.attempt_to_acquire_leader()
        self.set_is_leader(ret)
        return ret
@@ -119,7 +142,7 @@ class Ha(object):
                last_operation = self.state_handler.last_operation()
            except Exception:
                logger.exception('Exception when called state_handler.last_operation()')
-        ret = self.dcs.update_leader(last_operation)
+        ret = self.dcs.update_leader(last_operation, self._leader_access_is_restricted)
        self.set_is_leader(ret)
        if ret:
            self.watchdog.keepalive()
@@ -146,6 +169,10 @@ class Ha(object):
                'state': self.state_handler.state,
                'role': self.state_handler.role
            }
+
+            # following two lines are mainly necessary for consul, to avoid creation of master service
+            if data['role'] == 'master' and not self.is_leader():
+                data['role'] = 'promoted'
            tags = self.get_effective_tags()
            if tags:
                data['tags'] = tags
@@ -190,14 +217,24 @@ class Ha(object):
            self._async_executor.schedule('bootstrap {0}'.format(msg))
            self._async_executor.run_async(self.clone, args=(clone_member, msg))
            return 'trying to bootstrap {0}'.format(msg)
+
        # no initialize key and node is allowed to be master and has 'bootstrap' section in a configuration file
        elif self.cluster.initialize is None and not self.patroni.nofailover and 'bootstrap' in self.patroni.config:
            if self.dcs.initialize(create_new=True):  # race for initialization
                self.state_handler.bootstrapping = True
                self._post_bootstrap_task = CriticalTask()
-                self._async_executor.schedule('bootstrap')
-                self._async_executor.run_async(self.state_handler.bootstrap, args=(self.patroni.config['bootstrap'],))
-                return 'trying to bootstrap a new cluster'
+
+                if self.is_standby_cluster():
+                    self._async_executor.schedule('bootstrap_standby_leader')
+                    self._async_executor.run_async(self.bootstrap_standby_leader)
+                    return 'trying to bootstrap a new standby leader'
+                else:
+                    self._async_executor.schedule('bootstrap')
+                    self._async_executor.run_async(
+                        self.state_handler.bootstrap,
+                        args=(self.patroni.config['bootstrap'],)
+                    )
+                    return 'trying to bootstrap a new cluster'
            else:
                return 'failed to acquire initialize lock'
        else:
@@ -208,10 +245,25 @@ class Ha(object):
                return 'trying to ' + msg
            return 'waiting for leader to bootstrap'

+    def bootstrap_standby_leader(self):
+        """ If we found 'standby' key in the configuration, we need to bootstrap
+            not a real master, but a 'standby leader', that will take base backup
+            from a remote master and start follow it.
+        """
+        clone_source = self.get_remote_master()
+        msg = 'clone from remote master {0}'.format(clone_source.conn_url)
+        result = self.clone(clone_source, msg)
+        self._post_bootstrap_task.complete(result)
+        if result:
+            self.state_handler.set_role('standby_leader')
+
+        return result
+
    def _handle_rewind(self):
-        if self.state_handler.rewind_needed_and_possible(self.cluster.leader):
-            self._async_executor.schedule('running pg_rewind from ' + self.cluster.leader.name)
-            self._async_executor.run_async(self.state_handler.rewind, (self.cluster.leader,))
+        leader = self.get_remote_master() if self.is_standby_cluster() else self.cluster.leader
+        if self.state_handler.rewind_needed_and_possible(leader):
+            self._async_executor.schedule('running pg_rewind from ' + leader.name)
+            self._async_executor.run_async(self.state_handler.rewind, (leader,))
            return True

    def recover(self):
@@ -243,16 +295,24 @@ class Ha(object):

        self.load_cluster_from_dcs()

-        if self.has_lock():
-            msg = "starting as readonly because i had the session lock"
-            node_to_follow = None
-        else:
+        if self.is_standby_cluster() or not self.has_lock():
            if not self.state_handler.rewind_executed:
                self.state_handler.trigger_check_diverged_lsn()
            if self._handle_rewind():
                return self._async_executor.scheduled_action
-            msg = "starting as a secondary"
-            node_to_follow = self._get_node_to_follow(self.cluster)
+
+            if self.has_lock():  # in standby cluster
+                msg = "starting as a standby leader because i had the session lock"
+                node_to_follow = self._get_node_to_follow(self.cluster)
+            elif self.is_standby_cluster() and self.cluster.is_unlocked():
+                msg = "trying to follow a remote master because standby cluster is unhealthy"
+                node_to_follow = self.get_remote_master()
+            else:
+                msg = "starting as a secondary"
+                node_to_follow = self._get_node_to_follow(self.cluster)
+        elif self.has_lock():
+            msg = "starting as readonly because i had the session lock"
+            node_to_follow = None

        self.recovering = True

@@ -263,12 +323,18 @@ class Ha(object):
    def _get_node_to_follow(self, cluster):
        # determine the node to follow. If replicatefrom tag is set,
        # try to follow the node mentioned there, otherwise, follow the leader.
-        if not self.patroni.replicatefrom or self.patroni.replicatefrom == self.state_handler.name:
-            node_to_follow = cluster.leader
-        else:
-            node_to_follow = cluster.get_member(self.patroni.replicatefrom)
+        is_leader = self.cluster.leader and self.state_handler.name == self.cluster.leader.name

-        return node_to_follow if node_to_follow and node_to_follow.name != self.state_handler.name else None
+        if self.is_standby_cluster() and (is_leader or self.cluster.is_unlocked()):
+            node_to_follow = self.get_remote_master()
+        elif self.patroni.replicatefrom and self.patroni.replicatefrom != self.state_handler.name:
+            node_to_follow = cluster.get_member(self.patroni.replicatefrom)
+        else:
+            node_to_follow = cluster.leader
+
+        return (node_to_follow if
+                node_to_follow and
+                node_to_follow.name != self.state_handler.name else None)

    def follow(self, demote_reason, follow_reason, refresh=True):
        if refresh:
@@ -408,6 +474,12 @@ class Ha(object):
                        line.append(cluster_history[line[0]][3])
                self.dcs.set_history_value(json.dumps(history, separators=(',', ':')))

+    def enforce_follow_remote_master(self, message):
+        self.state_handler.set_role('standby_leader')
+        demote_reason = 'cannot be a real master in standby cluster'
+
+        return self.follow(demote_reason, message)
+
    def enforce_master_role(self, message, promote_message):
        if not self.is_paused() and not self.watchdog.is_running and not self.watchdog.activate():
            if self.state_handler.is_leader():
@@ -437,8 +509,10 @@ class Ha(object):
                    return 'Postponing promotion because synchronous replication state was updated by somebody else'
                self.state_handler.set_synchronous_standby('*' if self.is_synchronous_mode_strict() else None)
            if self.state_handler.role != 'master':
+                self.set_leader_access_is_restricted(self.cluster.has_permanent_logical_slots(self.state_handler.name))
                self._async_executor.schedule('promote')
-                self._async_executor.run_async(self.state_handler.promote, args=(self.dcs.loop_wait,))
+                self._async_executor.run_async(self.state_handler.promote,
+                                               args=(self.dcs.loop_wait, self._leader_access_is_restricted))
            return promote_message

    @staticmethod
@@ -452,7 +526,7 @@ class Ha(object):
            logger.info('Got response from %s %s: %s', member.name, member.api_url, response.content)
            return _MemberStatus.from_api_response(member, response.json())
        except Exception as e:
-            logger.warning("request failed: GET %s (%s)", member.api_url, e)
+            logger.warning("Request failed to %s: GET %s (%s)", member.name, member.api_url, e)
        return _MemberStatus.unknown(member)

    def fetch_nodes_statuses(self, members):
@@ -620,6 +694,7 @@ class Ha(object):
        self.state_handler.stop(mode_control['stop'], checkpoint=mode_control['checkpoint'],
                                on_safepoint=self.watchdog.disable if self.watchdog.is_running else None)
        self.state_handler.set_role('demoted')
+        self.set_is_leader(False)

        if mode_control['release']:
            self.release_leader_key_voluntarily()
@@ -736,8 +811,18 @@ class Ha(object):
                        logger.info('Cleaning up failover key after acquiring leader lock...')
                        self.dcs.manual_failover('', '')
                self.load_cluster_from_dcs()
-                return self.enforce_master_role('acquired session lock as a leader',
-                                                'promoted self to leader by acquiring session lock')
+
+                if self.is_standby_cluster():
+                    # standby leader disappeared, and this is a healthiest
+                    # replica, so it should become a new standby leader.
+                    # This imply that we need to start following a remote master
+                    msg = 'promoted self to a standby leader because i had the session lock'
+                    return self.enforce_follow_remote_master(msg)
+                else:
+                    return self.enforce_master_role(
+                        'acquired session lock as a leader',
+                        'promoted self to leader by acquiring session lock'
+                    )
            else:
                return self.follow('demoted self after trying and failing to obtain lock',
                                   'following new leader after trying and failing to obtain lock')
@@ -764,13 +849,27 @@ class Ha(object):
                self.dcs.reset_cluster()
                return 'removed leader lock because postgres is not running as master'

+            if self.state_handler.is_leader() and self._leader_access_is_restricted:
+                self.state_handler.sync_replication_slots(self.cluster)
+                self.state_handler.call_nowait(ACTION_ON_ROLE_CHANGE)
+                self.set_leader_access_is_restricted(False)
+
            if self.update_lock(True):
                msg = self.process_manual_failover_from_leader()
                if msg is not None:
                    return msg

-                return self.enforce_master_role('no action.  i am the leader with the lock',
-                                                'promoted self to leader because i had the session lock')
+                if self.is_standby_cluster():
+                    # in case of standby cluster we don't really need to
+                    # enforce anything, since the leader is not a master.
+                    # So just remind the role.
+                    msg = 'no action.  i am the standby leader with the lock'
+                    return self.enforce_follow_remote_master(msg)
+                else:
+                    return self.enforce_master_role(
+                        'no action.  i am the leader with the lock',
+                        'promoted self to leader because i had the session lock'
+                    )
            else:
                # Either there is no connection to DCS or someone else acquired the lock
                logger.error('failed to update leader lock')
@@ -900,7 +999,8 @@ class Ha(object):

    def _do_reinitialize(self, cluster):
        self.state_handler.stop('immediate')
-        self.state_handler.remove_data_directory()
+        # Commented redundant data directory cleanup here
+        # self.state_handler.remove_data_directory()

        clone_member = self.cluster.get_clone_member(self.state_handler.name)
        member_role = 'leader' if clone_member == self.cluster.leader else 'replica'
@@ -993,10 +1093,12 @@ class Ha(object):
        if not self.watchdog.activate():
            logger.error('Cancelling bootstrap because watchdog activation failed')
            self.cancel_initialization()
+        self.state_handler.sync_replication_slots(self.cluster)
        self.dcs.take_leader()
        self.set_is_leader(True)
        self.state_handler.call_nowait(ACTION_ON_START)
        self.load_cluster_from_dcs()
+
        return 'initialized a new cluster'

    def handle_starting_instance(self):
@@ -1150,11 +1252,11 @@ class Ha(object):
                # stops PostgreSQL, therefore, we only reload replication slots if no
                # asynchronous processes are running (should be always the case for the master)
                if not self._async_executor.busy and not self.state_handler.is_starting():
+                    self.state_handler.sync_replication_slots(self.cluster)
                    if not self.state_handler.cb_called:
                        if not self.state_handler.is_leader():
                            self.state_handler.trigger_check_diverged_lsn()
                        self.state_handler.call_nowait(ACTION_ON_START)
-                    self.state_handler.sync_replication_slots(self.cluster)
        except DCSError:
            dcs_failed = True
            logger.error('Error communicating with DCS')
@@ -1211,3 +1313,26 @@ class Ha(object):
        no "active" leader watch request in progress.
        This usually happens on the master or if the node is running async action"""
        self.dcs.event.set()
+
+    def get_remote_master(self):
+        """ In case of standby cluster this will tel us from which remote
+            master to stream. Config can be both patroni config or
+            cluster.config.data
+        """
+        cluster_params = self.get_standby_cluster_config()
+
+        if cluster_params:
+            unique_name = 'remote_master:{}'.format(uuid.uuid1())
+            data = {
+                'conn_kwargs': {
+                    "host": cluster_params.get('host'),
+                    "port": cluster_params.get('port'),
+                },
+                'no_replication_slot': 'primary_slot_name' not in cluster_params,
+            }
+            data.update({
+                k: v for k, v in cluster_params.items()
+                if k in RemoteMember.allowed_keys()
+            })
+
+            return RemoteMember(unique_name, data)
@@ -15,11 +15,13 @@ from patroni.callback_executor import CallbackExecutor
 from patroni.exceptions import PostgresConnectionException, PostgresException
 from patroni.utils import compare_values, parse_bool, parse_int, Retry, RetryFailedError, polling_loop, split_host_port
 from patroni.postmaster import PostmasterProcess
+from patroni.dcs import slot_name_from_member_name, RemoteMember
 from requests.structures import CaseInsensitiveDict
 from six import string_types
 from six.moves.urllib.parse import quote_plus
 from threading import current_thread, Lock

+
 logger = logging.getLogger(__name__)

 ACTION_ON_START = "on_start"
@@ -35,14 +37,16 @@ STATE_UNKNOWN = 'unknown'

 STOP_POLLING_INTERVAL = 1
 REWIND_STATUS = type('Enum', (), {'INITIAL': 0, 'CHECK': 1, 'NEED': 2, 'NOT_NEED': 3, 'SUCCESS': 4, 'FAILED': 5})
-sync_standby_name_re = re.compile('^[A-Za-z_][A-Za-z_0-9\$]*$')
+sync_standby_name_re = re.compile(r'^[A-Za-z_][A-Za-z_0-9\$]*$')

-cluster_info_query = ("SELECT CASE WHEN pg_is_in_recovery() THEN 0 "
-                      "ELSE ('x' || SUBSTR(pg_{0}file_name(pg_current_{0}_{1}()), 1, 8))::bit(32)::int END, "
-                      "CASE WHEN pg_is_in_recovery() THEN GREATEST("
-                      " pg_{0}_{1}_diff(COALESCE(pg_last_{0}_receive_{1}(), '0/0'), '0/0')::bigint,"
-                      " pg_{0}_{1}_diff(pg_last_{0}_replay_{1}(), '0/0')::bigint)"
-                      "ELSE pg_{0}_{1}_diff(pg_current_{0}_{1}(), '0/0')::bigint END")
+cluster_info_query = ("SELECT CASE WHEN pg_catalog.pg_is_in_recovery() THEN 0 "
+                      "ELSE ('x' || pg_catalog.substr(pg_catalog.pg_{0}file_name("
+                      "pg_catalog.pg_current_{0}_{1}()), 1, 8))::bit(32)::int END, "
+                      "CASE WHEN pg_catalog.pg_is_in_recovery() THEN GREATEST("
+                      " pg_catalog.pg_{0}_{1}_diff(COALESCE("
+                      "pg_catalog.pg_last_{0}_receive_{1}(), '0/0'), '0/0')::bigint,"
+                      " pg_catalog.pg_{0}_{1}_diff(pg_catalog.pg_last_{0}_replay_{1}(), '0/0')::bigint)"
+                      "ELSE pg_catalog.pg_{0}_{1}_diff(pg_catalog.pg_current_{0}_{1}(), '0/0')::bigint END")


 def quote_ident(value):
@@ -50,22 +54,6 @@ def quote_ident(value):
    return value if sync_standby_name_re.match(value) else '"' + value + '"'


-def slot_name_from_member_name(member_name):
-    """Translate member name to valid PostgreSQL slot name.
-
-    PostgreSQL replication slot names must be valid PostgreSQL names. This function maps the wider space of
-    member names to valid PostgreSQL names. Names are lowercased, dashes and periods common in hostnames
-    are replaced with underscores, other characters are encoded as their unicode codepoint. Name is truncated
-    to 64 characters. Multiple different member names may map to a single slot name."""
-
-    def replace_char(match):
-        c = match.group(0)
-        return '_' if c in '-.' else "u{:04d}".format(ord(c))
-
-    slot_name = re.sub('[^a-z0-9_]', replace_char, member_name.lower())
-    return slot_name[0:63]
-
-
@contextmanager
 def null_context():
    yield
@@ -152,7 +140,7 @@ class Postgresql(object):
        self._connection = None
        self._cursor_holder = None
        self._sysid = None
-        self._replication_slots = []  # list of already existing replication slots
+        self._replication_slots = {}  # already existing replication slots
        self.retry = Retry(max_tries=-1, deadline=config['retry_timeout']/2.0, max_delay=1,
                           retry_exceptions=PostgresConnectionException)

@@ -322,8 +310,8 @@ class Postgresql(object):
                    changes['wal_segment_size'] = '16384kB'
                # XXX: query can raise an exception
                for r in self.query("""SELECT name, setting, unit, vartype, context
-                                         FROM pg_settings
-                                        WHERE LOWER(name) IN (""" + ', '.join(['%s'] * len(changes)) + """)
+                                         FROM pg_catalog.pg_settings
+                                        WHERE pg_catalog.lower(name) IN (""" + ', '.join(['%s'] * len(changes)) + """)
                                        ORDER BY 1 DESC""", *(k.lower() for k in changes.keys())):
                    if r[4] == 'internal':
                        if r[0] == 'wal_segment_size':
@@ -638,7 +626,8 @@ class Postgresql(object):
            return os.environ.copy()

        with open(self._pgpass, 'w') as f:
-            os.fchmod(f.fileno(), 0o600)
+            if os.name != 'nt':
+                os.fchmod(f.fileno(), 0o600)
            f.write('{host}:{port}:*:{user}:{password}\n'.format(**record))

        env = os.environ.copy()
@@ -665,9 +654,17 @@ class Postgresql(object):
        self.set_state('creating replica')
        self._sysid = None

-        # get list of replica methods from config.
-        # If there is no configuration key, or no value is specified, use basebackup
-        replica_methods = self._create_replica_methods or ['basebackup']
+        is_remote_master = isinstance(clone_member, RemoteMember)
+        create_replica_methods = is_remote_master and clone_member.create_replica_methods
+
+        # get list of replica methods either from clone member or from
+        # the config. If there is no configuration key, or no value is
+        # specified, use basebackup
+        replica_methods = (
+            create_replica_methods
+            or self._create_replica_methods
+            or ['basebackup']
+        )

        if clone_member and clone_member.conn_url:
            r = clone_member.conn_kwargs(self._replication)
@@ -695,8 +692,10 @@ class Postgresql(object):
                    # if basebackup succeeds, exit with success
                    break
            else:
-                if not self.data_directory_empty():
+                if not self.data_directory_empty() and not self.config.get(replica_method, {}).get('keep_data', False):
                    self.remove_data_directory()
+                else:
+                    logger.info('Leaving data directory uncleaned')

                cmd = replica_method
                method_config = {}
@@ -709,10 +708,14 @@ class Postgresql(object):
                    cmd = method_config.pop('command', cmd)

