How To Audit Patroni Cluster

[muhabbad]

I have setuped patroni cluster with the playbook. Now i want to audit which user executes which command and i want to follow the processes on my cluster. I installed pgaudit and i can log the things that i want but there is an issue. All client ip addresses show me my pgbouncer ip address in my logs. There is not actual client ip address etc.. When i control pgbouncer client connections, i see that all incoming client connections belong to a haproxy instance. So there is still no actual client ip address. What to do now? I want to restrict some users to access to the server based on the some hosts or network cidr. How can i do it? Did you have a need something like this before?

[vitabaks]

haproxy does not forward client addresses and therefore you only see the addresses of the load balancer.

Related issue #239

[vitabaks]

Try a scheme of Type C (Consul) in which you can also balance the load on reading, but haproxy is not used there.

[muhabbad]

Thank you @vitabaks for you answer. How about auditing HAProxy? I have been using the system on production and don't have a chance to change the architecture for now. Is there something like auditing haproxy and restricting some connections based on specific subnets?

[vitabaks]

Thank you @vitabaks for you answer. How about auditing HAProxy? I have been using the system on production and don't have a chance to change the architecture for now. Is there something like auditing haproxy and restricting some connections based on specific subnets?

Use firewall