When we running standby cluster we must allow connection from postgres user and know it's credentials?

• Which image of the operator are you using? ghcr.io/zalando/postgres-operator:v1.12.2
• Where do you run it - cloud or metal? Kubernetes or OpenShift? Bare Metal K8s
• Are you running Postgres Operator in production? no
• Type of issue? question

I can't provide postgres password and access to it from standby replica to main server, as this is different cluster that I not own, I only allowed to replicate it with user I was provided.

From what I see there is no way to setup rewind user, or just say to use same standby user for check_leader_is_not_in_recovery.

Based on: Patroni ENVIRONMENT:

• PATRONI_REWIND_USERNAME: (optional) name for the user for pg_rewind; the user will be created during initialization of postgres 11+ and all necessary permissions will be granted.
• PATRONI_REWIND_PASSWORD: (optional) password for the user for pg_rewind; the user will be created during initialization.
• PATRONI_SUPERUSER_USERNAME: name for the superuser, set during initialization (initdb) and later used by Patroni to connect to the postgres. Also this user is used by pg_rewind.

I tried settings PATRONI_REWIND_USERNAME and PATRONI_REWIND_PASSWORD environment variables to the pods, but it doesn't change behavior of cluster (from what I read Spilo ignores PATRONI_* varuables).

I can't set rewind user settings in CRDs, and this is a problem.

Operator also not allows me to set same superuser login as standby login.

In result I facing next error:

2024-08-06 18:02:15,773 ERROR: Exception when working with leader
Traceback (most recent call last):
  File "/usr/local/lib/python3.10/dist-packages/patroni/postgresql/rewind.py", line 79, in check_leader_is_not_in_recovery
    with get_connection_cursor(connect_timeout=3, options='-c statement_timeout=2000', **conn_kwargs) as cur:
  File "/usr/lib/python3.10/contextlib.py", line 135, in __enter__
    return next(self.gen)
  File "/usr/local/lib/python3.10/dist-packages/patroni/postgresql/connection.py", line 157, in get_connection_cursor
    conn = psycopg.connect(**kwargs)
  File "/usr/local/lib/python3.10/dist-packages/patroni/psycopg.py", line 103, in connect
    ret = _connect(*args, **kwargs)
  File "/usr/lib/python3/dist-packages/psycopg2/__init__.py", line 122, in connect
    conn = _connect(dsn, connection_factory=connection_factory, **kwasync)
psycopg2.OperationalError: connection to server at "main-server", port 5432 failed: FATAL:  password authentication failed for user "postgres"
connection to server at "main-server", port 5432 failed: FATAL:  pg_hba.conf rejects connection for host "myip", user "postgres", database "postgres", no encryption

Start by tracing how the operator's CRD settings configure Patroni and Spilo, especially the rewind credentials and the check_leader_is_not_in_recovery path described in the error. Determine whether the standby credentials can be used or a rewind user can be configured, then verify that the standby can connect to the main server without requiring the main cluster's postgres password.