                # add the default parameters
-                method_config.update({"scope": self.scope,
-                                      "role": "replica",
-                                      "datadir": self._data_dir,
-                                      "connstring": connstring})
+                if not method_config.get('no_params', False):
+                    method_config.update({"scope": self.scope,
+                                          "role": "replica",
+                                          "datadir": self._data_dir,
+                                          "connstring": connstring})
+                else:
+                    for param in ('no_params', 'no_master', 'keep_data'):
+                        method_config.pop(param, None)
                params = ["--{0}={1}".format(arg, val) for arg, val in method_config.items()]
                try:
                    # call script with the full set of parameters
@@ -940,12 +943,12 @@ class Postgresql(object):
            with self._get_connection_cursor(**connect_kwargs) as cur:
                cur.execute("SET statement_timeout = 0")
                if check_not_is_in_recovery:
-                    cur.execute('SELECT pg_is_in_recovery()')
+                    cur.execute('SELECT pg_catalog.pg_is_in_recovery()')
                    if cur.fetchone()[0]:
                        return 'is_in_recovery=true'
                return cur.execute('CHECKPOINT')
        except psycopg2.Error:
-            logging.exception('Exception during CHECKPOINT')
+            logger.exception('Exception during CHECKPOINT')
            return 'not accessible or not healty'

    def stop(self, mode='fast', block_callbacks=False, checkpoint=None, on_safepoint=None):
@@ -1114,9 +1117,10 @@ class Postgresql(object):
            # therefore we need to make sure that hba_file is not overriden
            # after changing superuser password we will "revert" all these "changes"
            if self._running_custom_bootstrap or 'hba_file' not in self._server_parameters:
-                f.write("hba_file = '{0}'\n".format(self._pg_hba_conf))
+                f.write("hba_file = '{0}'\n".format(self._pg_hba_conf.replace('\\', '\\\\')))
            if 'ident_file' not in self._server_parameters:
-                f.write("ident_file = '{0}'\n".format(os.path.join(self._config_dir, 'pg_ident.conf')))
+                s = "ident_file = '{0}'\n".format(os.path.join(self._config_dir, 'pg_ident.conf').replace('\\', '\\\\'))
+                f.write(s)

    def is_healthy(self):
        if not self.is_running():
@@ -1192,7 +1196,7 @@ class Postgresql(object):
            ('user', r.get('user')),
            ('host', r.get('host')),
            ('port', r.get('port')),
-            ('dbname', r.get('database')),
+            ('dbname', r.get('database') or self._database),
            ('sslmode', 'prefer'),
            ('sslcompression', '1'),
        ]
@@ -1211,12 +1215,15 @@ class Postgresql(object):
        # Don't try to call pg_controldata during backup restore
        if self._version_file_exists() and self.state != 'creating replica':
            try:
-                data = subprocess.check_output([self._pgcommand('pg_controldata'), self._data_dir],
-                                               env={'LANG': 'C', 'LC_ALL': 'C', 'PATH': os.environ['PATH']})
+                env = {'LANG': 'C', 'LC_ALL': 'C', 'PATH': os.getenv('PATH')}
+                if os.getenv('SYSTEMROOT') is not None:
+                    env['SYSTEMROOT'] = os.getenv('SYSTEMROOT')
+                data = subprocess.check_output([self._pgcommand('pg_controldata'), self._data_dir], env=env)
                if data:
                    data = data.decode('utf-8').splitlines()
                    # pg_controldata output depends on major verion. Some of parameters are prefixed by 'Current '
-                    result = {l.split(':')[0].replace('Current ', '', 1): l.split(':', 1)[1].strip() for l in data if l}
+                    result = {l.split(':')[0].replace('Current ', '', 1): l.split(':', 1)[1].strip() for l in data
+                              if l and ':' in l}
            except subprocess.CalledProcessError:
                logger.exception("Error when calling pg_controldata")
        return result
@@ -1234,8 +1241,9 @@ class Postgresql(object):
                yield cur

    @contextmanager
-    def _get_replication_connection_cursor(self, host='localhost', port=5432, **kwargs):
-        with self._get_connection_cursor(host=host, port=int(port), database=self._database, replication=1,
+    def _get_replication_connection_cursor(self, host='localhost', port=5432, database=None, **kwargs):
+        database = database or self._database
+        with self._get_connection_cursor(host=host, port=int(port), database=database, replication='database',
                                         user=self._replication['username'], password=self._replication['password'],
                                         connect_timeout=3, options='-c statement_timeout=2000') as cur:
            yield cur
@@ -1243,7 +1251,7 @@ class Postgresql(object):
    def check_leader_is_not_in_recovery(self, **kwargs):
        try:
            with self._get_connection_cursor(connect_timeout=3, options='-c statement_timeout=2000', **kwargs) as cur:
-                cur.execute('SELECT pg_is_in_recovery()')
+                cur.execute('SELECT pg_catalog.pg_is_in_recovery()')
                if not cur.fetchone()[0]:
                    return True
                logger.info('Leader is still in_recovery and therefore can\'t be used for rewind')
@@ -1354,10 +1362,10 @@ class Postgresql(object):
        history_path = 'pg_{0}/{1:08X}.history'.format(self.wal_name, timeline)
        try:
            cursor = self._cursor()
-            cursor.execute('SELECT isdir, modification FROM pg_stat_file(%s)', (history_path,))
+            cursor.execute('SELECT isdir, modification FROM pg_catalog.pg_stat_file(%s)', (history_path,))
            isdir, modification = cursor.fetchone()
            if not isdir:
-                cursor.execute('SELECT pg_read_file(%s)', (history_path,))
+                cursor.execute('SELECT pg_catalog.pg_read_file(%s)', (history_path,))
                history = list(self.parse_history(cursor.fetchone()[0]))
                if history[-1][0] == timeline - 1:
                    history[-1].append(modification.isoformat())
@@ -1412,6 +1420,12 @@ class Postgresql(object):
        return self._rewind_state == REWIND_STATUS.FAILED

    def follow(self, member, timeout=None):
+        is_remote_master = isinstance(member, RemoteMember)
+        no_replication_slot = is_remote_master and member.no_replication_slot
+        restore_command = is_remote_master and member.restore_command
+        min_apply_delay = is_remote_master and member.recovery_min_apply_delay
+        archive_cleanup = is_remote_master and member.archive_cleanup_command
+
        primary_conninfo = self.primary_conninfo(member)
        change_role = self.role in ('master', 'demoted')

@@ -1419,8 +1433,16 @@ class Postgresql(object):
        recovery_params.update({'standby_mode': 'on', 'recovery_target_timeline': 'latest'})
        if primary_conninfo:
            recovery_params['primary_conninfo'] = primary_conninfo
-        if self.use_slots:
-            recovery_params['primary_slot_name'] = slot_name_from_member_name(self.name)
+        if self.use_slots and not no_replication_slot:
+            required_name = is_remote_master and member.data.get('primary_slot_name')
+            name = required_name or slot_name_from_member_name(self.name)
+            recovery_params['primary_slot_name'] = name
+        if restore_command:
+            recovery_params['restore_command'] = restore_command
+        if min_apply_delay:
+            recovery_params['recovery_min_apply_delay'] = min_apply_delay
+        if archive_cleanup:
+            recovery_params['archive_cleanup_command'] = archive_cleanup

        self.write_recovery_conf(recovery_params)

@@ -1472,7 +1494,7 @@ class Postgresql(object):
            if data.get('Database cluster state') == 'in production':
                return True

-    def promote(self, wait_seconds):
+    def promote(self, wait_seconds, access_is_restricted=False):
        if self.role == 'master':
            return True
        ret = self.pg_ctl('promote', '-W')
@@ -1480,7 +1502,8 @@ class Postgresql(object):
            self.set_role('master')
            logger.info("cleared rewind state after becoming the leader")
            self._rewind_state = REWIND_STATUS.INITIAL
-            self.call_nowait(ACTION_ON_ROLE_CHANGE)
+            if not access_is_restricted:
+                self.call_nowait(ACTION_ON_ROLE_CHANGE)
            ret = self._wait_promote(wait_seconds)
        return ret

@@ -1513,59 +1536,88 @@ $$""".format(name, ' '.join(options)), name, password, password)

    def load_replication_slots(self):
        if self.use_slots and self._schedule_load_slots:
-            cursor = self._query("SELECT slot_name FROM pg_replication_slots WHERE slot_type='physical'")
-            self._replication_slots = [r[0] for r in cursor]
+            replication_slots = {}
+            cursor = self._query('SELECT slot_name, slot_type, plugin, database FROM pg_catalog.pg_replication_slots')
+            for r in cursor:
+                value = {'type': r[1]}
+                if r[1] == 'logical':
+                    value.update({'plugin': r[2], 'database': r[3]})
+                replication_slots[r[0]] = value
+            self._replication_slots = replication_slots
            self._schedule_load_slots = False

    def postmaster_start_time(self):
        try:
-            cursor = self.query("""SELECT to_char(pg_postmaster_start_time(), 'YYYY-MM-DD HH24:MI:SS.MS TZ')""")
+            cursor = self.query("SELECT pg_catalog.to_char(pg_catalog.pg_postmaster_start_time(),"
+                                " 'YYYY-MM-DD HH24:MI:SS.MS TZ')")
            return cursor.fetchone()[0]
        except psycopg2.Error:
            return None

+    def drop_replication_slot(self, name):
+        cursor = self._query(('SELECT pg_catalog.pg_drop_replication_slot(%s) WHERE EXISTS (SELECT 1 ' +
+                              'FROM pg_catalog.pg_replication_slots WHERE slot_name = %s AND NOT active)'), name, name)
+        # In normal situation rowcount should be 1, otherwise either slot doesn't exists or it is still active
+        return cursor.rowcount == 1
+
+    @staticmethod
+    def compare_slots(s1, s2):
+        return s1['type'] == s2['type'] and\
+                (s1['type'] == 'physical' or s1['database'] == s2['database'] and s1['plugin'] == s2['plugin'])
+
    def sync_replication_slots(self, cluster):
        if self.use_slots:
            try:
                self.load_replication_slots()
-                # if the replicatefrom tag is set on the member - we should not create the replication slot for it on
-                # the current master, because that member would replicate from elsewhere. We still create the slot if
-                # the replicatefrom destination member is currently not a member of the cluster (fallback to the
-                # master), or if replicatefrom destination member happens to be the current master
-                if self.role == 'master':
-                    slot_members = [m.name for m in cluster.members if m.name != self.name and
-                                    (m.replicatefrom is None or m.replicatefrom == self.name or
-                                     not cluster.has_member(m.replicatefrom))]
-                else:
-                    # only manage slots for replicas that replicate from this one, except for the leader among them
-                    slot_members = [m.name for m in cluster.members if m.replicatefrom == self.name and
-                                    m.name != cluster.leader.name]
-                slots = set(slot_name_from_member_name(name) for name in slot_members)

-                if len(slots) < len(slot_members):
-                    # Find which names are conflicting for a nicer error message
-                    slot_conflicts = defaultdict(list)
-                    for name in slot_members:
-                        slot_conflicts[slot_name_from_member_name(name)].append(name)
-                    logger.error("Following cluster members share a replication slot name: %s",
-                                 "; ".join("{} map to {}".format(", ".join(v), k)
-                                           for k, v in slot_conflicts.items() if len(v) > 1))
+                slots = cluster.get_replication_slots(self.name, self.role)

-                # drop unused slots
-                for slot in set(self._replication_slots) - slots:
-                    cursor = self._query("""SELECT pg_drop_replication_slot(%s)
-                                             WHERE EXISTS(SELECT 1 FROM pg_replication_slots
-                                             WHERE slot_name = %s AND NOT active)""", slot, slot)
+                # drop old replication slots which are not presented in desired slots
+                for name in set(self._replication_slots) - set(slots):
+                    if not self.drop_replication_slot(name):
+                        logger.error("Failed to drop replication slot '%s'", name)
+                        self._schedule_load_slots = True

-                    if cursor.rowcount != 1:  # Either slot doesn't exists or it is still active
-                        self._schedule_load_slots = True  # schedule load_replication_slots on the next iteration
+                immediately_reserve = ', true' if self._major_version >= 90600 else ''

-                # create new slots
-                for slot in slots - set(self._replication_slots):
-                    self._query("""SELECT pg_create_physical_replication_slot(%s)
-                                    WHERE NOT EXISTS (SELECT 1 FROM pg_replication_slots
-                                    WHERE slot_name = %s)""", slot, slot)
+                logical_slots = defaultdict(dict)
+                for name, value in slots.items():
+                    if name in self._replication_slots and not self.compare_slots(value, self._replication_slots[name]):
+                        logger.info("Trying to drop replication slot '%s' because value is changing from %s to %s",
+                                    name, self._replication_slots[name], value)
+                        if not self.drop_replication_slot(name):
+                            logger.error("Failed to drop replication slot '%s'", name)
+                            self._schedule_load_slots = True
+                            continue
+                        self._replication_slots.pop(name)
+                    if name not in self._replication_slots:
+                        if value['type'] == 'physical':
+                            try:
+                                self._query(("SELECT pg_catalog.pg_create_physical_replication_slot(%s{0})" +
+                                             " WHERE NOT EXISTS (SELECT 1 FROM pg_catalog.pg_replication_slots" +
+                                             " WHERE slot_type = 'physical' AND slot_name = %s)").format(
+                                                 immediately_reserve), name, name)
+                            except Exception:
+                                logger.exception("Failed to create physical replication slot '%s'", name)
+                                self._schedule_load_slots = True
+                        elif value['type'] == 'logical' and name not in self._replication_slots:
+                            logical_slots[value['database']][name] = value

+                # create new logical slots
+                for database, values in logical_slots.items():
+                    conn_kwargs = self._local_connect_kwargs
+                    conn_kwargs['database'] = database
+                    with self._get_connection_cursor(**conn_kwargs) as cur:
+                        for name, value in values.items():
+                            try:
+                                cur.execute("SELECT pg_catalog.pg_create_logical_replication_slot(%s, %s)" +
+                                            " WHERE NOT EXISTS (SELECT 1 FROM pg_catalog.pg_replication_slots" +
+                                            " WHERE slot_type = 'logical' AND slot_name = %s)",
+                                            (name, value['plugin'], name))
+                            except Exception:
+                                logger.exception("Failed to create logical replication slot '%s' plugin='%s'",
+                                                 name, value['plugin'])
+                                self._schedule_load_slots = True
                self._replication_slots = slots
            except Exception:
                logger.exception('Exception when changing replication slots')
@@ -1722,9 +1774,9 @@ $$""".format(name, ' '.join(options)), name, password, password)
        # Pick candidates based on who has flushed WAL farthest.
        # TODO: for synchronous_commit = remote_write we actually want to order on write_location
        for app_name, state, sync_state in self.query(
-                """SELECT LOWER(application_name), state, sync_state
-                     FROM pg_stat_replication
-                    ORDER BY flush_{0} DESC""".format(self.lsn_name)):
+                "SELECT pg_catalog.lower(application_name), state, sync_state"
+                " FROM pg_catalog.pg_stat_replication"
+                " ORDER BY flush_{0} DESC".format(self.lsn_name)):
            member = members.get(app_name)
            if state != 'streaming' or not member or member.tags.get('nosync', False):
                continue
@@ -1733,7 +1785,7 @@ $$""".format(name, ' '.join(options)), name, password, password)
            if sync_state == 'potential' and app_name == current:
                # Prefer current even if not the best one any more to avoid indecisivness and spurious swaps.
                return current, False
-            if sync_state == 'async':
+            if sync_state in ('async', 'potential'):
                candidates.append(app_name)

        if candidates:
@@ -12,7 +12,7 @@ logger = logging.getLogger(__name__)
 STOP_SIGNALS = {
    'smart': signal.SIGTERM,
    'fast': signal.SIGINT,
-    'immediate': signal.SIGQUIT,
+    'immediate': signal.SIGQUIT if os.name != 'nt' else signal.SIGABRT,
 }


@@ -138,7 +138,8 @@ class PostmasterProcess(psutil.Process):
        # of init process to take care about postmaster.
        # In order to make everything portable we can't use fork&exec approach here, so  we will call
        # ourselves and pass list of arguments which must be used to start postgres.
-        env = {p: os.environ[p] for p in ('PATH', 'LD_LIBRARY_PATH', 'LC_ALL', 'LANG') if p in os.environ}
+        # On Windows, in order to run a side-by-side assembly the specified env must include a valid SYSTEMROOT.
+        env = {p: os.environ[p] for p in ('PATH', 'LD_LIBRARY_PATH', 'LC_ALL', 'LANG', 'SYSTEMROOT') if p in os.environ}
        try:
            proc = PostmasterProcess._from_pidfile(data_dir)
            if proc and not proc._is_postmaster_process():
@@ -153,10 +154,10 @@ class PostmasterProcess(psutil.Process):
                env['PG_GRANDPARENT_PID'] = str(proc.pid)
        except psutil.NoSuchProcess:
            pass
-
-        proc = call_self(['pg_ctl_start', pgcommand, '-D', data_dir,
-                          '--config-file={}'.format(conf)] + options, close_fds=True,
-                         preexec_fn=os.setsid, stdout=subprocess.PIPE, env=env)
+        cmdline = [pgcommand, '-D', data_dir, '--config-file={}'.format(conf)] + options
+        logger.debug("Starting postgres: %s", " ".join(cmdline))
+        proc = call_self(['pg_ctl_start'] + cmdline, close_fds=(os.name != 'nt'),
+                         stdout=subprocess.PIPE, stderr=subprocess.STDOUT, env=env)
        pid = int(proc.stdout.readline().strip())
        proc.wait()
        logger.info('postmaster pid=%s', pid)
@@ -224,13 +224,12 @@ class WALERestore(object):
                            lsn_name = 'location'
                        con.autocommit = True
                        with con.cursor() as cur:
-                            cur.execute("""SELECT CASE WHEN pg_is_in_recovery()
-                                                       THEN GREATEST(
-                                                                pg_{0}_{1}_diff(COALESCE(
-                                                                  pg_last_{0}_receive_{1}(), '0/0'), %s)::bigint,
-                                                                pg_{0}_{1}_diff(pg_last_{0}_replay_{1}(), %s)::bigint)
-                                                       ELSE pg_{0}_{1}_diff(pg_current_{0}_{1}(), %s)::bigint
-                                                   END""".format(wal_name, lsn_name),
+                            cur.execute(("SELECT CASE WHEN pg_catalog.pg_is_in_recovery()"
+                                         " THEN GREATEST(pg_catalog.pg_{0}_{1}_diff(COALESCE("
+                                         "pg_last_{0}_receive_{1}(), '0/0'), %s)::bigint, "
+                                         "pg_catalog.pg_{0}_{1}_diff(pg_catalog.pg_last_{0}_replay_{1}(), %s)::bigint)"
+                                         " ELSE pg_catalog.pg_{0}_{1}_diff(pg_catalog.pg_current_{0}_{1}(), %s)::bigint"
+                                         " END").format(wal_name, lsn_name),
                                        (backup_start_lsn, backup_start_lsn, backup_start_lsn))

