fix: Repair PostgreSQL Patroni pg_hba and standby password drift#33
Merged
wallyxjh merged 3 commits intoJun 1, 2026
Merged
Conversation
Add a Component reconcile transformer for PostgreSQL Patroni clusters that repairs missing pg_hba rules in Patroni dynamic config after failover. The repair finds the current InstanceSet leader, reads the rendered pg_hba.conf ConfigMap when available, falls back to the required remote client/replication rules, patches Patroni /config, reloads Patroni, and verifies the resulting dynamic config. Also watch Pod changes so leader/failover state changes can retrigger Component reconciliation. Tests: - go test ./controllers/apps -run 'Test(ParsePgHBAContent|MergePgHBARules|RepairPatroniPgHBA|RepairPatroniPgHBANoop|RepairPatroniPgHBAReloadsAfterPreviousFailure|EnsurePgHBARemoteRules|HTTPPatroniConfigClient|ComponentPatroniDCSRepairTransformer|ComponentPatroniDCSRepairTransformerFallbackPgHBA)$' -count=1 - go test ./controllers/apps -run 'Test(ParsePgHBAContent|MergePgHBARules|RepairPatroniPgHBA|RepairPatroniPgHBANoop|RepairPatroniPgHBAReloadsAfterPreviousFailure|EnsurePgHBARemoteRules|HTTPPatroniConfigClient|ComponentPatroniDCSRepairTransformer|ComponentPatroniDCSRepairTransformerFallbackPgHBA)$' -race -count=1
Add a Component reconcile transformer for PostgreSQL clusters that repairs drift between the standby password stored in pod pgpass files and the password stored in the PostgreSQL leader after failover. The repair lists running component Pods, reads each Pod's /run/postgresql/pgpass entry for the standby user, stops automatic repair when pod passwords differ, finds the current InstanceSet leader, compares the expected md5 password hash in pg_authid, updates the standby role password when needed, and verifies the result. Tests: - go test ./controllers/apps -run 'Test(ParseStandbyPasswordFromPgpass|ConsistentStandbyPassword|ConsistentStandbyPasswordInconsistent|EnsureLeaderStandbyPassword|EnsureLeaderStandbyPasswordNoop|EnsureLeaderStandbyPasswordRejectsNewline|ComponentPostgreSQLStandbyPasswordRepairTransformer|ComponentPostgreSQLStandbyPasswordRepairTransformerInconsistent)$' -count=1 - go test ./controllers/apps -run 'Test(ParseStandbyPasswordFromPgpass|ConsistentStandbyPassword|ConsistentStandbyPasswordInconsistent|EnsureLeaderStandbyPassword|EnsureLeaderStandbyPasswordNoop|EnsureLeaderStandbyPasswordRejectsNewline|ComponentPostgreSQLStandbyPasswordRepairTransformer|ComponentPostgreSQLStandbyPasswordRepairTransformerInconsistent)$' -race -count=1
Handle PostgreSQL leaders that expose the standby credential through PGPASSWORD_STANDBY instead of a standby entry in /run/postgresql/pgpass, and skip automatic password repair for standby-cluster mode where the addon may use remote primary credentials.
im0x0ing
changed the title
wallyxjh
approved these changes
Jun 1, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds PostgreSQL-specific repair logic to the Component reconciliation pipeline to recover from Patroni failover drift.
Improvements to PostgreSQL recovery:
componentPatroniDCSRepairTransformerto verify and repair Patroni dynamicpostgresql.pg_hbaconfig after failover. The transformer reads expected rules from the rendered ConfigMap when available, falls back to the minimal required remote access rules, patches Patroni/config, reloads Patroni, and verifies the repaired config.componentPostgreSQLStandbyPasswordRepairTransformerto repair drift between the standby password used by PostgreSQL pods and the password stored in the leader database. It validates that all running pods agree on the standby credential, updates the leader only when the hash differs, and reports inconsistent credentials through Component conditions.Runtime safety and observability:
Validation: