Allow enabling https for Patroni REST API

[bkhomuts]

This change introduces new variables:
patroni_restapi_protocol
patroni_restapi_certfile
patroni_restapi_keyfile
patroni_restapi_cafile

With existing patroni_restapi_connect_addr and patroni_use_unix_socket_repl, it enables secure communication to the Patroni REST API.

Resolves: #1234

[bkhomuts]

The support for https is very initial, and will require manually enabling https on existing cluster, if switching from http to https, by configuring all parameters manually and reloading patroni. This is because the playbook will try to connect to https, before patroni accepts it.

For my low-scale use it works, but changing the settings effectively on higher scale will require creating additional logic to switch from http to https.

[vitabaks]

The support for https is very initial, and will require manually enabling https on existing cluster, if switching from http to https, by configuring all parameters manually and reloading patroni. This is because the playbook will try to connect to https, before patroni accepts it.

This change will be part of the upcoming 2.4 release, and we can highlight it in the release notes. For existing clusters, we can recommend explicitly setting patroni_restapi_protocol: http to maintain backward compatibility. For new clusters, however, it makes sense to enable TLS wherever possible to provide stronger security.

[vitabaks]

The test with a self-signed certificate for the Patroni REST API was successful — it works. On the client side, you either need to specify the cacert or disable certificate verification (e.g., the -k option in curl).

TODO: @vitabaks

• Extend the patroni client package in the Autobase API service to support HTTPS (with certificate verification disabled to allow self-signed certs). If HTTPS fails, fall back to HTTP (for backward compatibility).
• Test the updated Patroni cluster monitoring functionality in Autobase Console.

[Copilot]

Pull Request Overview

This PR enables HTTPS support for the Patroni REST API by introducing new configuration variables and updating the client code to support both HTTP and HTTPS protocols with automatic fallback.

• Adds HTTPS support with configurable protocol, certificate files, and CA certificate for secure Patroni REST API communication
• Implements automatic HTTPS-to-HTTP fallback in the Go client for backward compatibility
• Updates all Ansible playbooks and tasks to use the new protocol variables consistently across the codebase

Reviewed Changes

Copilot reviewed 17 out of 17 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
console/service/pkg/patroni/client.go	Refactored client to support HTTPS with fallback to HTTP, added TLS configuration
automation/roles/patroni/templates/patroni.yml.j2	Added conditional TLS certificate configuration to Patroni config template
automation/roles/common/defaults/main.yml	Defined new protocol and certificate variables with defaults
automation/roles/patroni/tasks/*.yml	Updated health check URLs to use configurable protocol and CA certificates
automation/roles/update/tasks/*.yml	Updated REST API calls to support HTTPS protocol and CA validation
automation/roles/upgrade/tasks/*.yml	Updated Patroni API calls to use new protocol variables
automation/playbooks/*.yml	Updated playbook API calls to use HTTPS-capable configuration
automation/molecule/tests/patroni/patroni.yml	Updated test to use configurable protocol

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

[vitabaks]

Test: Consul service heath-checks & Partoni API with https

HTTP checks expect a valid TLS certificate by default. You can disable certificate verification by setting the tls_skip_verify field to true.

Doc: https://developer.hashicorp.com/consul/docs/register/health-check/vm#http-checks

commit aba7655

result:

cat /etc/consul/conf.d/service_test-pgcluster-master.json

{
  "service": {
    "name": "test-pgcluster",
    "id": "test-pgcluster-master",
    "port": 6432,
    "checks": [{"http": "https://10.172.0.20:8008/primary", "interval": "2s", "tls_skip_verify": true}, {"args": ["systemctl", "status", "pgbouncer"], "interval": "5s"}],
    "tags": ["master", "primary"]
  }

