697 lines
23 KiB
Bash
Executable File
697 lines
23 KiB
Bash
Executable File
# Sourced by managed-container; uses the shared OCF and parameter environment.
|
|
|
|
pg_command()
|
|
{
|
|
local command="$1"
|
|
|
|
mc_runtime_exec \
|
|
--user "${PG_OS_USER}" \
|
|
"${CONTAINER_NAME}" \
|
|
sh -c "${command}"
|
|
}
|
|
|
|
pgdata_path()
|
|
{
|
|
pg_command '
|
|
if [ -z "$PGDATA" ]; then
|
|
exit 1
|
|
fi
|
|
|
|
printf "%s\n" "$PGDATA"
|
|
'
|
|
}
|
|
|
|
pg_running()
|
|
{
|
|
pg_command '
|
|
BINDIR="$(pg_config --bindir)" || exit 1
|
|
"$BINDIR/pg_ctl" status -D "$PGDATA" >/dev/null 2>&1
|
|
'
|
|
}
|
|
|
|
pg_ready()
|
|
{
|
|
mc_runtime_exec \
|
|
--user "${PG_OS_USER}" \
|
|
"${CONTAINER_NAME}" \
|
|
pg_isready -q \
|
|
-U "${DB_USER}" \
|
|
-d "${DB_NAME}"
|
|
}
|
|
|
|
pg_role()
|
|
{
|
|
mc_runtime_exec \
|
|
--user "${PG_OS_USER}" \
|
|
"${CONTAINER_NAME}" \
|
|
psql \
|
|
-U "${DB_USER}" \
|
|
-d "${DB_NAME}" \
|
|
-Atqc 'SELECT pg_is_in_recovery();'
|
|
}
|
|
|
|
pg_wal_receiver_status()
|
|
{
|
|
mc_runtime_exec \
|
|
--user "${PG_OS_USER}" \
|
|
"${CONTAINER_NAME}" \
|
|
psql \
|
|
-U "${DB_USER}" \
|
|
-d "${DB_NAME}" \
|
|
-Atqc "SELECT status FROM pg_stat_wal_receiver LIMIT 1;"
|
|
}
|
|
|
|
pg_streaming()
|
|
{
|
|
[ "$(pg_wal_receiver_status 2>/dev/null || true)" = "streaming" ]
|
|
}
|
|
|
|
pg_wal_receiver_sender()
|
|
{
|
|
mc_runtime_exec \
|
|
--user "${PG_OS_USER}" \
|
|
"${CONTAINER_NAME}" \
|
|
psql \
|
|
-U "${DB_USER}" \
|
|
-d "${DB_NAME}" \
|
|
-Atqc "
|
|
SELECT sender_host || '|' || sender_port
|
|
FROM pg_stat_wal_receiver
|
|
WHERE status = 'streaming'
|
|
LIMIT 1;
|
|
"
|
|
}
|
|
|
|
mc_pg_rejoin_running_standby()
|
|
{
|
|
local primary_info primary_rc primary_node primary_host primary_port
|
|
|
|
[ -n "${OCF_RESKEY_replication_peers:-}" ] || return 1
|
|
|
|
primary_info="$(mc_pg_find_remote_primary 2>/dev/null)"
|
|
primary_rc=$?
|
|
|
|
case "${primary_rc}" in
|
|
0)
|
|
primary_node="${primary_info%%|*}"
|
|
primary_info="${primary_info#*|}"
|
|
primary_host="${primary_info%%|*}"
|
|
primary_port="${primary_info#*|}"
|
|
|
|
ocf_log warn \
|
|
"Standby is not streaming while remote primary ${primary_node} (${primary_host}:${primary_port}) is available; forcing managed rejoin"
|
|
|
|
if pg_running; then
|
|
if ! pg_command '
|
|
BINDIR="$(pg_config --bindir)" || exit 1
|
|
exec "$BINDIR/pg_ctl" \
|
|
-D "$PGDATA" \
|
|
stop -m fast -w
|
|
'
|
|
then
|
|
ocf_exit_reason \
|
|
"Unable to stop non-streaming standby before managed rejoin"
|
|
return "${OCF_ERR_GENERIC}"
|
|
fi
|
|
fi
|
|
|
|
mc_pg_require_replication_slot || return "$?"
|
|
|
|
REJOIN_SOURCE_HOST="${primary_host}"
|
|
REJOIN_SOURCE_PORT="${primary_port}"
|
|
OCF_RESKEY_rejoin_source_host="${primary_host}"
|
|
OCF_RESKEY_rejoin_source_port="${primary_port}"
|
|
|
|
if ! managed_rejoin; then
|
|
ocf_exit_reason \
|
|
"Managed rejoin of non-streaming standby against ${primary_node} failed"
|
|
return "${OCF_ERR_GENERIC}"
|
|
fi
|
|
|
|
pg_clear_rejoin_pending >/dev/null 2>&1 || true
|
|
return "${OCF_SUCCESS}"
|
|
;;
|
|
|
|
1)
|
|
# No writable peer exists. This is a normal failover-election
|
|
# condition; leave the standby running Unpromoted and let the
|
|
# promotion scorer decide whether it is eligible.
|
|
return 1
|
|
;;
|
|
|
|
2)
|
|
ocf_exit_reason \
|
|
"Multiple writable PostgreSQL peers detected while repairing non-streaming standby"
|
|
return "${OCF_ERR_GENERIC}"
|
|
;;
|
|
|
|
*)
|
|
ocf_exit_reason \
|
|
"Unable to determine PostgreSQL peer-primary state while repairing non-streaming standby"
|
|
return "${OCF_ERR_GENERIC}"
|
|
;;
|
|
esac
|
|
}
|
|
|
|
|
|
pg_rejoin_pending()
|
|
{
|
|
pg_command 'test -f "$PGDATA/.loxthelion-ha-rejoin-required"'
|
|
}
|
|
|
|
pg_mark_rejoin_pending()
|
|
{
|
|
pg_command '
|
|
umask 077
|
|
: > "$PGDATA/.loxthelion-ha-rejoin-required"
|
|
chmod 600 "$PGDATA/.loxthelion-ha-rejoin-required"
|
|
'
|
|
}
|
|
|
|
pg_clear_rejoin_pending()
|
|
{
|
|
pg_command 'rm -f "$PGDATA/.loxthelion-ha-rejoin-required"'
|
|
}
|
|
|
|
mc_pg_reconcile_rejoin_marker()
|
|
{
|
|
local primary_info primary_rc primary_node primary_host primary_port
|
|
local receiver_sender
|
|
|
|
[ -n "${OCF_RESKEY_replication_peers:-}" ] || return 1
|
|
|
|
primary_info="$(mc_pg_find_remote_primary 2>/dev/null)"
|
|
primary_rc=$?
|
|
|
|
[ "${primary_rc}" -eq 0 ] || return 1
|
|
|
|
primary_node="${primary_info%%|*}"
|
|
primary_info="${primary_info#*|}"
|
|
primary_host="${primary_info%%|*}"
|
|
primary_port="${primary_info#*|}"
|
|
|
|
receiver_sender="$(pg_wal_receiver_sender 2>/dev/null || true)"
|
|
|
|
if ! pg_streaming; then
|
|
return 1
|
|
fi
|
|
|
|
if [ "${receiver_sender}" != "${primary_host}|${primary_port}" ]; then
|
|
return 1
|
|
fi
|
|
|
|
if ! pg_clear_rejoin_pending; then
|
|
ocf_log warn \
|
|
"Standby is streaming from elected primary ${primary_node}, but rejoin-required marker could not be cleared"
|
|
return 1
|
|
fi
|
|
|
|
ocf_log info \
|
|
"Standby is verified streaming from elected primary ${primary_node} (${primary_host}:${primary_port}); cleared provisional rejoin marker"
|
|
|
|
return 0
|
|
}
|
|
|
|
pg_has_standby_signal()
|
|
{
|
|
pg_command 'test -f "$PGDATA/standby.signal"'
|
|
}
|
|
|
|
managed_monitor()
|
|
{
|
|
local role
|
|
|
|
if ! service_running; then
|
|
ocf_log debug "User service ${SERVICE_NAME} is not active"
|
|
return "${OCF_NOT_RUNNING}"
|
|
fi
|
|
|
|
if ! container_running; then
|
|
ocf_log warn \
|
|
"Service ${SERVICE_NAME} is active but container ${CONTAINER_NAME} is not running"
|
|
return "${OCF_NOT_RUNNING}"
|
|
fi
|
|
|
|
if ! pg_running; then
|
|
ocf_log debug \
|
|
"Container ${CONTAINER_NAME} is running but PostgreSQL is stopped"
|
|
return "${OCF_NOT_RUNNING}"
|
|
fi
|
|
|
|
if ! pg_ready; then
|
|
ocf_exit_reason \
|
|
"PostgreSQL process exists but pg_isready failed"
|
|
return "${OCF_ERR_GENERIC}"
|
|
fi
|
|
|
|
role="$(pg_role 2>/dev/null)" || {
|
|
ocf_exit_reason \
|
|
"PostgreSQL is accepting connections but role query failed"
|
|
return "${OCF_ERR_GENERIC}"
|
|
}
|
|
|
|
case "${role}" in
|
|
f)
|
|
ocf_log debug \
|
|
"PostgreSQL healthy: role=primary (promoted)"
|
|
return "${OCF_RUNNING_PROMOTED}"
|
|
;;
|
|
t)
|
|
# A former primary may be started provisionally in recovery when
|
|
# no writable peer exists yet, solely so Pacemaker can decide
|
|
# which Unpromoted instance to promote. Once another node becomes
|
|
# primary, force recovery of this provisional instance through a
|
|
# stop/start cycle so start() can pg_rewind it against the winner.
|
|
if pg_rejoin_pending && [ -n "${OCF_RESKEY_replication_peers:-}" ]; then
|
|
local primary_info primary_rc
|
|
primary_info="$(mc_pg_find_remote_primary 2>/dev/null)"
|
|
primary_rc=$?
|
|
|
|
case "${primary_rc}" in
|
|
0)
|
|
ocf_exit_reason \
|
|
"A remote primary is now available (${primary_info%%|*}); provisional former-primary standby requires rejoin"
|
|
return "${OCF_ERR_GENERIC}"
|
|
;;
|
|
2)
|
|
ocf_exit_reason \
|
|
"Multiple writable PostgreSQL peers detected while monitoring provisional standby"
|
|
return "${OCF_ERR_GENERIC}"
|
|
;;
|
|
esac
|
|
fi
|
|
|
|
if pg_streaming; then
|
|
ocf_log debug \
|
|
"PostgreSQL healthy: role=standby (unpromoted), WAL receiver=streaming"
|
|
return "${OCF_SUCCESS}"
|
|
fi
|
|
|
|
# A standby can legitimately lose its receiver while the cluster
|
|
# has no writable primary (for example during failover election).
|
|
# Do not declare that condition unhealthy: promotion eligibility
|
|
# is decided separately by the promotion-scoring evidence. If a
|
|
# writable primary already exists, however, a non-streaming
|
|
# standby is broken and must be repaired rather than reported OK.
|
|
if [ -n "${OCF_RESKEY_replication_peers:-}" ]; then
|
|
local primary_info primary_rc
|
|
primary_info="$(mc_pg_find_remote_primary 2>/dev/null)"
|
|
primary_rc=$?
|
|
|
|
case "${primary_rc}" in
|
|
0)
|
|
ocf_exit_reason \
|
|
"PostgreSQL standby is in recovery but WAL receiver is not streaming while remote primary ${primary_info%%|*} is available"
|
|
return "${OCF_ERR_GENERIC}"
|
|
;;
|
|
1)
|
|
ocf_log debug \
|
|
"PostgreSQL standby is disconnected and no remote primary is currently identifiable; leaving promotion eligibility to Pacemaker scoring"
|
|
return "${OCF_SUCCESS}"
|
|
;;
|
|
2)
|
|
ocf_exit_reason \
|
|
"Multiple writable PostgreSQL peers detected while monitoring standby"
|
|
return "${OCF_ERR_GENERIC}"
|
|
;;
|
|
*)
|
|
ocf_exit_reason \
|
|
"Unable to determine PostgreSQL peer-primary state while monitoring standby"
|
|
return "${OCF_ERR_GENERIC}"
|
|
;;
|
|
esac
|
|
fi
|
|
|
|
# Backward-compatible behavior when native peer discovery is not
|
|
# configured: role-aware monitoring cannot prove an upstream.
|
|
ocf_log debug \
|
|
"PostgreSQL healthy: role=standby (unpromoted); native peer discovery is not configured"
|
|
return "${OCF_SUCCESS}"
|
|
;;
|
|
*)
|
|
ocf_exit_reason \
|
|
"Unexpected pg_is_in_recovery() result: '${role}'"
|
|
return "${OCF_ERR_GENERIC}"
|
|
;;
|
|
esac
|
|
|
|
}
|
|
|
|
managed_start()
|
|
{
|
|
local i monitor_rc
|
|
|
|
managed_monitor
|
|
monitor_rc=$?
|
|
|
|
case "${monitor_rc}" in
|
|
"${OCF_SUCCESS}")
|
|
ocf_log info \
|
|
"PostgreSQL resource already running unpromoted"
|
|
return "${OCF_SUCCESS}"
|
|
;;
|
|
|
|
"${OCF_RUNNING_PROMOTED}")
|
|
ocf_exit_reason \
|
|
"Refusing start: PostgreSQL is already primary; promotion must occur through promote()"
|
|
return "${OCF_ERR_GENERIC}"
|
|
;;
|
|
|
|
"${OCF_NOT_RUNNING}")
|
|
# Expected for a stopped resource. Continue.
|
|
;;
|
|
|
|
*)
|
|
# If start() is called for an already-running standby that is in
|
|
# recovery but cannot stream from an existing primary, repair it
|
|
# instead of simply returning the monitor failure. This catches a
|
|
# previous partial rejoin whose standby.signal survived restart.
|
|
if service_running && container_running && pg_running; then
|
|
local existing_role
|
|
existing_role="$(pg_role 2>/dev/null || true)"
|
|
if [ "${existing_role}" = "t" ] && ! pg_streaming; then
|
|
if mc_pg_rejoin_running_standby; then
|
|
managed_monitor
|
|
return $?
|
|
fi
|
|
fi
|
|
fi
|
|
|
|
ocf_exit_reason \
|
|
"Cannot start unhealthy PostgreSQL instance (monitor rc=${monitor_rc})"
|
|
return "${monitor_rc}"
|
|
;;
|
|
esac
|
|
|
|
ocf_log info \
|
|
"Ensuring container service ${SERVICE_NAME} is running"
|
|
|
|
if ! service_running; then
|
|
if ! mc_lifecycle_start "${SERVICE_NAME}"
|
|
then
|
|
ocf_exit_reason \
|
|
"Failed to start ${SERVICE_NAME}"
|
|
return "${OCF_ERR_GENERIC}"
|
|
fi
|
|
fi
|
|
|
|
for i in $(seq 1 20); do
|
|
container_running && break
|
|
sleep 0.5
|
|
done
|
|
|
|
if ! container_running; then
|
|
ocf_exit_reason \
|
|
"Container ${CONTAINER_NAME} did not become running"
|
|
return "${OCF_ERR_GENERIC}"
|
|
fi
|
|
|
|
if ! pg_running; then
|
|
#
|
|
# OCF promotable-resource rule:
|
|
# start() must produce an Unpromoted instance. Missing standby.signal
|
|
# therefore never authorizes a primary start. It means either:
|
|
# * a former primary can be rewound against an existing winner, or
|
|
# * no winner exists yet, in which case place this PGDATA into
|
|
# recovery and let Pacemaker decide whether to promote it.
|
|
#
|
|
if pg_rejoin_pending || ! pg_has_standby_signal; then
|
|
local primary_info primary_rc primary_node primary_host primary_port
|
|
|
|
if [ -z "${OCF_RESKEY_replication_peers:-}" ]; then
|
|
ocf_exit_reason \
|
|
"Cannot safely recover PGDATA without standby.signal: replication_peers is required for automatic primary discovery"
|
|
return "${OCF_ERR_CONFIGURED}"
|
|
fi
|
|
|
|
# At this point the maintenance container is running, so resolve
|
|
# the exact configured slot from PostgreSQL/container state before
|
|
# any rewind or recovery configuration is written.
|
|
mc_pg_require_replication_slot || return "$?"
|
|
|
|
primary_info="$(mc_pg_find_remote_primary 2>/dev/null)"
|
|
primary_rc=$?
|
|
|
|
case "${primary_rc}" in
|
|
0)
|
|
primary_node="${primary_info%%|*}"
|
|
primary_info="${primary_info#*|}"
|
|
primary_host="${primary_info%%|*}"
|
|
primary_port="${primary_info#*|}"
|
|
|
|
ocf_log info \
|
|
"Existing remote primary ${primary_node} (${primary_host}:${primary_port}) found; rejoining local PGDATA before start"
|
|
|
|
REJOIN_SOURCE_HOST="${primary_host}"
|
|
REJOIN_SOURCE_PORT="${primary_port}"
|
|
OCF_RESKEY_rejoin_source_host="${primary_host}"
|
|
OCF_RESKEY_rejoin_source_port="${primary_port}"
|
|
|
|
if ! managed_rejoin; then
|
|
ocf_exit_reason \
|
|
"Automatic rejoin against ${primary_node} failed"
|
|
return "${OCF_ERR_GENERIC}"
|
|
fi
|
|
|
|
pg_clear_rejoin_pending >/dev/null 2>&1 || true
|
|
managed_monitor
|
|
return $?
|
|
;;
|
|
|
|
1)
|
|
ocf_log info \
|
|
"No remote primary is currently identifiable; preparing local PGDATA as Unpromoted and leaving promotion exclusively to Pacemaker"
|
|
|
|
if ! mc_pg_write_peer_recovery; then
|
|
ocf_exit_reason \
|
|
"Unable to place PGDATA into native standby recovery while no primary exists"
|
|
return "${OCF_ERR_GENERIC}"
|
|
fi
|
|
|
|
if ! pg_mark_rejoin_pending; then
|
|
ocf_exit_reason \
|
|
"Unable to mark provisional standby as requiring rejoin if another node wins promotion"
|
|
return "${OCF_ERR_GENERIC}"
|
|
fi
|
|
;;
|
|
|
|
2)
|
|
ocf_exit_reason \
|
|
"Multiple writable PostgreSQL peers detected; refusing start"
|
|
return "${OCF_ERR_GENERIC}"
|
|
;;
|
|
|
|
*)
|
|
ocf_exit_reason \
|
|
"Unable to determine PostgreSQL peer-primary state"
|
|
return "${OCF_ERR_GENERIC}"
|
|
;;
|
|
esac
|
|
fi
|
|
|
|
ocf_log info \
|
|
"Starting PostgreSQL as an unpromoted standby inside ${CONTAINER_NAME}"
|
|
|
|
if ! pg_command '
|
|
BINDIR="$(pg_config --bindir)" || exit 1
|
|
exec "$BINDIR/pg_ctl" \
|
|
-D "$PGDATA" \
|
|
-l "$PGDATA/postgresql.log" \
|
|
start -w
|
|
'
|
|
then
|
|
ocf_exit_reason "pg_ctl start failed"
|
|
return "${OCF_ERR_GENERIC}"
|
|
fi
|
|
fi
|
|
|
|
managed_monitor
|
|
monitor_rc=$?
|
|
|
|
case "${monitor_rc}" in
|
|
"${OCF_SUCCESS}")
|
|
ocf_log info \
|
|
"PostgreSQL start completed in unpromoted state"
|
|
return "${OCF_SUCCESS}"
|
|
;;
|
|
|
|
"${OCF_RUNNING_PROMOTED}")
|
|
ocf_exit_reason \
|
|
"PostgreSQL became primary during start; stopping it to preserve OCF role semantics"
|
|
|
|
pg_command '
|
|
BINDIR="$(pg_config --bindir)" || exit 1
|
|
exec "$BINDIR/pg_ctl" \
|
|
-D "$PGDATA" \
|
|
stop -m fast -w
|
|
' >/dev/null 2>&1 || true
|
|
|
|
return "${OCF_ERR_GENERIC}"
|
|
;;
|
|
|
|
*)
|
|
# standby.signal can exist while the standby is still unusable
|
|
# (for example, its required WAL was removed after a failed
|
|
# primary repair). If a writable peer exists, route the instance
|
|
# through managed_rejoin(), whose guarded basebackup fallback can
|
|
# rebuild PGDATA when rewind alone cannot establish streaming.
|
|
if pg_running; then
|
|
local final_role
|
|
final_role="$(pg_role 2>/dev/null || true)"
|
|
if [ "${final_role}" = "t" ] && ! pg_streaming; then
|
|
if mc_pg_rejoin_running_standby; then
|
|
managed_monitor
|
|
return $?
|
|
fi
|
|
fi
|
|
fi
|
|
|
|
return "${monitor_rc}"
|
|
;;
|
|
esac
|
|
}
|
|
|
|
managed_stop()
|
|
{
|
|
local i
|
|
|
|
if container_running && pg_running; then
|
|
ocf_log info \
|
|
"Stopping PostgreSQL cleanly inside ${CONTAINER_NAME}"
|
|
|
|
if ! pg_command '
|
|
BINDIR="$(pg_config --bindir)" || exit 1
|
|
exec "$BINDIR/pg_ctl" \
|
|
-D "$PGDATA" \
|
|
stop -m fast -w
|
|
'
|
|
then
|
|
ocf_exit_reason "pg_ctl stop failed"
|
|
return "${OCF_ERR_GENERIC}"
|
|
fi
|
|
fi
|
|
|
|
if service_running; then
|
|
ocf_log info \
|
|
"Stopping container service ${SERVICE_NAME}"
|
|
|
|
if ! mc_lifecycle_stop "${SERVICE_NAME}"
|
|
then
|
|
ocf_exit_reason \
|
|
"Failed to stop ${SERVICE_NAME}"
|
|
return "${OCF_ERR_GENERIC}"
|
|
fi
|
|
fi
|
|
|
|
for i in $(seq 1 20); do
|
|
if ! service_running && ! container_running; then
|
|
return "${OCF_SUCCESS}"
|
|
fi
|
|
sleep 0.5
|
|
done
|
|
|
|
if service_running; then
|
|
ocf_exit_reason \
|
|
"${SERVICE_NAME} remained active after stop"
|
|
return "${OCF_ERR_GENERIC}"
|
|
fi
|
|
|
|
if container_running; then
|
|
ocf_exit_reason \
|
|
"${CONTAINER_NAME} remained running after stop"
|
|
return "${OCF_ERR_GENERIC}"
|
|
fi
|
|
|
|
return "${OCF_SUCCESS}"
|
|
}
|
|
|
|
# Conservative scoring eligibility only; this does not replace role detection,
|
|
# fencing, the promotion action, or the existing controlled-demote WAL checks.
|
|
# This strict predicate remains unchanged; disconnected policy is separate below.
|
|
mc_pg_promotion_eligible()
|
|
{
|
|
local eligible
|
|
|
|
# A provisional former primary must never become promotion-eligible.
|
|
# It may run in recovery so Pacemaker can observe it, but it must first
|
|
# complete a real rejoin/rewind against the elected primary.
|
|
if pg_rejoin_pending; then
|
|
return 1
|
|
fi
|
|
|
|
eligible="$(
|
|
mc_runtime_exec_bounded 3s --user "${PG_OS_USER}" \
|
|
--env 'PGOPTIONS=-c statement_timeout=2000' \
|
|
"${CONTAINER_NAME}" \
|
|
psql -X -v ON_ERROR_STOP=1 -U "${DB_USER}" -d "${DB_NAME}" -Atqc "
|
|
SELECT CASE WHEN pg_is_in_recovery() THEN
|
|
NOT pg_is_wal_replay_paused()
|
|
AND EXISTS (
|
|
SELECT 1 FROM pg_stat_wal_receiver
|
|
WHERE status = 'streaming'
|
|
AND flushed_lsn IS NOT NULL
|
|
AND pg_last_wal_replay_lsn() >= flushed_lsn
|
|
)
|
|
ELSE false END;
|
|
" 2>/dev/null
|
|
)" || return 1
|
|
[ "${eligible}" = t ]
|
|
}
|
|
|
|
# One observation supplies both strict connected eligibility and disconnected
|
|
# evidence. PostgreSQL restart time deliberately invalidates prior observations,
|
|
# including a new basebackup sharing the same PostgreSQL system identifier.
|
|
mc_pg_standby_observation()
|
|
{
|
|
mc_runtime_exec_bounded 3s --user "${PG_OS_USER}" \
|
|
--env 'PGOPTIONS=-c statement_timeout=2000' \
|
|
"${CONTAINER_NAME}" \
|
|
psql -X -v ON_ERROR_STOP=1 -U "${DB_USER}" -d "${DB_NAME}" -Atqc "
|
|
WITH s AS MATERIALIZED (
|
|
SELECT pg_is_in_recovery() AS recovery,
|
|
pg_last_wal_replay_lsn() AS replay,
|
|
r.status AS receiver, r.flushed_lsn AS flush
|
|
FROM (SELECT 1) AS singleton
|
|
LEFT JOIN pg_stat_wal_receiver r ON true
|
|
)
|
|
SELECT json_build_object(
|
|
'identity', json_build_array(
|
|
(SELECT system_identifier::text FROM pg_control_system()),
|
|
current_setting('data_directory'),
|
|
extract(epoch FROM pg_postmaster_start_time())::text),
|
|
'recovery', recovery,
|
|
'paused', CASE WHEN recovery THEN pg_is_wal_replay_paused() ELSE true END,
|
|
'receiver', receiver, 'replay', replay::text, 'flush', flush::text,
|
|
'strict', CASE WHEN recovery THEN
|
|
NOT pg_is_wal_replay_paused() AND receiver = 'streaming'
|
|
AND flush IS NOT NULL AND replay >= flush
|
|
ELSE false END)
|
|
FROM s;
|
|
" 2>/dev/null
|
|
}
|
|
|
|
mc_pg_standby_score()
|
|
{
|
|
local observation
|
|
|
|
# Hard promotion veto for provisional former-primary PGDATA. Returning
|
|
# -INFINITY here ensures Pacemaker cannot choose this instance while the
|
|
# rejoin-required marker exists, even though monitor may report it as a
|
|
# healthy Unpromoted standby.
|
|
if pg_rejoin_pending; then
|
|
if ! mc_pg_reconcile_rejoin_marker; then
|
|
printf '%s\n' '-INFINITY'
|
|
return 0
|
|
fi
|
|
fi
|
|
|
|
observation="$(mc_pg_standby_observation)" || return 1
|
|
# The helper is root-owned alongside the modules; state never enters the
|
|
# rootless container. A failed/slow helper always withdraws eligibility.
|
|
printf '%s' "${observation}" | timeout --kill-after=1s 1s python3 \
|
|
"${MC_APPLICATION_DIR}/promotion_state.py" \
|
|
"${MC_PROMOTION_RESOURCE_INSTANCE:-}" \
|
|
"${SERVICE_USER}" "${SERVICE_NAME}" "${CONTAINER_NAME}" \
|
|
"${OCF_RESKEY_disconnected_max_age:-300}"
|
|
}
|