Do not let PostgreSQL to notify systemd (patroni#3590)

When systemd receives unexpected notifications it may terminate Patroni unit.

Close patroni#3586

Author: CyberDem0n

docs/releases.rst

@@ -3,6 +3,26 @@
 Release notes
 =============
 
+Version 4.1.2
+-------------
+
+Released 2026-04-21
+
+**Systemd support improvements**
+
+- Add support for ``notify-reload`` systemd unit type (Ronan Dunklau)
+
+  Allows ``systemctl reload`` to wait until Patroni has actually processed the configuration reload by sending ``RELOADING=1`` and ``READY=1`` notifications to systemd.
+
+- Send ``STOPPING=1`` notification to systemd on shutdown (Alexander Kukushkin)
+
+  Patroni now properly notifies systemd that it is shutting down, following the systemd notify protocol.
+
+- Do not let PostgreSQL to notify systemd (Alexander Kukushkin)
+
+  Remove ``NotifyAccess=all`` from the example systemd unit file. Filter ``NOTIFY_SOCKET`` from the environment when starting PostgreSQL so it doesn't send ``READY=1`` or ``STOPPING=1`` to systemd. When taking over a PostgreSQL that was started before Patroni and already has ``NOTIFY_SOCKET``, re-assert ``READY=1`` during PostgreSQL shutdown to counteract its ``STOPPING=1``.
+
+
 Version 4.1.1
 -------------
 

extras/startup-scripts/patroni.service

@@ -7,7 +7,6 @@ After=syslog.target network.target
 
 [Service]
 Type=notify
-NotifyAccess=all
 
 User=postgres
 Group=postgres

patroni/daemon.py

@@ -169,6 +169,7 @@ def shutdown(self) -> None:
         """
         with self._sigterm_lock:
             self._received_sigterm = True
+        notify_systemd("STOPPING=1")
         self._shutdown()
         self.logger.shutdown()
 

patroni/postgresql/__init__.py

@@ -19,6 +19,7 @@
 from .. import global_config, psycopg
 from ..async_executor import CriticalTask
 from ..collections import CaseInsensitiveDict, CaseInsensitiveSet, EMPTY_DICT
+from ..daemon import notify_systemd
 from ..dcs import Cluster, Leader, Member, slot_name_from_member_name
 from ..exceptions import PostgresConnectionException
 from ..tags import Tags
@@ -899,10 +900,14 @@ def _do_stop(self, mode: str, block_callbacks: bool, checkpoint: bool,
                 on_safepoint()
             return success, True
 
-        # We can skip safepoint detection if we don't have a callback
+        # Wait for our connection to terminate to detect that PostgreSQL started shutting down.
+        self._wait_for_connection_close(postmaster)
+        # If the stopped PostgreSQL was started before Patroni (e.g. a takeover) it may have
+        # had NOTIFY_SOCKET in its environment and sent STOPPING=1 to systemd on shutdown.
+        # Re-assert READY=1 to counteract that when NotifyAccess=all is configured.
+        notify_systemd("READY=1")
+
         if on_safepoint:
-            # Wait for our connection to terminate so we can be sure that no new connections are being initiated
-            self._wait_for_connection_close(postmaster)
             postmaster.wait_for_user_backends_to_close(stop_timeout)
             on_safepoint()
 

patroni/postgresql/postmaster.py

@@ -225,8 +225,10 @@ def start(pgcommand: str, data_dir: str, conf: str, options: List[str]) -> Optio
         # In order to make everything portable we can't use fork&exec approach here, so  we will call
         # ourselves and pass list of arguments which must be used to start postgres.
         # On Windows, in order to run a side-by-side assembly the specified env must include a valid SYSTEMROOT.
-        env = {p: os.environ[p] for p in os.environ if not p.startswith(
-            PATRONI_ENV_PREFIX) and not p.startswith(KUBERNETES_ENV_PREFIX)}
+        # We also remove NOTIFY_SOCKET environment variable so that PostgreSQL doesn't send READY=1 or STOPPING=1
+        # to systemd, because it is exclusively responsibility of Patroni to do it.
+        env = {p: os.environ[p] for p in os.environ if p != 'NOTIFY_SOCKET'
+               and not p.startswith(PATRONI_ENV_PREFIX) and not p.startswith(KUBERNETES_ENV_PREFIX)}
         if 'PG_MALLOC_ARENA_MAX' in env:
             env['MALLOC_ARENA_MAX'] = env.pop('PG_MALLOC_ARENA_MAX')
         try:

