Freeze lab-tested PostgreSQL plugin engine

Extract PostgreSQL, Podman runtime and systemd lifecycle adapters while preserving existing lifecycle and scoring behavior. Update RPM layout and add guarded operator-run lab harnesses. Record successful manual stop/start, promotion, demotion and rewind-only rejoin with pinned installed hashes. The unfenced lab does not validate automatic failover, Pacemaker-managed transitions or divergent-data rewind. Validation: 103 offline tests, original-function differential checks, checksum manifest and whitespace checks passed.
2026-09-13 01:57:04 -04:00
parent 488a1672d7
commit ec2077f979
41 changed files with 1925 additions and 331 deletions
@@ -0,0 +1,88 @@
+# Sourced by managed-container; uses the shared OCF and parameter environment.
+
+pg_replication_exec()
+{
+    mc_runtime_exec \
+        --user "${PG_OS_USER}" \
+        "${CONTAINER_NAME}" \
+        sh -c '
+            if [ -z "${POSTGRES_REPLICATION_PASSWORD:-}" ]; then
+                printf "%s\n" \
+                    "POSTGRES_REPLICATION_PASSWORD is missing from container environment" \
+                    >&2
+                exit 1
+            fi
+
+            export PGPASSWORD="${POSTGRES_REPLICATION_PASSWORD}"
+
+            exec "$@"
+        ' sh "$@"
+}
+
+ensure_rewind_privileges()
+{
+    local repl_user
+
+    repl_user="$(
+        pg_command '
+            printf "%s" "${POSTGRES_REPLICATION_USER:-}"
+        ' 2>/dev/null
+    )" || {
+        ocf_exit_reason \
+            "Unable to read POSTGRES_REPLICATION_USER from container"
+        return "${OCF_ERR_GENERIC}"
+    }
+
+    if [ -z "${repl_user}" ]; then
+        ocf_exit_reason \
+            "POSTGRES_REPLICATION_USER is empty"
+        return "${OCF_ERR_CONFIGURED}"
+    fi
+
+    case "${repl_user}" in
+        *[!A-Za-z0-9_]*)
+            ocf_exit_reason \
+                "Invalid replication role name: ${repl_user}"
+            return "${OCF_ERR_CONFIGURED}"
+            ;;
+    esac
+
+    ocf_log info \
+        "Ensuring pg_rewind source privileges for role ${repl_user}"
+
+    if ! pg_command "
+        psql \
+            -U '${DB_USER}' \
+            -d postgres \
+            -v ON_ERROR_STOP=1 \
+            -c \"
+                GRANT EXECUTE
+                    ON FUNCTION pg_catalog.pg_ls_dir(text, boolean, boolean)
+                    TO ${repl_user};
+
+                GRANT EXECUTE
+                    ON FUNCTION pg_catalog.pg_stat_file(text, boolean)
+                    TO ${repl_user};
+
+                GRANT EXECUTE
+                    ON FUNCTION pg_catalog.pg_read_binary_file(text)
+                    TO ${repl_user};
+
+                GRANT EXECUTE
+                    ON FUNCTION pg_catalog.pg_read_binary_file(
+                        text,
+                        bigint,
+                        bigint,
+                        boolean
+                    )
+                    TO ${repl_user};
+            \"
+    " >/dev/null
+    then
+        ocf_exit_reason \
+            "Failed ensuring pg_rewind privileges for ${repl_user}"
+        return "${OCF_ERR_GENERIC}"
+    fi
+
+    return "${OCF_SUCCESS}"
+}