managed-container/ocf/loxthelion/managed-container.d/applications/postgresql/promote.sh

# Sourced by managed-container; uses the shared OCF and parameter environment.

mc_pg_promote_database_shadow()
{
    local socket_path resource response rc

    socket_path="${MC_PROXY_SOCKET:-/run/user/1000/managed-containerd/managed-containerd.sock}"
    resource="${OCF_RESOURCE_INSTANCE:-}"
    resource="${resource%%:*}"

    # Standalone/resource-agent tests may not have a real resource identity.
    [ -n "${resource}" ] || return 0

    if response="$(
        timeout --kill-after=1s 5s \
            python3 \
            "${MC_PROXY_CLIENT:-/usr/lib/ocf/resource.d/loxthelion/managed-container.d/proxy_client.py}" \
            "${socket_path}" \
            "${resource}" \
            "promote.database" \
            10 \
            11
    )"; then
        rc=0
    else
        rc=$?
    fi

    if [ "${rc}" -ne 0 ]; then
        ocf_log warn \
            "managed-containerd promote.database shadow unavailable rc=${rc}"
        return 0
    fi

    if MC_DAEMON_RESPONSE="${response}" python3 -c '
import json
import os

response = json.loads(os.environ["MC_DAEMON_RESPONSE"])

if (
    response.get("ocf_rc") != 0
    or response.get("ready") is not True
    or response.get("mutation") is not False
):
    raise SystemExit(1)
'; then
        ocf_log info \
            "managed-containerd promote.database shadow: comparison=MATCH response=${response}"
    else
        ocf_log err \
            "managed-containerd promote.database shadow MISMATCH response=${response}"
    fi

    # Shadow-only milestone: daemon disagreement must not alter the
    # authoritative native promotion result yet.
    return 0
}


managed_promote()
{
    local monitor_rc role i

    # Belt-and-suspenders safety: promotion scoring already returns
    # -INFINITY while this marker exists, but refuse the action itself too.
    # This protects against an administrative/manual promotion request or a
    # future scoring regression.
    if pg_rejoin_pending; then
        ocf_exit_reason \
            "Cannot promote PostgreSQL while rejoin-required is set; instance must rejoin the elected primary first"
        return "${OCF_ERR_GENERIC}"
    fi

    managed_monitor
    monitor_rc=$?

    case "${monitor_rc}" in
        "${OCF_RUNNING_PROMOTED}")
            ocf_log info \
                "PostgreSQL is already primary; reconciling primary invariants"

            if ! ensure_local_ha_slots; then
                ocf_exit_reason \
                    "HA slot reconciliation failed on existing primary"
                return "${OCF_ERR_GENERIC}"
            fi

            if ! ensure_rewind_privileges; then
                ocf_exit_reason \
                    "pg_rewind privilege reconciliation failed on existing primary"
                return "${OCF_ERR_GENERIC}"
            fi

            pg_clear_rejoin_pending >/dev/null 2>&1 || true
            return "${OCF_SUCCESS}"
            ;;

        "${OCF_SUCCESS}")
            # Healthy standby: continue with promotion.
            ;;

        "${OCF_NOT_RUNNING}")
            ocf_exit_reason \
                "Cannot promote PostgreSQL because the resource is not running"
            return "${OCF_ERR_GENERIC}"
            ;;

        *)
            ocf_exit_reason \
                "Cannot promote unhealthy PostgreSQL instance (monitor rc=${monitor_rc})"
            return "${monitor_rc}"
            ;;
    esac

    ocf_log info \
        "Promoting PostgreSQL standby inside ${CONTAINER_NAME}"

    # Independent managed-containerd promotion preflight.
    # Shadow-only for now: disagreement is logged but does not block
    # the authoritative native PostgreSQL promotion.
    mc_pg_promote_database_shadow

    if ! pg_command '
        BINDIR="$(pg_config --bindir)" || exit 1
        exec "$BINDIR/pg_ctl" \
            -D "$PGDATA" \
            promote -w
    '
    then
        ocf_exit_reason "pg_ctl promote failed"
        return "${OCF_ERR_GENERIC}"
    fi

    for i in $(seq 1 30); do
        role="$(pg_role 2>/dev/null)" || {
            sleep 1
            continue
        }

        if [ "${role}" = "f" ]; then
            ocf_log info \
                "PostgreSQL became primary; reconciling primary invariants"

            if ! ensure_local_ha_slots; then
                ocf_exit_reason \
                    "PostgreSQL promoted but HA slot reconciliation failed"
                return "${OCF_ERR_GENERIC}"
            fi

            if ! ensure_rewind_privileges; then
                ocf_exit_reason \
                    "PostgreSQL promoted but pg_rewind privilege reconciliation failed"
                return "${OCF_ERR_GENERIC}"
            fi

            if ! pg_clear_rejoin_pending; then
                ocf_log warn \
                    "PostgreSQL promoted successfully but provisional rejoin marker could not be cleared"
            fi

            ocf_log info \
                "PostgreSQL promotion completed successfully"
            return "${OCF_SUCCESS}"
        fi

        sleep 1
    done

    ocf_exit_reason \
        "PostgreSQL did not become primary after promotion"
    return "${OCF_ERR_GENERIC}"
}