patroni/version.py

@@ -2,4 +2,4 @@
 
 :var __version__: the current Patroni version.
 """
-__version__ = '4.1.1'
+__version__ = '4.1.2'

setup.py

@@ -8,6 +8,7 @@
 import inspect
 import logging
 import os
+import re
 import sys
 
 from setuptools import Command, find_packages, setup
@@ -208,7 +209,7 @@ def main():
         license=LICENSE,
         license_files=('LICENSE',),
         keywords=KEYWORDS,
-        long_description=read('README.rst').replace('**Important!**', '.. warning::\n'),
+        long_description=re.sub(r'\n\n\.\. image:: docs/[^\n]*(?:\n   [^\n]+)*', '', read('README.rst')),
         classifiers=CLASSIFIERS,
         packages=find_packages(exclude=['tests', 'tests.*']),
         package_data={MAIN_PACKAGE: [

tests/test_ha.py

@@ -658,6 +658,7 @@ def test_bootstrap_release_initialize_key_on_failure(self):
     @patch('patroni.postgresql.mpp.citus.connect', psycopg_connect)
     @patch('patroni.postgresql.mpp.citus.quote_ident', Mock())
     @patch.object(Postgresql, 'connection', Mock(return_value=None))
+    @patch.object(Postgresql, '_wait_for_connection_close', Mock())
     def test_bootstrap_release_initialize_key_on_watchdog_failure(self):
         self.ha.cluster = get_cluster_not_initialized_without_leader()
         self.e.initialize = true
@@ -671,6 +672,7 @@ def test_bootstrap_release_initialize_key_on_watchdog_failure(self):
                                                                    ' watchdog activation failed'))
 
     @patch('patroni.psycopg.connect', psycopg_connect)
+    @patch.object(Postgresql, '_wait_for_connection_close', Mock())
     def test_reinitialize(self):
         self.assertIsNotNone(self.ha.reinitialize())
 
@@ -1794,6 +1796,7 @@ def test_sysid_no_match_in_pause(self):
     @patch('builtins.open', mock_open())
     @patch.object(ConfigHandler, 'check_recovery_conf', Mock(return_value=(False, False)))
     @patch.object(Postgresql, 'major_version', PropertyMock(return_value=130000))
+    @patch.object(Postgresql, '_wait_for_connection_close', Mock())
     @patch.object(SlotsHandler, 'sync_replication_slots', Mock(return_value=['ls']))
     def test_follow_copy(self):
         self.ha.cluster.config.data['slots'] = {'ls': {'database': 'a', 'plugin': 'b'}}

tests/test_patroni.py

@@ -124,6 +124,7 @@ def test_apply_dynamic_configuration(self):
     @patch.object(AbstractEtcdClientWithFailover, '_get_machines_list', Mock(return_value=['http://remotehost:2379']))
     @patch.object(Thread, 'join', Mock())
     @patch.object(Postgresql, '_get_gucs', Mock(return_value={'foo': True, 'bar': True}))
+    @patch.object(Postgresql, '_wait_for_connection_close', Mock())
     def test_patroni_patroni_main(self):
         with patch('subprocess.call', Mock(return_value=1)):
             with patch.object(Patroni, 'run', Mock(side_effect=SleepException)):

tests/test_postgresql.py

@@ -490,6 +490,7 @@ def test_call_nowait(self):
         self.assertIsNone(self.p.call_nowait(CallbackAction.ON_START))
 
     @patch.object(Postgresql, 'is_running', Mock(return_value=MockPostmaster()))
+    @patch.object(Postgresql, '_wait_for_connection_close', Mock())
     def test_is_primary_exception(self):
         self.p.start()
         self.p.query = Mock(side_effect=psycopg.OperationalError("not supported"))