                            diff_in_bytes = int(cur.fetchone()[0])
@@ -1 +1 @@
-__version__ = '1.4.5'
+__version__ = '1.5.2'
@@ -11,6 +11,11 @@ restapi:
 #    username: username
 #    password: password

+# ctl:
+#   insecure: false # Allow connections to SSL sites without certs
+#   certfile: /etc/ssl/certs/ssl-cert-snakeoil.pem
+#   cacert: /etc/ssl/certs/ssl-cacert-snakeoil.pem
+
 etcd:
  host: 127.0.0.1:2379

@@ -24,6 +29,10 @@ bootstrap:
    maximum_lag_on_failover: 1048576
 #    master_start_timeout: 300
 #    synchronous_mode: false
+    #standby_cluster:
+      #host: 127.0.0.1
+      #port: 1111
+      #primary_slot_name: patroni
    postgresql:
      use_pg_rewind: true
 #      use_slots: true
@@ -11,6 +11,11 @@ restapi:
 #    username: username
 #    password: password

+# ctl:
+#   insecure: false # Allow connections to SSL sites without certs
+#   certfile: /etc/ssl/certs/ssl-cert-snakeoil.pem
+#   cacert: /etc/ssl/certs/ssl-cacert-snakeoil.pem
+
 etcd:
  host: 127.0.0.1:2379

@@ -11,6 +11,11 @@ restapi:
    username: username
    password: password

+# ctl:
+#   insecure: false # Allow connections to SSL sites without certs
+#   certfile: /etc/ssl/certs/ssl-cert-snakeoil.pem
+#   cacert: /etc/ssl/certs/ssl-cacert-snakeoil.pem
+
 etcd:
  host: 127.0.0.1:2379

@@ -32,9 +32,10 @@ VERSION = read_version(MAIN_PACKAGE)
 DESCRIPTION = 'PostgreSQL High-Available orchestrator and CLI'
 LICENSE = 'The MIT License'
 URL = 'https://github.com/zalando/patroni'
-AUTHOR = 'Alexander Kukushkin, Oleksii Kliukin, Feike Steenbergen'
-AUTHOR_EMAIL = '[email protected], [email protected], [email protected]'
-KEYWORDS = 'etcd governor patroni postgresql postgres ha haproxy confd zookeeper exhibitor consul streaming replication'
+AUTHOR = 'Alexander Kukushkin, Dmitrii Dolgov, Oleksii Kliukin'
+AUTHOR_EMAIL = '[email protected], [email protected], [email protected]'
+KEYWORDS = 'etcd governor patroni postgresql postgres ha haproxy confd' +\
+    ' zookeeper exhibitor consul streaming replication kubernetes k8s'

 COVERAGE_XML = True
 COVERAGE_HTML = False
@@ -43,14 +44,18 @@ JUNIT_XML = True
 # Add here all kinds of additional classifiers as defined under
 # https://pypi.python.org/pypi?%3Aaction=list_classifiers
 CLASSIFIERS = [
-    'Development Status :: 4 - Beta',
+    'Development Status :: 5 - Production/Stable',
    'Environment :: Console',
    'Intended Audience :: Developers',
    'Intended Audience :: System Administrators',
    'License :: OSI Approved :: MIT License',
+    'Operating System :: MacOS',
    'Operating System :: POSIX :: Linux',
+    'Operating System :: POSIX :: BSD :: FreeBSD',
+    'Operating System :: Microsoft :: Windows',
    'Programming Language :: Python',
    'Programming Language :: Python :: 2.7',
+    'Programming Language :: Python :: 3',
    'Programming Language :: Python :: 3.4',
    'Programming Language :: Python :: 3.5',
    'Programming Language :: Python :: 3.6',
@@ -102,6 +107,8 @@ class PyTest(TestCommand):
        silence = logging.WARNING
        logging.basicConfig(format='%(asctime)s %(levelname)s: %(message)s', level=os.getenv('LOGLEVEL', silence))
        params['args'] += ['-s' if logging.getLogger().getEffectiveLevel() < silence else '--capture=fd']
+        if not os.getenv('SYSTEMROOT'):
+            os.environ['SYSTEMROOT'] = '/'
        errno = pytest.main(**params)
        sys.exit(errno)

@@ -95,6 +95,10 @@ class MockHa(object):
    def is_paused():
        return True

+    @staticmethod
+    def is_standby_cluster():
+        return False
+

 class MockPatroni(object):

@@ -155,6 +159,7 @@ class TestRestApiHandler(unittest.TestCase):
        with patch.object(RestApiHandler, 'get_postgresql_status', Mock(return_value={'role': 'replica'})):
            MockRestApiServer(RestApiHandler, 'GET /synchronous')
        with patch.object(RestApiHandler, 'get_postgresql_status', Mock(return_value={'role': 'replica'})):
+            MockPatroni.dcs.cluster.sync.sync_standby = ''
            MockRestApiServer(RestApiHandler, 'GET /asynchronous')
        MockPatroni.ha.is_leader = Mock(return_value=True)
        MockRestApiServer(RestApiHandler, 'GET /replica')
@@ -166,6 +171,8 @@ class TestRestApiHandler(unittest.TestCase):
        self.assertIsNotNone(MockRestApiServer(RestApiHandler, 'GET /master'))
        with patch.object(RestApiServer, 'query', Mock(return_value=[('', 1, '', '', '', '', False, '')])):
            self.assertIsNotNone(MockRestApiServer(RestApiHandler, 'GET /patroni'))
+        with patch.object(MockHa, 'is_standby_cluster', Mock(return_value=True)):
+            MockRestApiServer(RestApiHandler, 'GET /standby_leader')

    def test_do_OPTIONS(self):
        self.assertIsNotNone(MockRestApiServer(RestApiHandler, 'OPTIONS / HTTP/1.0'))
@@ -23,7 +23,7 @@ class TestConfig(unittest.TestCase):
    def test_set_dynamic_configuration(self):
        with patch.object(Config, '_build_effective_configuration', Mock(side_effect=Exception)):
            self.assertIsNone(self.config.set_dynamic_configuration({'foo': 'bar'}))
-        self.assertTrue(self.config.set_dynamic_configuration({'synchronous_mode': True}))
+        self.assertTrue(self.config.set_dynamic_configuration({'synchronous_mode': True, 'standby_cluster': {}}))

    def test_reload_local_configuration(self):
        os.environ.update({
@@ -70,12 +70,13 @@ class TestConfig(unittest.TestCase):
                self.assertRaises(Exception, config.reload_local_configuration, True)
            self.assertTrue(config.reload_local_configuration(True))
            self.assertTrue(config.reload_local_configuration())
+            self.assertIsNone(config.reload_local_configuration())

    @patch('tempfile.mkstemp', Mock(return_value=[3000, 'blabla']))
    @patch('os.path.exists', Mock(return_value=True))
    @patch('os.remove', Mock(side_effect=IOError))
    @patch('os.close', Mock(side_effect=IOError))
-    @patch('os.rename', Mock(return_value=None))
+    @patch('shutil.move', Mock(return_value=None))
    @patch('json.dump', Mock())
    def test_save_cache(self):
        self.config.set_dynamic_configuration({'ttl': 30, 'postgresql': {'foo': 'bar'}})
@@ -62,7 +62,7 @@ class TestHTTPClient(unittest.TestCase):

    def test_put(self):
        self.client.put(Mock(), '/v1/session/create')
-        self.client.put(Mock(), '/v1/session/create', data='{"foo": "bar"}')
+        self.client.put(Mock(), '/v1/session/create', params=[], data='{"foo": "bar"}')


@patch.object(consul.Consul.KV, 'get', kv_get)
@@ -74,10 +74,12 @@ class TestConsul(unittest.TestCase):
    @patch.object(consul.Consul.KV, 'delete', Mock())
    def setUp(self):
        Consul({'ttl': 30, 'scope': 't', 'name': 'p', 'url': 'https://l:1', 'retry_timeout': 10,
-                'verify': 'on', 'key': 'foo', 'cert': 'bar', 'cacert': 'buz', 'token': 'asd', 'dc': 'dc1'})
-        Consul({'ttl': 30, 'scope': 't', 'name': 'p', 'url': 'https://l:1', 'retry_timeout': 10,
-                'verify': 'on', 'cert': 'bar', 'cacert': 'buz'})
-        self.c = Consul({'ttl': 30, 'scope': 'test', 'name': 'postgresql1', 'host': 'localhost:1', 'retry_timeout': 10})
+                'verify': 'on', 'key': 'foo', 'cert': 'bar', 'cacert': 'buz', 'token': 'asd', 'dc': 'dc1',
+                'register_service': True})
+        Consul({'ttl': 30, 'scope': 't_', 'name': 'p', 'url': 'https://l:1', 'retry_timeout': 10,
+                'verify': 'on', 'cert': 'bar', 'cacert': 'buz', 'register_service': True})
+        self.c = Consul({'ttl': 30, 'scope': 'test', 'name': 'postgresql1', 'host': 'localhost:1', 'retry_timeout': 10,
+                         'register_service': True})
        self.c._base_path = '/service/good'
        self.c._load_cluster()

@@ -111,12 +113,14 @@ class TestConsul(unittest.TestCase):
    @patch.object(consul.Consul.KV, 'delete', Mock(side_effect=[ConsulException, True, True]))
    @patch.object(consul.Consul.KV, 'put', Mock(side_effect=[True, ConsulException]))
    def test_touch_member(self):
+        self.c._register_service = True
        self.c.refresh_session = Mock(return_value=True)
        self.c.touch_member({'balbla': 'blabla'})
        self.c.touch_member({'balbla': 'blabla'})
        self.c.touch_member({'balbla': 'blabla'})
        self.c.refresh_session = Mock(return_value=False)
-        self.c.touch_member({'balbla': 'blabla'})
+        self.c.touch_member({'conn_url': 'postgres://replicator:[email protected]:5433/postgres',
+                             'api_url': 'http://127.0.0.1:8009/patroni'})

    @patch.object(consul.Consul.KV, 'put', Mock(return_value=False))
    def test_take_leader(self):
@@ -176,3 +180,19 @@ class TestConsul(unittest.TestCase):
    @patch.object(consul.Consul.KV, 'put', Mock(return_value=True))
    def test_set_history_value(self):
        self.assertTrue(self.c.set_history_value('{}'))
+
+    @patch.object(consul.Consul.Agent.Service, 'register', Mock(side_effect=(False, True)))
+    @patch.object(consul.Consul.Agent.Service, 'deregister', Mock(return_value=True))
+    def test_update_service(self):
+        d = {'role': 'replica', 'api_url': 'http://a/t', 'conn_url': 'pg://c:1', 'state': 'running'}
+        self.assertIsNone(self.c.update_service({}, {}))
+        self.assertFalse(self.c.update_service({}, d))
+        self.assertTrue(self.c.update_service(d, d))
+        self.assertIsNone(self.c.update_service(d, d))
+        d['state'] = 'stopped'
+        self.assertTrue(self.c.update_service(d, d, force=True))
+        d['state'] = 'unknown'
+        self.assertIsNone(self.c.update_service({}, d))
+        d['state'] = 'running'
+        d['role'] = 'bla'
+        self.assertIsNone(self.c.update_service({}, d))
@@ -192,24 +192,24 @@ class TestCtl(unittest.TestCase):

    def test_query_member(self):
        with patch('patroni.ctl.get_cursor', Mock(return_value=MockConnect().cursor())):
-            rows = query_member(None, None, None, 'master', 'SELECT pg_is_in_recovery()', {})
+            rows = query_member(None, None, None, 'master', 'SELECT pg_catalog.pg_is_in_recovery()', {})
            self.assertTrue('False' in str(rows))

-            rows = query_member(None, None, None, 'replica', 'SELECT pg_is_in_recovery()', {})
-            self.assertEquals(rows, (None, None))
+            rows = query_member(None, None, None, 'replica', 'SELECT pg_catalog.pg_is_in_recovery()', {})
+            self.assertEqual(rows, (None, None))

            with patch('test_postgresql.MockCursor.execute', Mock(side_effect=OperationalError('bla'))):
-                rows = query_member(None, None, None, 'replica', 'SELECT pg_is_in_recovery()', {})
+                rows = query_member(None, None, None, 'replica', 'SELECT pg_catalog.pg_is_in_recovery()', {})

        with patch('patroni.ctl.get_cursor', Mock(return_value=None)):
-            rows = query_member(None, None, None, None, 'SELECT pg_is_in_recovery()', {})
+            rows = query_member(None, None, None, None, 'SELECT pg_catalog.pg_is_in_recovery()', {})
            self.assertTrue('No connection to' in str(rows))

-            rows = query_member(None, None, None, 'replica', 'SELECT pg_is_in_recovery()', {})
+            rows = query_member(None, None, None, 'replica', 'SELECT pg_catalog.pg_is_in_recovery()', {})
            self.assertTrue('No connection to' in str(rows))

        with patch('patroni.ctl.get_cursor', Mock(side_effect=OperationalError('bla'))):
-            rows = query_member(None, None, None, 'replica', 'SELECT pg_is_in_recovery()', {})
+            rows = query_member(None, None, None, 'replica', 'SELECT pg_catalog.pg_is_in_recovery()', {})

    @patch('patroni.ctl.get_dcs')
    def test_dsn(self, mock_get_dcs):
@@ -225,6 +225,22 @@ class TestCtl(unittest.TestCase):
        result = self.runner.invoke(ctl, ['dsn', 'alpha', '--member', 'dummy'])
        assert result.exit_code == 1

+    @patch('requests.post')
+    @patch('patroni.ctl.get_dcs')
+    def test_reload(self, mock_get_dcs, mock_post):
+        mock_get_dcs.return_value.get_cluster = get_cluster_initialized_with_leader
+
+        result = self.runner.invoke(ctl, ['reload', 'alpha'], input='y')
+        assert 'Failed: reload for member' in result.output
+
+        mock_post.return_value.status_code = 200
+        result = self.runner.invoke(ctl, ['reload', 'alpha'], input='y')
+        assert 'No changes to apply on member' in result.output
+
+        mock_post.return_value.status_code = 202
+        result = self.runner.invoke(ctl, ['reload', 'alpha'], input='y')
+        assert 'Reload request received for member' in result.output
+
    @patch('requests.post', requests_get)
    @patch('patroni.ctl.get_dcs')
    def test_restart_reinit(self, mock_get_dcs):
@@ -328,8 +344,14 @@ class TestCtl(unittest.TestCase):
        assert result.exit_code == 0

    @patch('requests.post', Mock(side_effect=requests.exceptions.ConnectionError('foo')))
-    def test_request_patroni(self):
+    @patch('click.get_current_context')
+    def test_request_patroni(self, mock_context):
        member = get_cluster_initialized_with_leader().leader.member
+
+        mock_context.return_value.obj = {'ctl': {'cacert': 'cert.pem'}}
+        self.assertRaises(requests.exceptions.ConnectionError, request_patroni, member, 'post', 'dummy', {})
+
+        mock_context.return_value.obj = {'ctl': {'insecure': True}}
        self.assertRaises(requests.exceptions.ConnectionError, request_patroni, member, 'post', 'dummy', {})

    def test_ctl(self):
@@ -342,20 +364,20 @@ class TestCtl(unittest.TestCase):
        self.assertIsNone(get_any_member(get_cluster_initialized_without_leader(), role='master'))

        m = get_any_member(get_cluster_initialized_with_leader(), role='master')
-        self.assertEquals(m.name, 'leader')
+        self.assertEqual(m.name, 'leader')

    def test_get_all_members(self):
-        self.assertEquals(list(get_all_members(get_cluster_initialized_without_leader(), role='master')), [])
+        self.assertEqual(list(get_all_members(get_cluster_initialized_without_leader(), role='master')), [])

        r = list(get_all_members(get_cluster_initialized_with_leader(), role='master'))
-        self.assertEquals(len(r), 1)
-        self.assertEquals(r[0].name, 'leader')
+        self.assertEqual(len(r), 1)
+        self.assertEqual(r[0].name, 'leader')

        r = list(get_all_members(get_cluster_initialized_with_leader(), role='replica'))
-        self.assertEquals(len(r), 1)
-        self.assertEquals(r[0].name, 'other')
+        self.assertEqual(len(r), 1)
+        self.assertEqual(r[0].name, 'other')

-        self.assertEquals(len(list(get_all_members(get_cluster_initialized_without_leader(), role='replica'))), 2)
+        self.assertEqual(len(list(get_all_members(get_cluster_initialized_without_leader(), role='replica'))), 2)

    @patch('patroni.ctl.get_dcs')
    def test_members(self, mock_get_dcs):
@@ -477,23 +499,23 @@ class TestCtl(unittest.TestCase):
        after_editing, changed_config = apply_config_changes(before_editing, config,
                                                             ["postgresql.parameters.work_mem = 5MB",
                                                              "ttl=15", "postgresql.use_pg_rewind=off", 'a.b=c'])
-        self.assertEquals(changed_config, {"a": {"b": "c"}, "postgresql": {"parameters": {"work_mem": "5MB"},
-                                                                           "use_pg_rewind": False}, "ttl": 15})
+        self.assertEqual(changed_config, {"a": {"b": "c"}, "postgresql": {"parameters": {"work_mem": "5MB"},
+                                                                          "use_pg_rewind": False}, "ttl": 15})

        # postgresql.parameters namespace is flattened
        after_editing, changed_config = apply_config_changes(before_editing, config,
                                                             ["postgresql.parameters.work_mem.sub = x"])
-        self.assertEquals(changed_config, {"postgresql": {"parameters": {"work_mem": "4MB", "work_mem.sub": "x"},
-                                                          "use_pg_rewind": True}, "ttl": 30})
+        self.assertEqual(changed_config, {"postgresql": {"parameters": {"work_mem": "4MB", "work_mem.sub": "x"},
+                                                         "use_pg_rewind": True}, "ttl": 30})

        # Setting to null deletes
        after_editing, changed_config = apply_config_changes(before_editing, config,
                                                             ["postgresql.parameters.work_mem=null"])
-        self.assertEquals(changed_config, {"postgresql": {"use_pg_rewind": True}, "ttl": 30})
+        self.assertEqual(changed_config, {"postgresql": {"use_pg_rewind": True}, "ttl": 30})
        after_editing, changed_config = apply_config_changes(before_editing, config,
                                                             ["postgresql.use_pg_rewind=null",
                                                              "postgresql.parameters.work_mem=null"])
-        self.assertEquals(changed_config, {"ttl": 30})
+        self.assertEqual(changed_config, {"ttl": 30})

        self.assertRaises(PatroniCtlException, apply_config_changes, before_editing, config, ['a'])

@@ -550,5 +572,5 @@ class TestCtl(unittest.TestCase):
            assert 'failed to get version' in result.output

    def test_format_pg_version(self):
-        self.assertEquals(format_pg_version(100001), '10.1')
-        self.assertEquals(format_pg_version(90605), '9.6.5')
+        self.assertEqual(format_pg_version(100001), '10.1')
+        self.assertEqual(format_pg_version(90605), '9.6.5')
@@ -215,8 +215,8 @@ class TestClient(unittest.TestCase):
            self.assertRaises(etcd.EtcdException, self.client.api_execute, '/', 'GET')

    def test_get_srv_record(self):
-        self.assertEquals(self.client.get_srv_record('_etcd-server._tcp.blabla'), [])
-        self.assertEquals(self.client.get_srv_record('_etcd-server._tcp.exception'), [])
+        self.assertEqual(self.client.get_srv_record('_etcd-server._tcp.blabla'), [])
+        self.assertEqual(self.client.get_srv_record('_etcd-server._tcp.exception'), [])

    def test__get_machines_cache_from_srv(self):
        self.client._get_machines_cache_from_srv('foobar')
@@ -259,7 +259,7 @@ class TestEtcd(unittest.TestCase):
                              'host': 'localhost:2379', 'scope': 'test', 'name': 'foo'})

    def test_base_path(self):
-        self.assertEquals(self.etcd._base_path, '/patroni/test')
+        self.assertEqual(self.etcd._base_path, '/patroni/test')

    @patch('dns.resolver.query', dns_query)
    def test_get_etcd_client(self):
@@ -2,6 +2,7 @@ import datetime
 import etcd
 import os
 import unittest
+import sys

 from mock import Mock, MagicMock, PropertyMock, patch
 from patroni.config import Config
@@ -26,16 +27,17 @@ def false(*args, **kwargs):
    return False


-def get_cluster(initialize, leader, members, failover, sync):
+def get_cluster(initialize, leader, members, failover, sync, cluster_config=None):
    history = TimelineHistory(1, [(1, 67197376, 'no recovery target specified', datetime.datetime.now().isoformat())])
-    return Cluster(initialize, ClusterConfig(1, {1: 2}, 1), leader, 10, members, failover, sync, history)
+    cluster_config = cluster_config or ClusterConfig(1, {1: 2}, 1)
+    return Cluster(initialize, cluster_config, leader, 10, members, failover, sync, history)


-def get_cluster_not_initialized_without_leader():
-    return get_cluster(None, None, [], None, SyncState(None, None, None))
+def get_cluster_not_initialized_without_leader(cluster_config=None):
+    return get_cluster(None, None, [], None, SyncState(None, None, None), cluster_config)


-def get_cluster_initialized_without_leader(leader=False, failover=None, sync=None):
+def get_cluster_initialized_without_leader(leader=False, failover=None, sync=None, cluster_config=None):
    m1 = Member(0, 'leader', 28, {'conn_url': 'postgres://replicator:[email protected]:5435/postgres',
                                  'api_url': 'http://127.0.0.1:8008/patroni', 'xlog_location': 4})
    leader = Leader(0, 0, m1) if leader else None
@@ -47,16 +49,27 @@ def get_cluster_initialized_without_leader(leader=False, failover=None, sync=Non
                                 'scheduled_restart': {'schedule': "2100-01-01 10:53:07.560445+00:00",
                                                       'postgres_version': '99.0.0'}})
    syncstate = SyncState(0 if sync else None, sync and sync[0], sync and sync[1])
-    return get_cluster(SYSID, leader, [m1, m2], failover, syncstate)
+    return get_cluster(SYSID, leader, [m1, m2], failover, syncstate, cluster_config)


 def get_cluster_initialized_with_leader(failover=None, sync=None):
    return get_cluster_initialized_without_leader(leader=True, failover=failover, sync=sync)


-def get_cluster_initialized_with_only_leader(failover=None):
+def get_cluster_initialized_with_only_leader(failover=None, cluster_config=None):
    leader = get_cluster_initialized_without_leader(leader=True, failover=failover).leader
-    return get_cluster(True, leader, [leader], failover, None)
+    return get_cluster(True, leader, [leader], failover, None, cluster_config)
+
+
+def get_standby_cluster_initialized_with_only_leader(failover=None, sync=None):
+    return get_cluster_initialized_with_only_leader(
+        cluster_config=ClusterConfig(1, {
+            "standby_cluster": {
+                "host": "localhost",
+                "port": 5432,
+                "primary_slot_name": "",
+            }}, 1)
+    )


 def get_node_status(reachable=True, in_recovery=True, wal_position=10, nofailover=False, watchdog_failed=False):
@@ -97,6 +110,10 @@ zookeeper:
    hosts: [localhost]
    port: 8181
 """
+        # We rely on sys.argv in Config, so it's necessary to reset
+        # all the extra values that are coming from py.test
+        sys.argv = sys.argv[:1]
+
        self.config = Config()
        self.postgresql = p
        self.dcs = d
@@ -129,7 +146,6 @@ def run_async(self, func, args=()):
@patch.object(Postgresql, 'write_recovery_conf', Mock())
@patch.object(Postgresql, 'query', Mock())
@patch.object(Postgresql, 'checkpoint', Mock())
-@patch.object(Postgresql, 'call_nowait', Mock())
@patch.object(Postgresql, 'cancellable_subprocess_call', Mock(return_value=0))
@patch.object(etcd.Client, 'write', etcd_write)
@patch.object(etcd.Client, 'read', etcd_read)
@@ -175,16 +191,36 @@ class TestHa(unittest.TestCase):
        self.p.replica_cached_timeline = Mock(side_effect=Exception)
        self.ha.touch_member()

+    def test_is_leader(self):
+        self.assertFalse(self.ha.is_leader())
+
    def test_start_as_replica(self):
        self.p.is_healthy = false
-        self.assertEquals(self.ha.run_cycle(), 'starting as a secondary')
+        self.assertEqual(self.ha.run_cycle(), 'starting as a secondary')
+
+    @patch('patroni.dcs.etcd.Etcd.initialize', return_value=True)
+    def test_start_as_standby_leader(self, initialize):
+        self.p.data_directory_empty = true
+        self.ha.cluster = get_cluster_not_initialized_without_leader(cluster_config=ClusterConfig(0, {}, 0))
+        self.ha.cluster.is_unlocked = true
+        self.ha.patroni.config._dynamic_configuration = {"standby_cluster": {"port": 5432}}
+        self.assertEqual(self.ha.run_cycle(), 'trying to bootstrap a new standby leader')
+
+    @patch.object(Cluster, 'get_clone_member',
+                  Mock(return_value=Member(0, 'test', 1, {'api_url': 'http://127.0.0.1:8011/patroni'})))
+    @patch.object(Postgresql, 'create_replica', Mock(return_value=0))
+    def test_start_as_cascade_replica_in_standby_cluster(self):
+        self.p.data_directory_empty = true
+        self.ha.cluster = get_standby_cluster_initialized_with_only_leader()
+        self.ha.cluster.is_unlocked = false
+        self.assertEqual(self.ha.run_cycle(), "trying to bootstrap from replica 'test'")

    def test_recover_replica_failed(self):
        self.p.controldata = lambda: {'Database cluster state': 'in recovery', 'Database system identifier': SYSID}
        self.p.is_running = false
        self.p.follow = false
-        self.assertEquals(self.ha.run_cycle(), 'starting as a secondary')
-        self.assertEquals(self.ha.run_cycle(), 'failed to start postgres')
+        self.assertEqual(self.ha.run_cycle(), 'starting as a secondary')
+        self.assertEqual(self.ha.run_cycle(), 'failed to start postgres')

    def test_recover_former_master(self):
        self.p.follow = false
@@ -193,19 +229,19 @@ class TestHa(unittest.TestCase):
        self.p.set_role('master')
        self.p.controldata = lambda: {'Database cluster state': 'shut down', 'Database system identifier': SYSID}
        self.ha.cluster = get_cluster_initialized_with_leader()
-        self.assertEquals(self.ha.run_cycle(), 'starting as readonly because i had the session lock')
+        self.assertEqual(self.ha.run_cycle(), 'starting as readonly because i had the session lock')

    @patch.object(Postgresql, 'fix_cluster_state', Mock())
    def test_crash_recovery(self):
        self.p.is_running = false
        self.p.controldata = lambda: {'Database cluster state': 'in production', 'Database system identifier': SYSID}
-        self.assertEquals(self.ha.run_cycle(), 'doing crash recovery in a single user mode')
+        self.assertEqual(self.ha.run_cycle(), 'doing crash recovery in a single user mode')

    @patch.object(Postgresql, 'rewind_needed_and_possible', Mock(return_value=True))
    def test_recover_with_rewind(self):
        self.p.is_running = false
        self.ha.cluster = get_cluster_initialized_with_leader()
-        self.assertEquals(self.ha.run_cycle(), 'running pg_rewind from leader')
+        self.assertEqual(self.ha.run_cycle(), 'running pg_rewind from leader')

    @patch('sys.exit', return_value=1)
    @patch('patroni.ha.Ha.sysid_valid', MagicMock(return_value=True))
@@ -220,129 +256,129 @@ class TestHa(unittest.TestCase):
        self.p.is_healthy = true
        self.ha.has_lock = true
        self.p.controldata = lambda: {'Database cluster state': 'in production', 'Database system identifier': SYSID}
-        self.assertEquals(self.ha.run_cycle(), 'promoted self to leader because i had the session lock')
+        self.assertEqual(self.ha.run_cycle(), 'promoted self to leader because i had the session lock')

    @patch('psycopg2.connect', psycopg2_connect)
    def test_acquire_lock_as_master(self):
-        self.assertEquals(self.ha.run_cycle(), 'acquired session lock as a leader')
+        self.assertEqual(self.ha.run_cycle(), 'acquired session lock as a leader')

    def test_promoted_by_acquiring_lock(self):
        self.ha.is_healthiest_node = true
        self.p.is_leader = false
-        self.assertEquals(self.ha.run_cycle(), 'promoted self to leader by acquiring session lock')
+        self.assertEqual(self.ha.run_cycle(), 'promoted self to leader by acquiring session lock')

    def test_long_promote(self):
        self.ha.cluster.is_unlocked = false
        self.ha.has_lock = true
        self.p.is_leader = false
        self.p.set_role('master')
-        self.assertEquals(self.ha.run_cycle(), 'no action.  i am the leader with the lock')
+        self.assertEqual(self.ha.run_cycle(), 'no action.  i am the leader with the lock')

    def test_demote_after_failing_to_obtain_lock(self):
        self.ha.acquire_lock = false
-        self.assertEquals(self.ha.run_cycle(), 'demoted self after trying and failing to obtain lock')
+        self.assertEqual(self.ha.run_cycle(), 'demoted self after trying and failing to obtain lock')

    def test_follow_new_leader_after_failing_to_obtain_lock(self):
        self.ha.is_healthiest_node = true
        self.ha.acquire_lock = false
        self.p.is_leader = false
-        self.assertEquals(self.ha.run_cycle(), 'following new leader after trying and failing to obtain lock')
+        self.assertEqual(self.ha.run_cycle(), 'following new leader after trying and failing to obtain lock')

    def test_demote_because_not_healthiest(self):
        self.ha.is_healthiest_node = false
-        self.assertEquals(self.ha.run_cycle(), 'demoting self because i am not the healthiest node')
+        self.assertEqual(self.ha.run_cycle(), 'demoting self because i am not the healthiest node')

    def test_follow_new_leader_because_not_healthiest(self):
        self.ha.is_healthiest_node = false
        self.p.is_leader = false
-        self.assertEquals(self.ha.run_cycle(), 'following a different leader because i am not the healthiest node')
+        self.assertEqual(self.ha.run_cycle(), 'following a different leader because i am not the healthiest node')

    def test_promote_because_have_lock(self):
        self.ha.cluster.is_unlocked = false
        self.ha.has_lock = true
        self.p.is_leader = false
-        self.assertEquals(self.ha.run_cycle(), 'promoted self to leader because i had the session lock')
+        self.assertEqual(self.ha.run_cycle(), 'promoted self to leader because i had the session lock')

    def test_promote_without_watchdog(self):
        self.ha.cluster.is_unlocked = false
        self.ha.has_lock = true
        self.p.is_leader = true
        with patch.object(Watchdog, 'activate', Mock(return_value=False)):
-            self.assertEquals(self.ha.run_cycle(), 'Demoting self because watchdog could not be activated')
+            self.assertEqual(self.ha.run_cycle(), 'Demoting self because watchdog could not be activated')
            self.p.is_leader = false
-            self.assertEquals(self.ha.run_cycle(), 'Not promoting self because watchdog could not be activated')
+            self.assertEqual(self.ha.run_cycle(), 'Not promoting self because watchdog could not be activated')

    def test_leader_with_lock(self):
        self.ha.cluster = get_cluster_not_initialized_without_leader()
        self.ha.cluster.is_unlocked = false
        self.ha.has_lock = true
-        self.assertEquals(self.ha.run_cycle(), 'no action.  i am the leader with the lock')
+        self.assertEqual(self.ha.run_cycle(), 'no action.  i am the leader with the lock')

    def test_demote_because_not_having_lock(self):
        self.ha.cluster.is_unlocked = false
        with patch.object(Watchdog, 'is_running', PropertyMock(return_value=True)):
-            self.assertEquals(self.ha.run_cycle(), 'demoting self because i do not have the lock and i was a leader')
+            self.assertEqual(self.ha.run_cycle(), 'demoting self because i do not have the lock and i was a leader')

    def test_demote_because_update_lock_failed(self):
        self.ha.cluster.is_unlocked = false
        self.ha.has_lock = true
        self.ha.update_lock = false
-        self.assertEquals(self.ha.run_cycle(), 'demoted self because failed to update leader lock in DCS')
+        self.assertEqual(self.ha.run_cycle(), 'demoted self because failed to update leader lock in DCS')
        self.p.is_leader = false
-        self.assertEquals(self.ha.run_cycle(), 'not promoting because failed to update leader lock in DCS')
+        self.assertEqual(self.ha.run_cycle(), 'not promoting because failed to update leader lock in DCS')

    def test_follow(self):
        self.ha.cluster.is_unlocked = false
        self.p.is_leader = false
-        self.assertEquals(self.ha.run_cycle(), 'no action.  i am a secondary and i am following a leader')
+        self.assertEqual(self.ha.run_cycle(), 'no action.  i am a secondary and i am following a leader')
        self.ha.patroni.replicatefrom = "foo"
-        self.assertEquals(self.ha.run_cycle(), 'no action.  i am a secondary and i am following a leader')
+        self.assertEqual(self.ha.run_cycle(), 'no action.  i am a secondary and i am following a leader')

    def test_follow_in_pause(self):
        self.ha.cluster.is_unlocked = false
        self.ha.is_paused = true
-        self.assertEquals(self.ha.run_cycle(), 'PAUSE: continue to run as master without lock')
+        self.assertEqual(self.ha.run_cycle(), 'PAUSE: continue to run as master without lock')
        self.p.is_leader = false
-        self.assertEquals(self.ha.run_cycle(), 'PAUSE: no action')
+        self.assertEqual(self.ha.run_cycle(), 'PAUSE: no action')

    @patch.object(Postgresql, 'rewind_needed_and_possible', Mock(return_value=True))
    def test_follow_triggers_rewind(self):
        self.p.is_leader = false
        self.p.trigger_check_diverged_lsn()
        self.ha.cluster = get_cluster_initialized_with_leader()
-        self.assertEquals(self.ha.run_cycle(), 'running pg_rewind from leader')
+        self.assertEqual(self.ha.run_cycle(), 'running pg_rewind from leader')

    def test_no_etcd_connection_master_demote(self):
        self.ha.load_cluster_from_dcs = Mock(side_effect=DCSError('Etcd is not responding properly'))
-        self.assertEquals(self.ha.run_cycle(), 'demoted self because DCS is not accessible and i was a leader')
+        self.assertEqual(self.ha.run_cycle(), 'demoted self because DCS is not accessible and i was a leader')