cat /etc/consul/conf.d/service_test-pgcluster-replica.json

{
  "service": {
    "name": "test-pgcluster",
    "id": "test-pgcluster-replica",
    "port": 6432,
    "checks": [{"http": "https://10.172.0.20:8008/replica?lag=100MB", "interval": "2s", "tls_skip_verify": true}, {"args": ["systemctl", "status", "pgbouncer"], "interval": "5s"}],
    "tags": ["replica"]
  }
}

check:

root@pgnode01:/# dig @127.0.0.1 -p 8600 +short master.test-pgcluster.service.consul SRV
1 1 6432 pgnode03.node.dc1.consul.
root@pgnode01:/# 
root@pgnode01:/# dig @127.0.0.1 -p 8600 +short replica.test-pgcluster.service.consul SRV
1 1 6432 pgnode01.node.dc1.consul.
1 1 6432 pgnode02.node.dc1.consul.

connect:

root@pgnode01:/# psql -h master.test-pgcluster.service.consul -p 6432 -U postgres -d postgres
Password for user postgres: 
psql (17.6 (Ubuntu 17.6-1.pgdg22.04+1))
SSL connection (protocol: TLSv1.3, cipher: TLS_AES_256_GCM_SHA384, compression: off, ALPN: none)
Type "help" for help.

postgres=# select pg_is_in_recovery();
 pg_is_in_recovery 
-------------------
 f
(1 row)

postgres=# \q
root@pgnode01:/# psql -h replica.test-pgcluster.service.consul -p 6432 -U postgres -d postgres
Password for user postgres: 
psql (17.6 (Ubuntu 17.6-1.pgdg22.04+1))
SSL connection (protocol: TLSv1.3, cipher: TLS_AES_256_GCM_SHA384, compression: off, ALPN: none)
Type "help" for help.

postgres=# select pg_is_in_recovery();
 pg_is_in_recovery 
-------------------
 t
(1 row)

postgres=# \q

passed

[vitabaks]

Test: Autobase console & Patroni API with https

Test the updated Patroni cluster monitoring functionality in Autobase Console.

Result:

if node is unavailable

{"level":"debug","app":"pg_console","version":"2.3.2","module":"cluster_watcher","cluster":"vitabaks-pgcluster-01","error":"http fallback failed after https: Get \"https://172.31.42.40:8008/cluster\": context deadline exceeded (Client.Timeout exceeded while awaiting headers)","time":"2025-09-17T17:28:40Z","message":"failed to get patroni info"}
{"level":"debug","app":"pg_console","version":"2.3.2","cid":"03a1ca28-815f-4bf0-b180-8c95a147391b","error":"Get \"https://172.31.44.144:8008/cluster\": context deadline exceeded (Client.Timeout exceeded while awaiting headers)","time":"2025-09-17T17:28:42Z","message":"https request failed, falling back to http"}
{"level":"debug","app":"pg_console","version":"2.3.2","module":"cluster_watcher","cluster":"vitabaks-pgcluster-01","error":"http fallback failed after https: Get \"https://172.31.44.144:8008/cluster\": context deadline exceeded (Client.Timeout exceeded while awaiting headers)","time":"2025-09-17T17:28:44Z","message":"failed to get patroni info"}

if node is available

{"level":"debug","app":"pg_console","version":"2.3.2","query_id":"1ec5035f-6643-4fb2-96c6-803e91904870","cid":"65021616-f8b1-4294-851d-b49556232d15","sql":"insert into servers(cluster_id, ip_address, server_name, server_role, server_status, timeline, lag, tags, pending_restart)values($1, $2, $3, $4, $5, $6, $7, $8, $9) on conflict(cluster_id, ip_address) do update    set server_name = case when EXCLUDED.server_name = '' then servers.server_name else EXCLUDED.server_name end,        server_role = coalesce(EXCLUDED.server_role, servers.server_role),        server_status = coalesce(EXCLUDED.server_status, servers.server_status),        timeline = coalesce(EXCLUDED.timeline, servers.timeline),        lag = EXCLUDED.lag,        tags = coalesce(EXCLUDED.tags, servers.tags),        pending_restart = coalesce(EXCLUDED.pending_restart, servers.pending_restart) returning *","args":"(,85,\"172.31.36.231\",\"ip-172-31-36-231\",(*string)(\"replica\"),(*string)(\"streaming\"),(*int64)(1),(*int64)(0),(*interface{})(nil)(*bool)(false))","time":"2025-09-17T17:43:49Z","message":"TraceQueryStart"}
{"level":"debug","app":"pg_console","version":"2.3.2","query_id":"1ec5035f-6643-4fb2-96c6-803e91904870","cid":"65021616-f8b1-4294-851d-b49556232d15","time":"2025-09-17T17:43:49Z","message":"TraceQueryEnd duration: 2.857574ms"}
{"level":"debug","app":"pg_console","version":"2.3.2","query_id":"cbc3f30e-4734-440c-8a57-c7a419822e33","cid":"65021616-f8b1-4294-851d-b49556232d15","sql":"insert into servers(cluster_id, ip_address, server_name, server_role, server_status, timeline, lag, tags, pending_restart)values($1, $2, $3, $4, $5, $6, $7, $8, $9) on conflict(cluster_id, ip_address) do update    set server_name = case when EXCLUDED.server_name = '' then servers.server_name else EXCLUDED.server_name end,        server_role = coalesce(EXCLUDED.server_role, servers.server_role),        server_status = coalesce(EXCLUDED.server_status, servers.server_status),        timeline = coalesce(EXCLUDED.timeline, servers.timeline),        lag = EXCLUDED.lag,        tags = coalesce(EXCLUDED.tags, servers.tags),        pending_restart = coalesce(EXCLUDED.pending_restart, servers.pending_restart) returning *","args":"(,85,\"172.31.42.40\",\"ip-172-31-42-40\",(*string)(\"leader\"),(*string)(\"running\"),(*int64)(1),(*int64)(nil),(*interface{})(nil)(*bool)(false))","time":"2025-09-17T17:43:49Z","message":"TraceQueryStart"}
{"level":"debug","app":"pg_console","version":"2.3.2","query_id":"cbc3f30e-4734-440c-8a57-c7a419822e33","cid":"65021616-f8b1-4294-851d-b49556232d15","time":"2025-09-17T17:43:49Z","message":"TraceQueryEnd duration: 708.206µs"}
{"level":"debug","app":"pg_console","version":"2.3.2","query_id":"5f665979-d6b6-46a5-8901-8fe3dd5474ae","cid":"65021616-f8b1-4294-851d-b49556232d15","sql":"insert into servers(cluster_id, ip_address, server_name, server_role, server_status, timeline, lag, tags, pending_restart)values($1, $2, $3, $4, $5, $6, $7, $8, $9) on conflict(cluster_id, ip_address) do update    set server_name = case when EXCLUDED.server_name = '' then servers.server_name else EXCLUDED.server_name end,        server_role = coalesce(EXCLUDED.server_role, servers.server_role),        server_status = coalesce(EXCLUDED.server_status, servers.server_status),        timeline = coalesce(EXCLUDED.timeline, servers.timeline),        lag = EXCLUDED.lag,        tags = coalesce(EXCLUDED.tags, servers.tags),        pending_restart = coalesce(EXCLUDED.pending_restart, servers.pending_restart) returning *","args":"(,85,\"172.31.44.144\",\"ip-172-31-44-144\",(*string)(\"replica\"),(*string)(\"streaming\"),(*int64)(1),(*int64)(0),(*interface{})(nil)(*bool)(false))","time":"2025-09-17T17:43:49Z","message":"TraceQueryStart"}
{"level":"debug","app":"pg_console","version":"2.3.2","query_id":"5f665979-d6b6-46a5-8901-8fe3dd5474ae","cid":"65021616-f8b1-4294-851d-b49556232d15","time":"2025-09-17T17:43:49Z","message":"TraceQueryEnd duration: 618.966µs"}

passed