Message-ID: <67c5b9b0.050a0220.324e87.5ae8@mx.google.com>
Sender: Michael Banck <mbanck@gmail.com>
Date: Mon, 3 Mar 2025 15:16:15 +0100
From: Michael Banck <mbanck@gmx.net>
To: kamal deen <kamaldeendba@gmail.com>
Cc: Ron Johnson <ronljohnsonjr@gmail.com>,
	pgsql-admin <pgsql-admin@postgresql.org>
Subject: Re: Super user password explicit in patroni yml
References: 
 <CAAGAcEe8qmL05tCLX_y8cPK8UHoxVOnC6BW1Or33-pH9xcxgQw@mail.gmail.com>
 <CANzqJaCSGSRXnA6voPqHm2sMbEp_cH=+DnD0h2QnBku+pBohUA@mail.gmail.com>
 <CAAGAcEdPLiRqHwjT04iKyUy_1+qsF+0xEZi8rWuY9Qc4_vf_eA@mail.gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: 
 <CAAGAcEdPLiRqHwjT04iKyUy_1+qsF+0xEZi8rWuY9Qc4_vf_eA@mail.gmail.com>
User-Agent: Mutt/1.10.1 (2018-07-13)
Archived-At: 
 <https://www.postgresql.org/message-id/67c5b9b0.050a0220.324e87.5ae8%40mx.google.com>
Precedence: bulk

Hi,

On Thu, Feb 27, 2025 at 01:30:55AM +0530, kamal deen wrote:
> Without .pgpass file patroni can connect to postgres ?

Well, I think you could also set the password via environment variables,
but I am not sure that is much better form a security point-of-view.

As an alternative, if you have unix sockets configured and keep the
superuser password empty, Patroni will use a local unix socket
connection, i.e. does not require a superuser password to be set.

> How patroni service works in this sinario?

If you want to use pg_rewind, you will need to configure an additional
pg_rewind user (with a password, cause pg_rewind connects remotely) if
your superuser has no password. If you add this to a running Patroni
cluster, I think Patroni will not GRANT the necessary function execution
rights to this pg_rewind user so you will have to do this yourself. This
should all be in the Patroni documentation.


Michael