    @patch('time.sleep', Mock())
    def test_bootstrap_from_another_member(self):
        self.ha.cluster = get_cluster_initialized_with_leader()
-        self.assertEquals(self.ha.bootstrap(), 'trying to bootstrap from replica \'other\'')
+        self.assertEqual(self.ha.bootstrap(), 'trying to bootstrap from replica \'other\'')

    def test_bootstrap_waiting_for_leader(self):
        self.ha.cluster = get_cluster_initialized_without_leader()
-        self.assertEquals(self.ha.bootstrap(), 'waiting for leader to bootstrap')
+        self.assertEqual(self.ha.bootstrap(), 'waiting for leader to bootstrap')

    def test_bootstrap_without_leader(self):
        self.ha.cluster = get_cluster_initialized_without_leader()
        self.p.can_create_replica_without_replication_connection = MagicMock(return_value=True)
-        self.assertEquals(self.ha.bootstrap(), 'trying to bootstrap (without leader)')
+        self.assertEqual(self.ha.bootstrap(), 'trying to bootstrap (without leader)')

    def test_bootstrap_initialize_lock_failed(self):
        self.ha.cluster = get_cluster_not_initialized_without_leader()
-        self.assertEquals(self.ha.bootstrap(), 'failed to acquire initialize lock')
+        self.assertEqual(self.ha.bootstrap(), 'failed to acquire initialize lock')

    def test_bootstrap_initialized_new_cluster(self):
        self.ha.cluster = get_cluster_not_initialized_without_leader()
        self.e.initialize = true
-        self.assertEquals(self.ha.bootstrap(), 'trying to bootstrap a new cluster')
+        self.assertEqual(self.ha.bootstrap(), 'trying to bootstrap a new cluster')
        self.p.is_leader = false
-        self.assertEquals(self.ha.run_cycle(), 'waiting for end of recovery after bootstrap')
+        self.assertEqual(self.ha.run_cycle(), 'waiting for end of recovery after bootstrap')
        self.p.is_leader = true
-        self.assertEquals(self.ha.run_cycle(), 'running post_bootstrap')
-        self.assertEquals(self.ha.run_cycle(), 'initialized a new cluster')
+        self.assertEqual(self.ha.run_cycle(), 'running post_bootstrap')
+        self.assertEqual(self.ha.run_cycle(), 'initialized a new cluster')

    def test_bootstrap_release_initialize_key_on_failure(self):
        self.ha.cluster = get_cluster_not_initialized_without_leader()
@@ -358,7 +394,7 @@ class TestHa(unittest.TestCase):
        self.p.is_running.return_value = MockPostmaster()
        self.p.is_leader = true
        with patch.object(Watchdog, 'activate', Mock(return_value=False)):
-            self.assertEquals(self.ha.post_bootstrap(), 'running post_bootstrap')
+            self.assertEqual(self.ha.post_bootstrap(), 'running post_bootstrap')
            self.assertRaises(PatroniException, self.ha.post_bootstrap)

    @patch('psycopg2.connect', psycopg2_connect)
@@ -375,35 +411,35 @@ class TestHa(unittest.TestCase):

    @patch('time.sleep', Mock())
    def test_restart(self):
-        self.assertEquals(self.ha.restart({}), (True, 'restarted successfully'))
+        self.assertEqual(self.ha.restart({}), (True, 'restarted successfully'))
        self.p.restart = Mock(return_value=None)
-        self.assertEquals(self.ha.restart({}), (False, 'postgres is still starting'))
+        self.assertEqual(self.ha.restart({}), (False, 'postgres is still starting'))
        self.p.restart = false
-        self.assertEquals(self.ha.restart({}), (False, 'restart failed'))
+        self.assertEqual(self.ha.restart({}), (False, 'restart failed'))
        self.ha.cluster = get_cluster_initialized_with_leader()
        self.ha.reinitialize()
-        self.assertEquals(self.ha.restart({}), (False, 'reinitialize already in progress'))
+        self.assertEqual(self.ha.restart({}), (False, 'reinitialize already in progress'))
        with patch.object(self.ha, "restart_matches", return_value=False):
-            self.assertEquals(self.ha.restart({'foo': 'bar'}), (False, "restart conditions are not satisfied"))
+            self.assertEqual(self.ha.restart({'foo': 'bar'}), (False, "restart conditions are not satisfied"))

    @patch('os.kill', Mock())
    def test_restart_in_progress(self):
        with patch('patroni.async_executor.AsyncExecutor.busy', PropertyMock(return_value=True)):
            self.ha.restart({}, run_async=True)
            self.assertTrue(self.ha.restart_scheduled())
-            self.assertEquals(self.ha.run_cycle(), 'restart in progress')
+            self.assertEqual(self.ha.run_cycle(), 'restart in progress')

            self.ha.cluster = get_cluster_initialized_with_leader()
-            self.assertEquals(self.ha.run_cycle(), 'restart in progress')
+            self.assertEqual(self.ha.run_cycle(), 'restart in progress')

            self.ha.has_lock = true
-            self.assertEquals(self.ha.run_cycle(), 'updated leader lock during restart')
+            self.assertEqual(self.ha.run_cycle(), 'updated leader lock during restart')

            self.ha.update_lock = false
            self.p.set_role('master')
            with patch('patroni.async_executor.CriticalTask.cancel', Mock(return_value=False)):
                with patch('patroni.postgresql.Postgresql.terminate_starting_postmaster') as mock_terminate:
-                    self.assertEquals(self.ha.run_cycle(), 'lost leader lock during restart')
+                    self.assertEqual(self.ha.run_cycle(), 'lost leader lock during restart')
                    mock_terminate.assert_called()

    @patch('requests.get', requests_get)
@@ -411,25 +447,25 @@ class TestHa(unittest.TestCase):
        self.ha.fetch_node_status = get_node_status()
        self.ha.has_lock = true
        self.ha.cluster = get_cluster_initialized_with_leader(Failover(0, 'blabla', '', None))
-        self.assertEquals(self.ha.run_cycle(), 'no action.  i am the leader with the lock')
+        self.assertEqual(self.ha.run_cycle(), 'no action.  i am the leader with the lock')
        self.ha.cluster = get_cluster_initialized_with_leader(Failover(0, '', self.p.name, None))
-        self.assertEquals(self.ha.run_cycle(), 'no action.  i am the leader with the lock')
+        self.assertEqual(self.ha.run_cycle(), 'no action.  i am the leader with the lock')
        self.ha.cluster = get_cluster_initialized_with_leader(Failover(0, '', 'blabla', None))
-        self.assertEquals(self.ha.run_cycle(), 'no action.  i am the leader with the lock')
+        self.assertEqual(self.ha.run_cycle(), 'no action.  i am the leader with the lock')
        f = Failover(0, self.p.name, '', None)
        self.ha.cluster = get_cluster_initialized_with_leader(f)
-        self.assertEquals(self.ha.run_cycle(), 'manual failover: demoting myself')
+        self.assertEqual(self.ha.run_cycle(), 'manual failover: demoting myself')
        self.p.rewind_needed_and_possible = true
-        self.assertEquals(self.ha.run_cycle(), 'manual failover: demoting myself')
+        self.assertEqual(self.ha.run_cycle(), 'manual failover: demoting myself')
        self.ha.fetch_node_status = get_node_status(nofailover=True)
-        self.assertEquals(self.ha.run_cycle(), 'no action.  i am the leader with the lock')
+        self.assertEqual(self.ha.run_cycle(), 'no action.  i am the leader with the lock')
        self.ha.fetch_node_status = get_node_status(watchdog_failed=True)
-        self.assertEquals(self.ha.run_cycle(), 'no action.  i am the leader with the lock')
+        self.assertEqual(self.ha.run_cycle(), 'no action.  i am the leader with the lock')
        self.ha.fetch_node_status = get_node_status(wal_position=1)
-        self.assertEquals(self.ha.run_cycle(), 'no action.  i am the leader with the lock')
+        self.assertEqual(self.ha.run_cycle(), 'no action.  i am the leader with the lock')
        # manual failover from the previous leader to us won't happen if we hold the nofailover flag
        self.ha.cluster = get_cluster_initialized_with_leader(Failover(0, 'blabla', self.p.name, None))
-        self.assertEquals(self.ha.run_cycle(), 'no action.  i am the leader with the lock')
+        self.assertEqual(self.ha.run_cycle(), 'no action.  i am the leader with the lock')

        # Failover scheduled time must include timezone
        scheduled = datetime.datetime.now()
@@ -438,19 +474,19 @@ class TestHa(unittest.TestCase):

        scheduled = datetime.datetime.utcnow().replace(tzinfo=tzutc)
        self.ha.cluster = get_cluster_initialized_with_leader(Failover(0, 'blabla', self.p.name, scheduled))
-        self.assertEquals('no action.  i am the leader with the lock', self.ha.run_cycle())
+        self.assertEqual('no action.  i am the leader with the lock', self.ha.run_cycle())

        scheduled = scheduled + datetime.timedelta(seconds=30)
        self.ha.cluster = get_cluster_initialized_with_leader(Failover(0, 'blabla', self.p.name, scheduled))
-        self.assertEquals('no action.  i am the leader with the lock', self.ha.run_cycle())
+        self.assertEqual('no action.  i am the leader with the lock', self.ha.run_cycle())

        scheduled = scheduled + datetime.timedelta(seconds=-600)
        self.ha.cluster = get_cluster_initialized_with_leader(Failover(0, 'blabla', self.p.name, scheduled))
-        self.assertEquals('no action.  i am the leader with the lock', self.ha.run_cycle())
+        self.assertEqual('no action.  i am the leader with the lock', self.ha.run_cycle())

        scheduled = None
        self.ha.cluster = get_cluster_initialized_with_leader(Failover(0, 'blabla', self.p.name, scheduled))
-        self.assertEquals('no action.  i am the leader with the lock', self.ha.run_cycle())
+        self.assertEqual('no action.  i am the leader with the lock', self.ha.run_cycle())

    @patch('requests.get', requests_get)
    def test_manual_failover_from_leader_in_pause(self):
@@ -458,9 +494,9 @@ class TestHa(unittest.TestCase):
        self.ha.is_paused = true
        scheduled = datetime.datetime.now()
        self.ha.cluster = get_cluster_initialized_with_leader(Failover(0, 'blabla', self.p.name, scheduled))
-        self.assertEquals('PAUSE: no action.  i am the leader with the lock', self.ha.run_cycle())
+        self.assertEqual('PAUSE: no action.  i am the leader with the lock', self.ha.run_cycle())
        self.ha.cluster = get_cluster_initialized_with_leader(Failover(0, self.p.name, '', None))
-        self.assertEquals('PAUSE: no action.  i am the leader with the lock', self.ha.run_cycle())
+        self.assertEqual('PAUSE: no action.  i am the leader with the lock', self.ha.run_cycle())

    @patch('requests.get', requests_get)
    def test_manual_failover_from_leader_in_synchronous_mode(self):
@@ -470,48 +506,48 @@ class TestHa(unittest.TestCase):
        self.ha.is_failover_possible = false
        self.ha.process_sync_replication = Mock()
        self.ha.cluster = get_cluster_initialized_with_leader(Failover(0, self.p.name, 'a', None), (self.p.name, None))
-        self.assertEquals('no action.  i am the leader with the lock', self.ha.run_cycle())
+        self.assertEqual('no action.  i am the leader with the lock', self.ha.run_cycle())
        self.ha.cluster = get_cluster_initialized_with_leader(Failover(0, self.p.name, 'a', None), (self.p.name, 'a'))
        self.ha.is_failover_possible = true
-        self.assertEquals('manual failover: demoting myself', self.ha.run_cycle())
+        self.assertEqual('manual failover: demoting myself', self.ha.run_cycle())

    @patch('requests.get', requests_get)
    def test_manual_failover_process_no_leader(self):
        self.p.is_leader = false
        self.ha.cluster = get_cluster_initialized_without_leader(failover=Failover(0, '', self.p.name, None))
-        self.assertEquals(self.ha.run_cycle(), 'promoted self to leader by acquiring session lock')
+        self.assertEqual(self.ha.run_cycle(), 'promoted self to leader by acquiring session lock')
        self.ha.cluster = get_cluster_initialized_without_leader(failover=Failover(0, '', 'leader', None))
        self.p.set_role('replica')
-        self.assertEquals(self.ha.run_cycle(), 'promoted self to leader by acquiring session lock')
+        self.assertEqual(self.ha.run_cycle(), 'promoted self to leader by acquiring session lock')
        self.ha.fetch_node_status = get_node_status()  # accessible, in_recovery
-        self.assertEquals(self.ha.run_cycle(), 'following a different leader because i am not the healthiest node')
+        self.assertEqual(self.ha.run_cycle(), 'following a different leader because i am not the healthiest node')
        self.ha.cluster = get_cluster_initialized_without_leader(failover=Failover(0, self.p.name, '', None))
-        self.assertEquals(self.ha.run_cycle(), 'following a different leader because i am not the healthiest node')
+        self.assertEqual(self.ha.run_cycle(), 'following a different leader because i am not the healthiest node')
        self.ha.fetch_node_status = get_node_status(reachable=False)  # inaccessible, in_recovery
        self.p.set_role('replica')
-        self.assertEquals(self.ha.run_cycle(), 'promoted self to leader by acquiring session lock')
+        self.assertEqual(self.ha.run_cycle(), 'promoted self to leader by acquiring session lock')
        # set failover flag to True for all members of the cluster
        # this should elect the current member, as we are not going to call the API for it.
        self.ha.cluster = get_cluster_initialized_without_leader(failover=Failover(0, '', 'other', None))
        self.ha.fetch_node_status = get_node_status(nofailover=True)  # accessible, in_recovery
        self.p.set_role('replica')
-        self.assertEquals(self.ha.run_cycle(), 'promoted self to leader by acquiring session lock')
+        self.assertEqual(self.ha.run_cycle(), 'promoted self to leader by acquiring session lock')
        # same as previous, but set the current member to nofailover. In no case it should be elected as a leader
        self.ha.patroni.nofailover = True
-        self.assertEquals(self.ha.run_cycle(), 'following a different leader because I am not allowed to promote')
+        self.assertEqual(self.ha.run_cycle(), 'following a different leader because I am not allowed to promote')

    def test_manual_failover_process_no_leader_in_pause(self):
        self.ha.is_paused = true
        self.ha.cluster = get_cluster_initialized_without_leader(failover=Failover(0, '', 'other', None))
-        self.assertEquals(self.ha.run_cycle(), 'PAUSE: continue to run as master without lock')
+        self.assertEqual(self.ha.run_cycle(), 'PAUSE: continue to run as master without lock')
        self.ha.cluster = get_cluster_initialized_without_leader(failover=Failover(0, 'leader', '', None))
-        self.assertEquals(self.ha.run_cycle(), 'PAUSE: continue to run as master without lock')
+        self.assertEqual(self.ha.run_cycle(), 'PAUSE: continue to run as master without lock')
        self.ha.cluster = get_cluster_initialized_without_leader(failover=Failover(0, 'leader', 'blabla', None))
-        self.assertEquals('PAUSE: acquired session lock as a leader', self.ha.run_cycle())
+        self.assertEqual('PAUSE: acquired session lock as a leader', self.ha.run_cycle())
        self.p.is_leader = false
        self.p.set_role('replica')
        self.ha.cluster = get_cluster_initialized_without_leader(failover=Failover(0, 'leader', self.p.name, None))
-        self.assertEquals(self.ha.run_cycle(), 'PAUSE: promoted self to leader by acquiring session lock')
+        self.assertEqual(self.ha.run_cycle(), 'PAUSE: promoted self to leader by acquiring session lock')

    def test_is_healthiest_node(self):
        self.ha.state_handler.is_leader = false
@@ -592,7 +628,7 @@ class TestHa(unittest.TestCase):
    def test_scheduled_restart(self):
        self.ha.cluster = get_cluster_initialized_with_leader()
        with patch.object(self.ha, "evaluate_scheduled_restart", Mock(return_value="restart scheduled")):
-            self.assertEquals(self.ha.run_cycle(), "restart scheduled")
+            self.assertEqual(self.ha.run_cycle(), "restart scheduled")

    def test_restart_matches(self):
        self.p._role = 'replica'
@@ -609,29 +645,79 @@ class TestHa(unittest.TestCase):
        self.ha.is_paused = true
        self.p.name = 'leader'
        self.ha.cluster = get_cluster_initialized_with_leader()
-        self.assertEquals(self.ha.run_cycle(), 'PAUSE: removed leader lock because postgres is not running as master')
+        self.assertEqual(self.ha.run_cycle(), 'PAUSE: removed leader lock because postgres is not running as master')
        self.ha.cluster = get_cluster_initialized_with_leader(Failover(0, '', self.p.name, None))
-        self.assertEquals(self.ha.run_cycle(), 'PAUSE: waiting to become master after promote...')
+        self.assertEqual(self.ha.run_cycle(), 'PAUSE: waiting to become master after promote...')
+
+    def test_process_healthy_standby_cluster_as_standby_leader(self):
+        self.p.is_leader = false
+        self.p.name = 'leader'
+        self.ha.cluster = get_standby_cluster_initialized_with_only_leader()
+        msg = 'no action.  i am the standby leader with the lock'
+        self.assertEqual(self.ha.run_cycle(), msg)
+
+    def test_process_healthy_standby_cluster_as_cascade_replica(self):
+        self.p.is_leader = false
+        self.p.name = 'replica'
+        self.ha.cluster = get_standby_cluster_initialized_with_only_leader()
+        msg = 'no action.  i am a secondary and i am following a leader'
+        self.assertEqual(self.ha.run_cycle(), msg)
+
+    def test_process_unhealthy_standby_cluster_as_standby_leader(self):
+        self.p.is_leader = false
+        self.p.name = 'leader'
+        self.ha.cluster = get_standby_cluster_initialized_with_only_leader()
+        self.ha.cluster.is_unlocked = true
+        self.ha.sysid_valid = true
+        self.p._sysid = True
+        msg = 'promoted self to a standby leader because i had the session lock'
+        self.assertEqual(self.ha.run_cycle(), msg)
+
+    @patch.object(Postgresql, 'rewind_needed_and_possible', Mock(return_value=True))
+    def test_process_unhealthy_standby_cluster_as_cascade_replica(self):
+        self.p.is_leader = false
+        self.p.name = 'replica'
+        self.ha.cluster = get_standby_cluster_initialized_with_only_leader()
+        self.ha.is_unlocked = true
+        self.assertTrue(self.ha.run_cycle().startswith('running pg_rewind from remote_master:'))
+
+    def test_recover_unhealthy_leader_in_standby_cluster(self):
+        self.p.is_leader = false
+        self.p.name = 'leader'
+        self.p.is_running = false
+        self.p.follow = false
+        self.ha.cluster = get_standby_cluster_initialized_with_only_leader()
+        self.assertEqual(self.ha.run_cycle(), 'starting as a standby leader because i had the session lock')
+
+    def test_recover_unhealthy_unlocked_standby_cluster(self):
+        self.p.is_leader = false
+        self.p.name = 'leader'
+        self.p.is_running = false
+        self.p.follow = false
+        self.ha.cluster = get_standby_cluster_initialized_with_only_leader()
+        self.ha.cluster.is_unlocked = true
+        self.ha.has_lock = false
+        self.assertEqual(self.ha.run_cycle(), 'trying to follow a remote master because standby cluster is unhealthy')

    def test_failed_to_update_lock_in_pause(self):
        self.ha.update_lock = false
        self.ha.is_paused = true
        self.p.name = 'leader'
        self.ha.cluster = get_cluster_initialized_with_leader()
-        self.assertEquals(self.ha.run_cycle(),
-                          'PAUSE: continue to run as master after failing to update leader lock in DCS')
+        self.assertEqual(self.ha.run_cycle(),
+                         'PAUSE: continue to run as master after failing to update leader lock in DCS')

    def test_postgres_unhealthy_in_pause(self):
        self.ha.is_paused = true
        self.p.is_healthy = false
-        self.assertEquals(self.ha.run_cycle(), 'PAUSE: postgres is not running')
+        self.assertEqual(self.ha.run_cycle(), 'PAUSE: postgres is not running')
        self.ha.has_lock = true
-        self.assertEquals(self.ha.run_cycle(), 'PAUSE: removed leader lock because postgres is not running')
+        self.assertEqual(self.ha.run_cycle(), 'PAUSE: removed leader lock because postgres is not running')

    def test_no_etcd_connection_in_pause(self):
        self.ha.is_paused = true
        self.ha.load_cluster_from_dcs = Mock(side_effect=DCSError('Etcd is not responding properly'))
-        self.assertEquals(self.ha.run_cycle(), 'PAUSE: DCS is not accessible')
+        self.assertEqual(self.ha.run_cycle(), 'PAUSE: DCS is not accessible')

    @patch('patroni.ha.Ha.update_lock', return_value=True)
    @patch('patroni.ha.Ha.demote')
@@ -647,26 +733,26 @@ class TestHa(unittest.TestCase):
        self.ha.cluster = get_cluster_initialized_with_leader()
        self.p.check_for_startup = true
        self.p.time_in_state = lambda: 30
-        self.assertEquals(self.ha.run_cycle(), 'PostgreSQL is still starting up, 270 seconds until timeout')
+        self.assertEqual(self.ha.run_cycle(), 'PostgreSQL is still starting up, 270 seconds until timeout')
        check_calls([(update_lock, True), (demote, False)])

        self.p.time_in_state = lambda: 350
        self.ha.fetch_node_status = get_node_status(reachable=False)  # inaccessible, in_recovery
-        self.assertEquals(self.ha.run_cycle(),
-                          'master start has timed out, but continuing to wait because failover is not possible')
+        self.assertEqual(self.ha.run_cycle(),
+                         'master start has timed out, but continuing to wait because failover is not possible')
        check_calls([(update_lock, True), (demote, False)])

        self.ha.fetch_node_status = get_node_status()  # accessible, in_recovery
-        self.assertEquals(self.ha.run_cycle(), 'stopped PostgreSQL because of startup timeout')
+        self.assertEqual(self.ha.run_cycle(), 'stopped PostgreSQL because of startup timeout')
        check_calls([(update_lock, True), (demote, True)])

        update_lock.return_value = False
-        self.assertEquals(self.ha.run_cycle(), 'stopped PostgreSQL while starting up because leader key was lost')
+        self.assertEqual(self.ha.run_cycle(), 'stopped PostgreSQL while starting up because leader key was lost')
        check_calls([(update_lock, True), (demote, True)])

        self.ha.has_lock = false
        self.p.is_leader = false
-        self.assertEquals(self.ha.run_cycle(), 'no action.  i am a secondary and i am following a leader')
+        self.assertEqual(self.ha.run_cycle(), 'no action.  i am a secondary and i am following a leader')
        check_calls([(update_lock, False), (demote, False)])

    def test_manual_failover_while_starting(self):
@@ -675,7 +761,7 @@ class TestHa(unittest.TestCase):
        f = Failover(0, self.p.name, '', None)
        self.ha.cluster = get_cluster_initialized_with_leader(f)
        self.ha.fetch_node_status = get_node_status()  # accessible, in_recovery
-        self.assertEquals(self.ha.run_cycle(), 'manual failover: demoting myself')
+        self.assertEqual(self.ha.run_cycle(), 'manual failover: demoting myself')

    @patch('patroni.ha.Ha.demote')
    def test_failover_immediately_on_zero_master_start_timeout(self, demote):
@@ -686,7 +772,7 @@ class TestHa(unittest.TestCase):
        self.ha.has_lock = true
        self.ha.update_lock = true
        self.ha.fetch_node_status = get_node_status()  # accessible, in_recovery
-        self.assertEquals(self.ha.run_cycle(), 'stopped PostgreSQL to fail over after a crash')
+        self.assertEqual(self.ha.run_cycle(), 'stopped PostgreSQL to fail over after a crash')
        demote.assert_called_once()

    @patch('patroni.postgresql.Postgresql.follow')
@@ -748,18 +834,18 @@ class TestHa(unittest.TestCase):
        self.p.pick_synchronous_standby = Mock(return_value=('other2', True))
        self.ha.run_cycle()
        self.ha.dcs.get_cluster.assert_called_once()
-        self.assertEquals(self.ha.dcs.write_sync_state.call_count, 2)
+        self.assertEqual(self.ha.dcs.write_sync_state.call_count, 2)

        # Test updating sync standby key failed due to race
        self.ha.dcs.write_sync_state = Mock(side_effect=[True, False])
        self.ha.run_cycle()
-        self.assertEquals(self.ha.dcs.write_sync_state.call_count, 2)
+        self.assertEqual(self.ha.dcs.write_sync_state.call_count, 2)

        # Test changing sync standby failed due to race
        self.ha.dcs.write_sync_state = Mock(return_value=True)
        self.ha.dcs.get_cluster = Mock(return_value=get_cluster_initialized_with_leader(sync=('somebodyelse', None)))
        self.ha.run_cycle()
-        self.assertEquals(self.ha.dcs.write_sync_state.call_count, 1)
+        self.assertEqual(self.ha.dcs.write_sync_state.call_count, 1)

        # Test sync set to '*' when synchronous_mode_strict is enabled
        mock_set_sync.reset_mock()
@@ -780,7 +866,7 @@ class TestHa(unittest.TestCase):
        self.ha.cluster = get_cluster_initialized_with_leader(sync=('other', None))

        # When we just became master nobody is sync
-        self.assertEquals(self.ha.enforce_master_role('msg', 'promote msg'), 'promote msg')
+        self.assertEqual(self.ha.enforce_master_role('msg', 'promote msg'), 'promote msg')
        mock_set_sync.assert_called_once_with(None)
        mock_write_sync.assert_called_once_with('leader', None, index=0)

@@ -808,7 +894,7 @@ class TestHa(unittest.TestCase):
        self.ha.run_cycle()
        mock_acquire.assert_not_called()
        mock_follow.assert_called_once()
-        self.assertEquals(mock_follow.call_args[0][0], None)
+        self.assertEqual(mock_follow.call_args[0][0], None)
        mock_write_sync.assert_not_called()

        mock_follow.reset_mock()
@@ -859,15 +945,15 @@ class TestHa(unittest.TestCase):

    def test_effective_tags(self):
        self.ha._disable_sync = True
-        self.assertEquals(self.ha.get_effective_tags(), {'foo': 'bar', 'nosync': True})
+        self.assertEqual(self.ha.get_effective_tags(), {'foo': 'bar', 'nosync': True})
        self.ha._disable_sync = False
-        self.assertEquals(self.ha.get_effective_tags(), {'foo': 'bar'})
+        self.assertEqual(self.ha.get_effective_tags(), {'foo': 'bar'})

    def test_restore_cluster_config(self):
        self.ha.cluster.config.data.clear()
        self.ha.has_lock = true
        self.ha.cluster.is_unlocked = false
-        self.assertEquals(self.ha.run_cycle(), 'no action.  i am the leader with the lock')
+        self.assertEqual(self.ha.run_cycle(), 'no action.  i am the leader with the lock')

    def test_watch(self):
        self.ha.cluster = get_cluster_initialized_with_leader()
@@ -886,19 +972,19 @@ class TestHa(unittest.TestCase):
        self.ha.cluster = get_cluster_initialized_with_leader()
        self.ha.has_lock = true
        self.p.data_directory_empty = true
-        self.assertEquals(self.ha.run_cycle(), 'released leader key voluntarily as data dir empty and currently leader')
-        self.assertEquals(self.p.role, 'uninitialized')
+        self.assertEqual(self.ha.run_cycle(), 'released leader key voluntarily as data dir empty and currently leader')
+        self.assertEqual(self.p.role, 'uninitialized')

        # as has_lock is mocked out, we need to fake the leader key release
        self.ha.has_lock = false
        # will not say bootstrap from leader as replica can't self elect
-        self.assertEquals(self.ha.run_cycle(), "trying to bootstrap from replica 'other'")
+        self.assertEqual(self.ha.run_cycle(), "trying to bootstrap from replica 'other'")

    def test_update_cluster_history(self):
        self.p.get_master_timeline = Mock(return_value=1)
        self.ha.has_lock = true
        self.ha.cluster.is_unlocked = false
-        self.assertEquals(self.ha.run_cycle(), 'no action.  i am the leader with the lock')
+        self.assertEqual(self.ha.run_cycle(), 'no action.  i am the leader with the lock')

    @patch('sys.exit', return_value=1)
    def test_abort_join(self, exit_mock):
@@ -911,6 +997,15 @@ class TestHa(unittest.TestCase):
        self.ha.has_lock = true
        self.ha.cluster.is_unlocked = false
        self.ha.is_paused = true
-        self.assertEquals(self.ha.run_cycle(), 'PAUSE: no action.  i am the leader with the lock')
+        self.assertEqual(self.ha.run_cycle(), 'PAUSE: no action.  i am the leader with the lock')
        self.ha.is_paused = false
-        self.assertEquals(self.ha.run_cycle(), 'no action.  i am the leader with the lock')
+        self.assertEqual(self.ha.run_cycle(), 'no action.  i am the leader with the lock')
+
+    @patch('psycopg2.connect', psycopg2_connect)
+    def test_permanent_logical_slots_after_promote(self):
+        config = ClusterConfig(1, {'slots': {'l': {'database': 'postgres', 'plugin': 'test_decoding'}}}, 1)
+        self.ha.cluster = get_cluster_initialized_without_leader(cluster_config=config)
+        self.assertEqual(self.ha.run_cycle(), 'acquired session lock as a leader')
+        self.ha.cluster = get_cluster_initialized_without_leader(leader=True, cluster_config=config)
+        self.ha.has_lock = true
+        self.assertEqual(self.ha.run_cycle(), 'no action.  i am the leader with the lock')
@@ -50,6 +50,13 @@ class TestKubernetes(unittest.TestCase):
                        'labels': {'f': 'b'}, 'use_endpoints': True, 'pod_ip': '10.0.0.0'})
        self.assertIsNotNone(k.update_leader('123'))

+    @patch('kubernetes.config.load_kube_config', Mock())
+    @patch.object(k8s_client.CoreV1Api, 'create_namespaced_endpoints', Mock())
+    def test_update_leader_with_restricted_access(self):
+        k = Kubernetes({'ttl': 30, 'scope': 'test', 'name': 'p-0', 'retry_timeout': 10,
+                        'labels': {'f': 'b'}, 'use_endpoints': True, 'pod_ip': '10.0.0.0'})
+        self.assertIsNotNone(k.update_leader('123', True))
+
    def test_take_leader(self):
        self.k.take_leader()
        self.k._leader_observed_record['leader'] = 'test'
@@ -73,7 +73,7 @@ class TestPatroni(unittest.TestCase):
        mock_getpid.return_value = 2
        _main()

-        with patch('sys.frozen', Mock(return_value=True), create=True):
+        with patch('sys.frozen', Mock(return_value=True), create=True), patch('os.setsid', Mock()):
            sys.argv = ['/patroni', 'pg_ctl_start', 'postgres', '-D', '/data', '--max_connections=100']
            _main()

@@ -8,7 +8,7 @@ import unittest

 from mock import Mock, MagicMock, PropertyMock, patch, mock_open
 from patroni.async_executor import CriticalTask
-from patroni.dcs import Cluster, Leader, Member, SyncState
+from patroni.dcs import Cluster, ClusterConfig, Leader, Member, RemoteMember, SyncState
 from patroni.exceptions import PostgresConnectionException, PostgresException
 from patroni.postgresql import Postgresql, STATE_REJECT, STATE_NO_RESPONSE
 from patroni.postmaster import PostmasterProcess
@@ -28,15 +28,15 @@ class MockCursor(object):
    def execute(self, sql, *params):
        if sql.startswith('blabla'):
            raise psycopg2.ProgrammingError()
-        elif sql == 'CHECKPOINT':
+        elif sql == 'CHECKPOINT' or sql.startswith('SELECT pg_catalog.pg_create_'):
            raise psycopg2.OperationalError()
        elif sql.startswith('RetryFailedError'):
            raise RetryFailedError('retry')
        elif sql.startswith('SELECT slot_name'):
-            self.results = [('blabla',), ('foobar',)]
-        elif sql.startswith('SELECT CASE WHEN pg_is_in_recovery()'):
+            self.results = [('blabla', 'physical'), ('foobar', 'physical'), ('ls', 'logical', 'a', 'b')]
+        elif sql.startswith('SELECT CASE WHEN pg_catalog.pg_is_in_recovery()'):
            self.results = [(1, 2)]
-        elif sql.startswith('SELECT pg_is_in_recovery()'):
+        elif sql.startswith('SELECT pg_catalog.pg_is_in_recovery()'):
            self.results = [(False, 2)]
        elif sql.startswith('WITH replication_info AS ('):
            replication_info = '[{"application_name":"walreceiver","client_addr":"1.2.3.4",' +\
@@ -53,7 +53,7 @@ class MockCursor(object):
            self.results = [('1', 2, '0/402EEC0', '')]
        elif sql.startswith('SELECT isdir, modification'):
            self.results = [(False, datetime.datetime.now())]
-        elif sql.startswith('SELECT pg_read_file'):
+        elif sql.startswith('SELECT pg_catalog.pg_read_file'):
            self.results = [('1\t0/40159C0\tno recovery target specified\n\n' +
                             '2\t1/40159C0\tno recovery target specified\n',)]
        elif sql.startswith('TIMELINE_HISTORY '):
@@ -308,7 +308,7 @@ class TestPostgresql(unittest.TestCase):
    def test_restart(self):
        self.p.start = Mock(return_value=False)
        self.assertFalse(self.p.restart())
-        self.assertEquals(self.p.state, 'restart failed (restarting)')
+        self.assertEqual(self.p.state, 'restart failed (restarting)')

    @patch.object(builtins, 'open', MagicMock())
    def test_write_pgpass(self):
@@ -317,10 +317,10 @@ class TestPostgresql(unittest.TestCase):

    def test_checkpoint(self):
        with patch.object(MockCursor, 'fetchone', Mock(return_value=(True, ))):
-            self.assertEquals(self.p.checkpoint({'user': 'postgres'}), 'is_in_recovery=true')
+            self.assertEqual(self.p.checkpoint({'user': 'postgres'}), 'is_in_recovery=true')
        with patch.object(MockCursor, 'execute', Mock(return_value=None)):
            self.assertIsNone(self.p.checkpoint())
-        self.assertEquals(self.p.checkpoint(), 'not accessible or not healty')
+        self.assertEqual(self.p.checkpoint(), 'not accessible or not healty')

    @patch.object(Postgresql, 'cancellable_subprocess_call')
    @patch('patroni.postgresql.Postgresql.write_pgpass', MagicMock(return_value=dict()))
@@ -401,7 +401,8 @@ class TestPostgresql(unittest.TestCase):
    @patch.object(Postgresql, 'is_running', Mock(return_value=False))
    @patch.object(Postgresql, 'start', Mock())
    def test_follow(self):
-        self.p.follow(None)
+        m = RemoteMember('1', {'restore_command': '2', 'recovery_min_apply_delay': 3, 'archive_cleanup_command': '4'})
+        self.p.follow(m)

    @patch('subprocess.check_output', Mock(return_value=0, side_effect=pg_controldata_string))
    def test_can_rewind(self):
@@ -420,16 +421,20 @@ class TestPostgresql(unittest.TestCase):
    def test_create_replica(self, mock_cancellable_subprocess_call):
        self.p.delete_trigger_file = Mock(side_effect=OSError)

+        self.p.config['create_replica_methods'] = ['pgBackRest']
+        self.p.config['pgBackRest'] = {'command': 'pgBackRest', 'keep_data': True, 'no_params': True}
+        mock_cancellable_subprocess_call.return_value = 0
+        self.assertEqual(self.p.create_replica(self.leader), 0)
+
        self.p.config['create_replica_methods'] = ['wale', 'basebackup']
        self.p.config['wale'] = {'command': 'foo'}
-        mock_cancellable_subprocess_call.return_value = 0
-        self.assertEquals(self.p.create_replica(self.leader), 0)
+        self.assertEqual(self.p.create_replica(self.leader), 0)
        del self.p.config['wale']
-        self.assertEquals(self.p.create_replica(self.leader), 0)
+        self.assertEqual(self.p.create_replica(self.leader), 0)

        self.p.config['create_replica_methods'] = ['basebackup']
        self.p.config['basebackup'] = [{'max_rate': '100M'}, 'no-sync']
-        self.assertEquals(self.p.create_replica(self.leader), 0)
+        self.assertEqual(self.p.create_replica(self.leader), 0)

        self.p.config['basebackup'] = [{'max_rate': '100M', 'compress': '9'}]
        with mock.patch('patroni.postgresql.logger.error', new_callable=Mock()) as mock_logger:
@@ -446,24 +451,24 @@ class TestPostgresql(unittest.TestCase):
                            "not matching {0}".format(mock_logger.call_args[0][0]))

        self.p.config['basebackup'] = {"foo": "bar"}
-        self.assertEquals(self.p.create_replica(self.leader), 0)
+        self.assertEqual(self.p.create_replica(self.leader), 0)

        self.p.config['create_replica_methods'] = ['wale', 'basebackup']
        del self.p.config['basebackup']
        mock_cancellable_subprocess_call.return_value = 1
-        self.assertEquals(self.p.create_replica(self.leader), 1)
+        self.assertEqual(self.p.create_replica(self.leader), 1)

        mock_cancellable_subprocess_call.side_effect = Exception('foo')
-        self.assertEquals(self.p.create_replica(self.leader), 1)
+        self.assertEqual(self.p.create_replica(self.leader), 1)

        mock_cancellable_subprocess_call.side_effect = [1, 0]
-        self.assertEquals(self.p.create_replica(self.leader), 0)
+        self.assertEqual(self.p.create_replica(self.leader), 0)

        mock_cancellable_subprocess_call.side_effect = [Exception(), 0]
-        self.assertEquals(self.p.create_replica(self.leader), 0)
+        self.assertEqual(self.p.create_replica(self.leader), 0)

        self.p.cancel()
-        self.assertEquals(self.p.create_replica(self.leader), 1)
+        self.assertEqual(self.p.create_replica(self.leader), 1)

    @patch('time.sleep', Mock())
    @patch.object(Postgresql, 'cancellable_subprocess_call')
@@ -477,18 +482,18 @@ class TestPostgresql(unittest.TestCase):
        self.p.config['create_replica_method'] = ['wale', 'basebackup']
        self.p.config['wale'] = {'command': 'foo'}
        mock_cancellable_subprocess_call.return_value = 0
-        self.assertEquals(self.p.create_replica(self.leader), 0)
+        self.assertEqual(self.p.create_replica(self.leader), 0)
        del self.p.config['wale']
-        self.assertEquals(self.p.create_replica(self.leader), 0)
+        self.assertEqual(self.p.create_replica(self.leader), 0)

        self.p.config['create_replica_method'] = ['basebackup']
        self.p.config['basebackup'] = [{'max_rate': '100M'}, 'no-sync']
-        self.assertEquals(self.p.create_replica(self.leader), 0)
+        self.assertEqual(self.p.create_replica(self.leader), 0)

        self.p.config['create_replica_method'] = ['wale', 'basebackup']
        del self.p.config['basebackup']
        mock_cancellable_subprocess_call.return_value = 1
-        self.assertEquals(self.p.create_replica(self.leader), 1)
+        self.assertEqual(self.p.create_replica(self.leader), 1)

    def test_basebackup(self):
        self.p.cancel()
@@ -497,23 +502,25 @@ class TestPostgresql(unittest.TestCase):
    @patch.object(Postgresql, 'is_running', Mock(return_value=True))
    def test_sync_replication_slots(self):
        self.p.start()
-        cluster = Cluster(True, None, self.leader, 0, [self.me, self.other, self.leadermem], None, None, None)
+        config = ClusterConfig(1, {'slots': {'ls': {'database': 'a', 'plugin': 'b'},
+                                             'A': 0, 'test_3': 0, 'b': {'type': 'logical', 'plugin': '1'}}}, 1)
+        cluster = Cluster(True, config, self.leader, 0, [self.me, self.other, self.leadermem], None, None, None)
        with mock.patch('patroni.postgresql.Postgresql._query', Mock(side_effect=psycopg2.OperationalError)):
            self.p.sync_replication_slots(cluster)
        self.p.sync_replication_slots(cluster)
        with mock.patch('patroni.postgresql.Postgresql.role', new_callable=PropertyMock(return_value='replica')):
            self.p.sync_replication_slots(cluster)
-        with mock.patch('patroni.postgresql.logger.error', new_callable=Mock()) as errorlog_mock:
+        with patch.object(Postgresql, 'drop_replication_slot', Mock(return_value=True)),\
+                patch('patroni.dcs.logger.error', new_callable=Mock()) as errorlog_mock:
            self.p.query = Mock()
            alias1 = Member(0, 'test-3', 28, {'conn_url': 'postgres://replicator:[email protected]:5436/postgres'})
            alias2 = Member(0, 'test.3', 28, {'conn_url': 'postgres://replicator:[email protected]:5436/postgres'})
            cluster.members.extend([alias1, alias2])
            self.p.sync_replication_slots(cluster)
-            errorlog_mock.assert_called_once()
-            self.assertTrue("test-3" in errorlog_mock.call_args[0][1],
-                            "non matching {0}".format(errorlog_mock.call_args[0][1]))
-            self.assertTrue("test.3" in errorlog_mock.call_args[0][1],
-                            "non matching {0}".format(errorlog_mock.call_args[0][1]))
+            self.assertEqual(errorlog_mock.call_count, 5)
+            ca = errorlog_mock.call_args_list[0][0][1]
+            self.assertTrue("test-3" in ca, "non matching {0}".format(ca))
+            self.assertTrue("test.3" in ca, "non matching {0}".format(ca))

    @patch.object(MockCursor, 'execute', Mock(side_effect=psycopg2.OperationalError))
    def test__query(self):
@@ -549,25 +556,25 @@ class TestPostgresql(unittest.TestCase):
        self.assertTrue(self.p.promote(0))

    def test_timeline_wal_position(self):
-        self.assertEquals(self.p.timeline_wal_position(), (1, 2))
+        self.assertEqual(self.p.timeline_wal_position(), (1, 2))
        Thread(target=self.p.timeline_wal_position).start()

    @patch.object(PostmasterProcess, 'from_pidfile')
    def test_is_running(self, mock_frompidfile):
        # Cached postmaster running
        mock_postmaster = self.p._postmaster_proc = MockPostmaster()
-        self.assertEquals(self.p.is_running(), mock_postmaster)
+        self.assertEqual(self.p.is_running(), mock_postmaster)

        # Cached postmaster not running, no postmaster running
        mock_postmaster.is_running.return_value = False
        mock_frompidfile.return_value = None
-        self.assertEquals(self.p.is_running(), None)
-        self.assertEquals(self.p._postmaster_proc, None)
+        self.assertEqual(self.p.is_running(), None)
+        self.assertEqual(self.p._postmaster_proc, None)

        # No cached postmaster, postmaster running
        mock_frompidfile.return_value = mock_postmaster2 = MockPostmaster()
-        self.assertEquals(self.p.is_running(), mock_postmaster2)
-        self.assertEquals(self.p._postmaster_proc, mock_postmaster2)
+        self.assertEqual(self.p.is_running(), mock_postmaster2)
+        self.assertEqual(self.p._postmaster_proc, mock_postmaster2)

    @patch('shlex.split', Mock(side_effect=OSError))
    def test_call_nowait(self):
@@ -686,13 +693,13 @@ class TestPostgresql(unittest.TestCase):
        mock_cancellable_subprocess_call.assert_called()
        args, kwargs = mock_cancellable_subprocess_call.call_args
        self.assertTrue('PGPASSFILE' in kwargs['env'])
-        self.assertEquals(args[0], ['/bin/false', 'postgres://127.0.0.2:5432/postgres'])
+        self.assertEqual(args[0], ['/bin/false', 'postgres://127.0.0.2:5432/postgres'])

        mock_cancellable_subprocess_call.reset_mock()
        self.p._local_address.pop('host')
        self.assertTrue(self.p.run_bootstrap_post_init({'post_init': '/bin/false'}))
        mock_cancellable_subprocess_call.assert_called()
-        self.assertEquals(mock_cancellable_subprocess_call.call_args[0][0], ['/bin/false', 'postgres://:5432/postgres'])
+        self.assertEqual(mock_cancellable_subprocess_call.call_args[0][0], ['/bin/false', 'postgres://:5432/postgres'])

        mock_cancellable_subprocess_call.side_effect = OSError
        self.assertFalse(self.p.run_bootstrap_post_init({'post_init': '/bin/false'}))
@@ -704,7 +711,7 @@ class TestPostgresql(unittest.TestCase):
    @patch('os.listdir', Mock(return_value=['recovery.conf']))
    @patch('os.path.exists', Mock(return_value=True))
    def test_get_postgres_role_from_data_directory(self):
-        self.assertEquals(self.p.get_postgres_role_from_data_directory(), 'replica')
+        self.assertEqual(self.p.get_postgres_role_from_data_directory(), 'replica')

    def test_remove_data_directory(self):
        self.p.remove_data_directory()
@@ -719,13 +726,13 @@ class TestPostgresql(unittest.TestCase):
    def test_controldata(self):
        with patch('subprocess.check_output', Mock(return_value=0, side_effect=pg_controldata_string)):
            data = self.p.controldata()
-            self.assertEquals(len(data), 50)
-            self.assertEquals(data['Database cluster state'], 'shut down in recovery')
-            self.assertEquals(data['wal_log_hints setting'], 'on')
-            self.assertEquals(int(data['Database block size']), 8192)
+            self.assertEqual(len(data), 50)
+            self.assertEqual(data['Database cluster state'], 'shut down in recovery')
+            self.assertEqual(data['wal_log_hints setting'], 'on')
+            self.assertEqual(int(data['Database block size']), 8192)

        with patch('subprocess.check_output', Mock(side_effect=subprocess.CalledProcessError(1, ''))):
-            self.assertEquals(self.p.controldata(), {})
+            self.assertEqual(self.p.controldata(), {})

    @patch('patroni.postgresql.Postgresql._version_file_exists', Mock(return_value=True))
    @patch('subprocess.check_output', MagicMock(return_value=0, side_effect=pg_controldata_string))
@@ -779,9 +786,9 @@ class TestPostgresql(unittest.TestCase):
    @patch.object(Postgresql, '_version_file_exists', Mock(return_value=True))
    def test_get_major_version(self):
        with patch.object(builtins, 'open', mock_open(read_data='9.4')):
-            self.assertEquals(self.p.get_major_version(), 90400)
+            self.assertEqual(self.p.get_major_version(), 90400)
        with patch.object(builtins, 'open', Mock(side_effect=Exception)):
-            self.assertEquals(self.p.get_major_version(), 0)
+            self.assertEqual(self.p.get_major_version(), 0)

    def test_postmaster_start_time(self):
        with patch.object(MockCursor, "fetchone", Mock(return_value=('foo', True, '', '', '', '', False))):
@@ -793,31 +800,31 @@ class TestPostgresql(unittest.TestCase):
        with patch('subprocess.call', return_value=0):
            self.p._state = 'starting'
            self.assertFalse(self.p.check_for_startup())
-            self.assertEquals(self.p.state, 'running')
+            self.assertEqual(self.p.state, 'running')

        with patch('subprocess.call', return_value=1):
            self.p._state = 'starting'
            self.assertTrue(self.p.check_for_startup())
-            self.assertEquals(self.p.state, 'starting')
+            self.assertEqual(self.p.state, 'starting')

        with patch('subprocess.call', return_value=2):
            self.p._state = 'starting'
            self.assertFalse(self.p.check_for_startup())
-            self.assertEquals(self.p.state, 'start failed')
+            self.assertEqual(self.p.state, 'start failed')

        with patch('subprocess.call', return_value=0):
            self.p._state = 'running'
            self.assertFalse(self.p.check_for_startup())
-            self.assertEquals(self.p.state, 'running')
+            self.assertEqual(self.p.state, 'running')

        with patch('subprocess.call', return_value=127):
            self.p._state = 'running'
            self.assertFalse(self.p.check_for_startup())
-            self.assertEquals(self.p.state, 'running')
+            self.assertEqual(self.p.state, 'running')

            self.p._state = 'starting'
            self.assertFalse(self.p.check_for_startup())
-            self.assertEquals(self.p.state, 'running')
+            self.assertEqual(self.p.state, 'running')

    def test_wait_for_startup(self):
        state = {'sleeps': 0, 'num_rejects': 0, 'final_return': 0}
@@ -842,12 +849,12 @@ class TestPostgresql(unittest.TestCase):

                self.p._state = 'stopped'
                self.assertTrue(self.p.wait_for_startup())
-                self.assertEquals(state['sleeps'], 0)
+                self.assertEqual(state['sleeps'], 0)

                self.p._state = 'starting'
                state['num_rejects'] = 5
                self.assertTrue(self.p.wait_for_startup())
-                self.assertEquals(state['sleeps'], 5)
+                self.assertEqual(state['sleeps'], 5)

                self.p._state = 'starting'
                state['sleeps'] = 0
@@ -858,7 +865,7 @@ class TestPostgresql(unittest.TestCase):
                state['sleeps'] = 0
                state['final_return'] = 0
                self.assertFalse(self.p.wait_for_startup(timeout=2))
-                self.assertEquals(state['sleeps'], 3)
+                self.assertEqual(state['sleeps'], 3)

        with patch.object(Postgresql, 'check_startup_state_changed', Mock(return_value=False)):
            self.p.cancel()
@@ -874,30 +881,30 @@ class TestPostgresql(unittest.TestCase):
                    (self.me.name, 'streaming', 'async'),
                    (self.other.name, 'streaming', 'async'),
                ]):
-            self.assertEquals(self.p.pick_synchronous_standby(cluster), (self.leadermem.name, True))
+            self.assertEqual(self.p.pick_synchronous_standby(cluster), (self.leadermem.name, True))

        with patch.object(Postgresql, "query", return_value=[
                    (self.me.name, 'streaming', 'async'),
                    (self.leadermem.name, 'streaming', 'potential'),
                    (self.other.name, 'streaming', 'async'),
                ]):
-            self.assertEquals(self.p.pick_synchronous_standby(cluster), (self.leadermem.name, False))
+            self.assertEqual(self.p.pick_synchronous_standby(cluster), (self.leadermem.name, False))

        with patch.object(Postgresql, "query", return_value=[
                    (self.me.name, 'streaming', 'async'),
                    (self.other.name, 'streaming', 'async'),
                ]):
-            self.assertEquals(self.p.pick_synchronous_standby(cluster), (self.me.name, False))
+            self.assertEqual(self.p.pick_synchronous_standby(cluster), (self.me.name, False))

        with patch.object(Postgresql, "query", return_value=[
                    ('missing', 'streaming', 'sync'),
                    (self.me.name, 'streaming', 'async'),
                    (self.other.name, 'streaming', 'async'),
                ]):
-            self.assertEquals(self.p.pick_synchronous_standby(cluster), (self.me.name, False))
+            self.assertEqual(self.p.pick_synchronous_standby(cluster), (self.me.name, False))

        with patch.object(Postgresql, "query", return_value=[]):
-            self.assertEquals(self.p.pick_synchronous_standby(cluster), (None, False))
+            self.assertEqual(self.p.pick_synchronous_standby(cluster), (None, False))

    def test_set_sync_standby(self):
        def value_in_conf():
@@ -908,22 +915,22 @@ class TestPostgresql(unittest.TestCase):

        mock_reload = self.p.reload = Mock()
        self.p.set_synchronous_standby('n1')
-        self.assertEquals(value_in_conf(), "synchronous_standby_names = 'n1'")
+        self.assertEqual(value_in_conf(), "synchronous_standby_names = 'n1'")
        mock_reload.assert_called()

        mock_reload.reset_mock()
        self.p.set_synchronous_standby('n1')
        mock_reload.assert_not_called()
-        self.assertEquals(value_in_conf(), "synchronous_standby_names = 'n1'")
+        self.assertEqual(value_in_conf(), "synchronous_standby_names = 'n1'")

        self.p.set_synchronous_standby('n2')
        mock_reload.assert_called()
-        self.assertEquals(value_in_conf(), "synchronous_standby_names = 'n2'")
+        self.assertEqual(value_in_conf(), "synchronous_standby_names = 'n2'")

        mock_reload.reset_mock()
        self.p.set_synchronous_standby(None)
        mock_reload.assert_called()
-        self.assertEquals(value_in_conf(), None)
+        self.assertEqual(value_in_conf(), None)

    def test_get_server_parameters(self):
        config = {'synchronous_mode': True, 'parameters': {'wal_level': 'hot_standby'}, 'listen': '0'}
@@ -957,8 +964,8 @@ class TestPostgresql(unittest.TestCase):
 "--wal_log_hints=on" "--max_wal_senders=5" "--max_replication_slots=5"\n')
        with patch.object(builtins, 'open', m):
            data = self.p.read_postmaster_opts()
-            self.assertEquals(data['wal_level'], 'hot_standby')
-            self.assertEquals(int(data['max_replication_slots']), 5)
+            self.assertEqual(data['wal_level'], 'hot_standby')
+            self.assertEqual(int(data['max_replication_slots']), 5)
            self.assertEqual(data.get('D'), None)

            m.side_effect = IOError
@@ -968,7 +975,7 @@ class TestPostgresql(unittest.TestCase):
    @patch('subprocess.Popen')
    def test_single_user_mode(self, subprocess_popen_mock):
        subprocess_popen_mock.return_value.wait.return_value = 0
-        self.assertEquals(self.p.single_user_mode('CHECKPOINT', {'archive_mode': 'on'}), 0)
+        self.assertEqual(self.p.single_user_mode('CHECKPOINT', {'archive_mode': 'on'}), 0)

    @patch('os.listdir', Mock(side_effect=[OSError, ['a', 'b']]))
    @patch('os.unlink', Mock(side_effect=OSError))
@@ -986,10 +993,10 @@ class TestPostgresql(unittest.TestCase):
        self.assertTrue(self.p.fix_cluster_state())

    def test_replica_cached_timeline(self):
-        self.assertEquals(self.p.replica_cached_timeline(1), 2)
+        self.assertEqual(self.p.replica_cached_timeline(1), 2)

    def test_get_master_timeline(self):
-        self.assertEquals(self.p.get_master_timeline(), 1)
+        self.assertEqual(self.p.get_master_timeline(), 1)

    def test_cancellable_subprocess_call(self):
        self.p.cancel()
@@ -46,7 +46,7 @@ class TestPostmasterProcess(unittest.TestCase):
    @patch('psutil.Process.__init__')
    def test_from_pid(self, mock_init):
        mock_init.side_effect = psutil.NoSuchProcess(123)
-        self.assertEquals(PostmasterProcess.from_pid(123), None)
+        self.assertEqual(PostmasterProcess.from_pid(123), None)
        mock_init.side_effect = None
        self.assertNotEquals(PostmasterProcess.from_pid(123), None)

@@ -55,13 +55,13 @@ class TestPostmasterProcess(unittest.TestCase):
    @patch('psutil.Process.pid', Mock(return_value=123))
    def test_signal_stop(self, mock_send_signal):
        proc = PostmasterProcess(-123)
-        self.assertEquals(proc.signal_stop('immediate'), False)
+        self.assertEqual(proc.signal_stop('immediate'), False)

        mock_send_signal.side_effect = [None, psutil.NoSuchProcess(123), psutil.AccessDenied()]
        proc = PostmasterProcess(123)
-        self.assertEquals(proc.signal_stop('immediate'), None)
-        self.assertEquals(proc.signal_stop('immediate'), True)
-        self.assertEquals(proc.signal_stop('immediate'), False)
+        self.assertEqual(proc.signal_stop('immediate'), None)
+        self.assertEqual(proc.signal_stop('immediate'), True)
+        self.assertEqual(proc.signal_stop('immediate'), False)

