mirror of
https://github.com/outbackdingo/patroni.git
synced 2026-09-03 01:59:45 +00:00
Feike Steenbergen
f98f56af41
Environment variables available to the postmaster can be examined
by non-superusers (e.g. plperl is trusted, yet you can show the environment).
In some environments secrets may be written in environment variables.
Commit 9744019341 introduced the ability to
specify the full Patroni configuration as an environment variable,
PATRONI_CONFIGURATION.
PATRONI_CONFIGURATION will by definition contain secrets, the passwords for superuser,
replcation user etc.
We therefore only retain a small subset of the environment for pg_ctl start, to ensure
no leakage of these values are possible.