    @patch('psutil.Process.__init__', Mock())
    @patch('psutil.wait_procs')
@@ -89,11 +89,11 @@ class TestPostmasterProcess(unittest.TestCase):
        mock_frompidfile.return_value._is_postmaster_process.return_value = False
        mock_frompid.return_value = "proc 123"
        mock_popen.return_value.stdout.readline.return_value = '123'
-        self.assertEquals(PostmasterProcess.start('true', '/tmp', '/tmp/test.conf', []), "proc 123")
+        self.assertEqual(PostmasterProcess.start('true', '/tmp', '/tmp/test.conf', []), "proc 123")
        mock_frompid.assert_called_with(123)

        mock_frompidfile.side_effect = psutil.NoSuchProcess(123)
-        self.assertEquals(PostmasterProcess.start('true', '/tmp', '/tmp/test.conf', []), "proc 123")
+        self.assertEqual(PostmasterProcess.start('true', '/tmp', '/tmp/test.conf', []), "proc 123")

    @patch('psutil.Process.__init__', Mock(side_effect=psutil.NoSuchProcess(123)))
    def test_read_postmaster_pidfile(self):
@@ -8,7 +8,7 @@ from patroni.utils import Retry, RetryFailedError, polling_loop
 class TestUtils(unittest.TestCase):

    def test_polling_loop(self):
-        self.assertEquals(list(polling_loop(0.001, interval=0.001)), [0])
+        self.assertEqual(list(polling_loop(0.001, interval=0.001)), [0])


@patch('time.sleep', Mock())
@@ -29,21 +29,21 @@ class TestRetrySleeper(unittest.TestCase):
    def test_reset(self):
        retry = Retry(delay=0, max_tries=2)
        retry(self._fail())
-        self.assertEquals(retry._attempts, 1)
+        self.assertEqual(retry._attempts, 1)
        retry.reset()
-        self.assertEquals(retry._attempts, 0)
+        self.assertEqual(retry._attempts, 0)

    def test_too_many_tries(self):
        retry = Retry(delay=0)
        self.assertRaises(RetryFailedError, retry, self._fail(times=999))
-        self.assertEquals(retry._attempts, 1)
+        self.assertEqual(retry._attempts, 1)

    def test_maximum_delay(self):
        retry = Retry(delay=10, max_tries=100)
        retry(self._fail(times=10))
        self.assertTrue(retry._cur_delay < 4000, retry._cur_delay)
        # gevent's sleep function is picky about the type
-        self.assertEquals(type(retry._cur_delay), float)
+        self.assertEqual(type(retry._cur_delay), float)

    def test_deadline(self):
        retry = Retry(deadline=0.0001)
@@ -73,14 +73,14 @@ class TestWatchdog(unittest.TestCase):
    @patch.object(LinuxWatchdogDevice, 'can_be_disabled', PropertyMock(return_value=True))
    def test_unsafe_timeout_disable_watchdog_and_exit(self):
        watchdog = Watchdog({'ttl': 30, 'loop_wait': 15, 'watchdog': {'mode': 'required', 'safety_margin': -1}})
-        self.assertEquals(watchdog.activate(), False)
-        self.assertEquals(watchdog.is_running, False)
+        self.assertEqual(watchdog.activate(), False)
+        self.assertEqual(watchdog.is_running, False)

    @patch('platform.system', Mock(return_value='Linux'))
    @patch.object(LinuxWatchdogDevice, 'get_timeout', Mock(return_value=16))
    def test_timeout_does_not_ensure_safe_termination(self):
        Watchdog({'ttl': 30, 'loop_wait': 15, 'watchdog': {'mode': 'auto', 'safety_margin': -1}}).activate()
-        self.assertEquals(len(mock_devices), 2)
+        self.assertEqual(len(mock_devices), 2)

    @patch('platform.system', Mock(return_value='Linux'))
    @patch.object(Watchdog, 'is_running', PropertyMock(return_value=False))
@@ -99,29 +99,29 @@ class TestWatchdog(unittest.TestCase):
        watchdog = Watchdog({'ttl': 30, 'loop_wait': 10, 'watchdog': {'mode': 'required'}})
        watchdog.activate()

-        self.assertEquals(len(mock_devices), 2)
+        self.assertEqual(len(mock_devices), 2)
        device = mock_devices[-1]
        self.assertTrue(device.open)

-        self.assertEquals(device.timeout, 24)
+        self.assertEqual(device.timeout, 24)

        watchdog.keepalive()
-        self.assertEquals(len(device.writes), 1)
+        self.assertEqual(len(device.writes), 1)

        watchdog.disable()
        self.assertFalse(device.open)
-        self.assertEquals(device.writes[-1], b'V')
+        self.assertEqual(device.writes[-1], b'V')

    def test_invalid_timings(self):
        watchdog = Watchdog({'ttl': 30, 'loop_wait': 20, 'watchdog': {'mode': 'automatic', 'safety_margin': -1}})
        watchdog.activate()
-        self.assertEquals(len(mock_devices), 1)
+        self.assertEqual(len(mock_devices), 1)
        self.assertFalse(watchdog.is_running)

    def test_parse_mode(self):
        with patch('patroni.watchdog.base.logger.warning', new_callable=Mock()) as warning_mock:
            watchdog = Watchdog({'ttl': 30, 'loop_wait': 10, 'watchdog': {'mode': 'bad'}})
-            self.assertEquals(watchdog.config.mode, 'off')
+            self.assertEqual(watchdog.config.mode, 'off')
            warning_mock.assert_called_once()

    @patch('platform.system', Mock(return_value='Unknown'))
@@ -170,7 +170,7 @@ class TestNullWatchdog(unittest.TestCase):
        watchdog = NullWatchdog()
        self.assertTrue(watchdog.can_be_disabled)
        self.assertRaises(WatchdogError, watchdog.set_timeout, 1)
-        self.assertEquals(watchdog.describe(), 'NullWatchdog')
+        self.assertEqual(watchdog.describe(), 'NullWatchdog')
        self.assertIsInstance(NullWatchdog.from_config({}), NullWatchdog)


@@ -210,7 +210,7 @@ class TestLinuxWatchdogDevice(unittest.TestCase):
        self.assertRaises(WatchdogError, self.impl.get_timeout)
        self.assertRaises(WatchdogError, self.impl.set_timeout, 10)
        # We still try to output a reasonable string even if getting info errors
-        self.assertEquals(self.impl.describe(), "Linux watchdog device")
+        self.assertEqual(self.impl.describe(), "Linux watchdog device")

    @patch('os.open', Mock(side_effect=OSError))
    def test_open(self):
@@ -113,6 +113,7 @@ class TestPatroniSequentialThreadingHandler(unittest.TestCase):
    def test_create_connection(self):
        self.assertIsNotNone(self.handler.create_connection(()))
        self.assertIsNotNone(self.handler.create_connection((), 40))
+        self.assertIsNotNone(self.handler.create_connection(timeout=40))


 class TestZooKeeper(unittest.TestCase):
@@ -156,7 +157,7 @@ class TestZooKeeper(unittest.TestCase):
        self.zk.set_failover_value('Exception')

    def test_set_config_value(self):
-        self.zk.set_config_value('')
+        self.zk.set_config_value('', 1)
        self.zk.set_config_value('ok')
        self.zk.set_config_value('Exception')

@@ -179,7 +180,8 @@ class TestZooKeeper(unittest.TestCase):
        self.zk.touch_member({'retry': 'retry'})
        self.zk._fetch_cluster = True
        self.zk.get_cluster()
-        self.zk.touch_member({'retry': 'retry'})
+        self.zk.touch_member({'conn_url': 'postgres://repuser:rep-pass@localhost:5434/postgres',
+                              'api_url': 'http://127.0.0.1:8009/patroni'})

    def test_take_leader(self):
        self.zk.take_leader()
Author	SHA1	Message	Date
Alexander KukushkinandGitHub	f8f928420d	Release 1.5.2 (#875 ) * Update release notes * Bump version	2018-11-26 10:31:14 +01:00
Shea StewartandAlexander Kukushkin	6519a192b1	add openshift customizations, templates, and test (#871 ) - It modifies the Dockerfile and entrypoint slightly to allow for OpenShift SCCs to operate correctly - It adds 2 template examples that can be easily modified by changing parameters Fixes #572	2018-11-21 18:01:39 +01:00
Alexander KukushkinandGitHub	8c7e1892ee	touch_member method should not raise exceptions (#859 ) Fixes https://github.com/zalando/patroni/issues/853	2018-11-21 12:51:52 +01:00
Lardière SébastienandAlexander Kukushkin	a1ba2cdca7	Add confd template for pgbouncer (#844 )	2018-11-21 12:03:22 +01:00
Kostiantyn NemchenkoandAlexander Kukushkin	ce9c7bdadc	Describe Consul registration parameters (#870 ) Mention Consul related parameters introduced by #802	2018-11-21 12:00:40 +01:00
Alexander KukushkinandGitHub	fb01aaebc5	Compatibility with kazoo-2.6.0 (#872 ) Recently 2.6.0 was release which changes the way how create_connection method is called. Before it was passing two arguments, and in the new version all argument names are specified explicitly.	2018-11-19 14:26:20 +01:00
alago197andAlexander Kukushkin	a13cc8b847	Update SETTINGS.rst with connect_address clarifications (#858 )	2018-11-12 16:56:51 +01:00
lwsboxandAlexander Kukushkin	bd9f30372e	fix bug: change pip to pip3 (#851 ) should use python3 to install in postgres10 image.	2018-11-05 14:17:22 +01:00
Josh BerkusandAlexander Kukushkin	d247b5ae17	Fix several build problems with the Docker image for testing Kubernet… (#735 ) 1. Update to Postgres 10 2. Install most of the python modules from deb packages 3. Do not upgrade pip	2018-11-04 08:31:11 +01:00
Alexander KukushkinandGitHub	b4f35ecca0	Release 1.5.1 (#846 ) * Bump version * Update release notes	2018-11-01 16:18:41 +01:00
Alexander KukushkinandGitHub	0f666e69f3	Prefix system tables, views and functions with pg_catalog (#845 ) and implement missing unit tests	2018-11-01 16:17:40 +01:00
Alexander KukushkinandGitHub	2efd97baab	Permanent replication slots (#819 ) Permanent replication slots are preserved on failover/switchover, that is Patroni on the new primary will create configured replication slots right after doing promote. Slots could be configured with the help of `patronictl edit-config`. The initial configuration could be also done in the `bootstrap.dcs` ```yaml slots: permanent_physical_1: type: physical permanent_logical_1: type: logical database: foo plugin: pgoutput ``` It is the responsibility of the operator to make sure that there are no clashes in names between replication slots automatically created by Patroni for members and permanent replication slots. Closes https://github.com/zalando/patroni/issues/656	2018-10-31 11:37:42 +01:00
Alexander KukushkinandGitHub	c65c4f1ffe	Round-robing across all masters in pause mode if DCS is not accessible (#842 ) Regression was introduced in https://github.com/zalando/patroni/commit/90cf930036a9d5249265af15d2b787ec7517cf57 Fixes https://github.com/zalando/patroni/issues/841	2018-10-30 16:48:53 +01:00
SrikanthandAlexander Kukushkin	2264190e79	Add pre-command to start watchdog (#835 ) Add `ExecStartPre` commands to systemd unit to help start watchdog devices.	2018-10-26 07:55:01 +01:00
Alexander KukushkinandGitHub	f70edefc65	A few bugfixes in the "standby cluster" workflow (#823 ) * Always run `pg_rewind` against the remote master * Always use the remote master as the source when "recovering" stopped standby leader * Use remote master as the source when "recovering" the node in the unhealthy cluster * Use the local dbname as the fallback when doing `pg_rewind` from the remote master * `no_replication_slot` is the allowed key in the `RemoteMember` object * Make it possible to "bootstrap" the new `standby_cluster` with existing (and valid) data directory. There is one prerequisite though, there should be no `patroni.dynamic.json` file in it!	2018-10-09 13:30:48 +02:00
Yogesh SharmaandAlexander Kukushkin	6567f509b1	Add pgbackrest support (#1 ) (#822 ) * pgbackrest support pgBackrest can restore in existing $PGDATA folder, this allows speedy restore as files which have not changed since last backup are skipped, to support this feature new param keep_data has been introduced. When keep_data=True, cleanup of $PGDATA will be skipped. Patroni passes some extra parameters to custom_replica_methods when calling, this causes an error due to pgbackrest strict parameter checking. New param no_params=True can be set to skip parameters passing. Fixes https://github.com/zalando/patroni/issues/625	2018-10-08 19:00:30 +02:00
Alexander KukushkinandGitHub	534829d617	Release 1.5.0 (#809 ) Update release notes and bump version	2018-09-20 16:29:00 +02:00
Alexander KukushkinandGitHub	76d1b4cfd8	Minor fixes (#808 ) * Use `shutil.move` instead of `os.replace`, which is available only from 3.3 * Introduce standby-leader health-check and consul service * Improve unit tests, some lines were not covered * rename `assertEquals` -> `assertEqual`, due to deprecation warning	2018-09-19 16:32:33 +02:00
Pavel GolubandAlexander Kukushkin	3d76a013a7	Support for Windows (#799 ) Postgres on Windows is using different signals, backslashes as file separators and some of the functions and syscalls are not available there.	2018-09-19 13:50:36 +02:00
Pavel KirillovandAlexander Kukushkin	2e9cb412e4	Register service in consul (#802 ) Кegister service 'scope_name' with tag 'master' or 'replica' example with scope 'pgsql-pgpi' ```[root@pgpi1 ~]# host -t SRV pgsql-pgpi.service.consul. 127.0.0.1 Using domain server: Name: 127.0.0.1 Address: 127.0.0.1#53 Aliases: pgsql-pgpi.service.consul has SRV record 1 1 5432 pgpi1.node.dc.consul. pgsql-pgpi.service.consul has SRV record 1 1 5432 pgpi2.node.dc.consul. [root@pgpi1 ~]# host -t SRV master.pgsql-pgpi.service.consul. 127.0.0.1 Using domain server: Name: 127.0.0.1 Address: 127.0.0.1#53 Aliases: master.pgsql-pgpi.service.consul has SRV record 1 1 5432 pgpi2.node.dc.consul. [root@pgpi1 ~]# host -t SRV replica.pgsql-pgpi.service.consul. 127.0.0.1 Using domain server: Name: 127.0.0.1 Address: 127.0.0.1#53 Aliases: replica.pgsql-pgpi.service.consul has SRV record 1 1 5432 pgpi1.node.dc.consul.``` Fixes: https://github.com/zalando/patroni/issues/771	2018-09-07 15:17:56 +02:00
Dmitry DolgovandGitHub	dd7c3c349f	[WIP] Standby cluster implementation (#679 ) Implementation of "standby cluster" described in #657. Standby cluster consists of a "standby leader", that replicates from a "remote master" (which is not a part of current patroni cluster and can be anywhere), and cascade replicas, that replicate from the corresponding standby leader. "Standby leader" behaves pretty much like a regular leader, which means that it holds a leader lock in DSC, in case if disappears there will be an election of a new "standby leader". One can define such a cluster using the section "standby_cluster" in patroni config file. This section provides parameters for standby cluster, that will be applied only once during bootstrap and can be changed only through DSC.	2018-09-07 10:10:56 +02:00
Alexander KukushkinandGitHub	4ca8a6e506	Make retries of calls to DCS consistent across implementations (#805 ) in addition to that do a small refactoring of zookeeper and consul and try to improve the stability of AT	2018-09-06 08:37:26 +02:00
wilfriedrosetandAlexander Kukushkin	0136f252ab	Add patronictl -k/--insecure flag and suport for restapi cert (#790 ) Fixes https://github.com/zalando/patroni/issues/785	2018-08-29 16:08:13 +02:00
anikin-aaandAlexander Kukushkin	0e13677880	exclude members with nofailover tag (#798 ) Exclude members with nofailover tag from `patronictl switchover/failover` output. Fixes https://github.com/zalando/patroni/issues/769	2018-08-29 16:07:01 +02:00
anikin-aaandAlexander Kukushkin	68c0d87d42	check if output lines of controldata are possible to split (#797 ) Otherwise it fails with scary stacktrace	2018-08-29 16:06:06 +02:00
Alexander KukushkinandGitHub	90cf930036	Refactor REST API health-checks (#779 ) Make it more readable and easy to understand. Mostly it is needed to implement https://github.com/zalando/patroni/issues/772	2018-08-29 11:35:22 +02:00
Jan MusslerandAlexander Kukushkin	2b87ae0cd0	Add member name to error message. (#792 ) Analog to success message.	2018-08-29 11:30:51 +02:00
Alexander KukushkinandGitHub	5ca5dacaa9	Immediately reserve LSN on upon creation of replication slot (#783 ) This feature is available starting from 9.6	2018-08-29 11:30:01 +02:00
Alexander KukushkinandGitHub	87e9aab04c	Improve tests (#778 ) * Implement missing unit-tests * Add acceptance tests for ISSUE #776 * Update list of classifiers, keywords and authors	2018-08-29 11:29:37 +02:00
Alexander KukushkinandGitHub	518df2bc49	Search new sync candidate amoung potential and async standbys (#794 ) In synchronos_mode_strict we put '*' into synchronos_standby_names, what makes one connection 'sync' and other connections 'potential'. The code picking up the correct sync standby didn't consider 'potential' as a good candidate. Fixes: https://github.com/zalando/patroni/issues/789	2018-08-29 11:28:46 +02:00
Alexander KukushkinandGitHub	a513a7bb68	Improve stability of acceptance tests (#780 ) last time tests were failing due to postgres/patroni slowness in picking sync standby	2018-08-29 11:13:18 +02:00
Alexander KukushkinandGitHub	715caaddf3	Remove .zappr.yaml (#795 ) and switch to github approvals	2018-08-29 11:09:35 +02:00
Oleksii KliukinandAlexander Kukushkin	b165183503	Reset is_leader status on demote (#777 ) Make sure demoted cluster member stops responding with code 200 on the /master API call. Issue a new minor release. Fixes https://github.com/zalando/patroni/issues/776	2018-08-14 17:08:08 +02:00
Dmitry DolgovandGitHub	b282a0f254	Add "cluster_unlocked" field (#764 ) Add a field to an api to figure out if a master is there from patroni point of view. It can be useful, when you have an alert, based on Auto Scaling Groups, and then ASG decided to shutdown the current master, spin up a new instance but the current master shutdown is stuck. In this situation the current master is no longer a part of ASG, but patroni and Postgres are still alive on the instance, which means a new replica will not be promoted yet - this will lead to a false alert, saying that your cluster doesn't have any master node.	2018-08-13 14:02:01 +02:00