Repository: zalando/patroni
Pull request #2684 (2023-05-22 13:35:50)

Remove bootstrap.pg_hba
Remove legacy `bootstrap.pg_hba` config parameter from config validator, docs and the dev yaml files.
It is still supported though.

coveralls: ## Pull Request Test Coverage Report for [Build 5046486961](https://coveralls.io/builds/60188260)

* **0** of **0**   changed or added relevant lines in **0** files are covered.
* No unchanged relevant lines lost coverage.
* Overall coverage remained the same at **99.849%**

---



|  Totals | [![Coverage Status](https://coveralls.io/builds/60188260/badge)](https://coveralls.io/builds/60188260) |
| :-- | --: |
| Change from base [Build 5046430074](https://coveralls.io/builds/60186865): |  0.0% |
| Covered Lines: | 12546 |
| Relevant Lines: | 12565 |

---
##### 💛  - [Coveralls](https://coveralls.io)


Patch:
diff --git a/.github/ISSUE_TEMPLATE/bug_report.yml b/.github/ISSUE_TEMPLATE/bug_report.yml
index 7c97a4e3..fca0377a 100644
--- a/.github/ISSUE_TEMPLATE/bug_report.yml
+++ b/.github/ISSUE_TEMPLATE/bug_report.yml
@@ -6,7 +6,7 @@ body:
 - type: markdown
   attributes:
     value: |
-      If you have a question please post it on channel [#patroni](https://postgresteam.slack.com/archives/C9XPYG92A) in the [PostgreSQL Slack](https://join.slack.com/t/postgresteam/shared_invite/zt-1qj14i9sj-E9WqIFlvcOiHsEk2yFEMjA).
+      If you have a question please post it on channel [#patroni](https://postgresteam.slack.com/archives/C9XPYG92A) in the [PostgreSQL Slack](https://pgtreats.info/slack-invite).
       Before reporting a bug please make sure to **reproduce it with the latest Patroni version**!
       Please fill the form below and provide as much information as possible.
       Not doing so may result in your bug not being addressed in a timely manner.
diff --git a/.github/ISSUE_TEMPLATE/config.yml b/.github/ISSUE_TEMPLATE/config.yml
index d63cedc1..5c40952c 100644
--- a/.github/ISSUE_TEMPLATE/config.yml
+++ b/.github/ISSUE_TEMPLATE/config.yml
@@ -1,5 +1,5 @@
 blank_issues_enabled: false
 contact_links:
 - name: Question
-  url: https://join.slack.com/t/postgresteam/shared_invite/zt-1qj14i9sj-E9WqIFlvcOiHsEk2yFEMjA
+  url: https://pgtreats.info/slack-invite
   about: "Please ask questions on channel #patroni in the PostgreSQL Slack"
diff --git a/Dockerfile b/Dockerfile
index 5892e1ef..4aa0ce5c 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -155,14 +155,15 @@ WORKDIR $PGHOME
 
 RUN sed -i 's/env python/&3/' /patroni*.py \
     # "fix" patroni configs
-    && sed -i 's/^\(  connect_address:\|  - host\)/#&/' postgres?.yml \
     && sed -i 's/^  listen: 127.0.0.1/  listen: 0.0.0.0/' postgres?.yml \
     && sed -i "s|^\(  data_dir: \).*|\1$PGDATA|" postgres?.yml \
     && sed -i "s|^#\(  bin_dir: \).*|\1$PGBIN|" postgres?.yml \
     && sed -i 's/^  - encoding: UTF8/  - locale: en_US.UTF-8\n&/' postgres?.yml \
-    && sed -i 's/^\(scope\|name\|etcd\|  host\|  authentication\|  pg_hba\|  parameters\):/#&/' postgres?.yml \
+    && sed -i 's/^\(scope\|name\|etcd\|  host\|  authentication\|  connect_address\|  parameters\):/#&/' postgres?.yml \
     && sed -i 's/^    \(replication\|superuser\|rewind\|unix_socket_directories\|\(\(  \)\{0,1\}\(username\|password\)\)\):/#&/' postgres?.yml \
-    && sed -i 's/^      parameters:/      pg_hba:\n      - local all all trust\n      - host replication all all md5\n      - host all all all md5\n&\n        max_connections: 100/'  postgres?.yml \
+    && sed -i 's/^      parameters:/&\n        max_connections: 100/'  postgres?.yml \
+    && sed -i 's/^      pg_hba:/&\n      - local all all trust/' postgres?.yml \
+    && sed -i 's/^\(.*\) \(.*\) md5/\1 all md5/' postgres?.yml \
     && if [ "$COMPRESS" = "true" ]; then chmod u+s /usr/bin/sudo; fi \
     && chmod +s /bin/ping \
     && chown -R postgres:postgres "$PGHOME" /run /etc/haproxy
diff --git a/Dockerfile.citus b/Dockerfile.citus
index 06a84683..2a10745e 100644
--- a/Dockerfile.citus
+++ b/Dockerfile.citus
@@ -37,8 +37,10 @@ RUN set -ex \
         && MAKEFLAGS="-j $(grep -c ^processor /proc/cpuinfo)" \
         && cd citus && ./configure && make install && cd ../ && rm -rf /citus; \
     else \
-        curl https://install.citusdata.com/community/deb.sh | bash \
-        && apt-get -y install postgresql-$PG_MAJOR-citus-11.2; \
+        echo "deb [signed-by=/etc/apt/trusted.gpg.d/citusdata_community.gpg] https://packagecloud.io/citusdata/community/debian/ $(lsb_release -cs) main" > /etc/apt/sources.list.d/citusdata_community.list \
+        && curl -sL https://packagecloud.io/citusdata/community/gpgkey | gpg --dearmor > /etc/apt/trusted.gpg.d/citusdata_community.gpg \
+        && apt-get update -y \
+        && apt-get -y install postgresql-$PG_MAJOR-citus-11.3 \
     fi \
     && pip3 install dumb-init \
 \
@@ -88,7 +90,7 @@ RUN set -ex \
                 libmagic1 bsdmainutils login ncurses-bin libmagic-mgc e2fslibs bsdutils \
                 exim4-config gnupg-agent dirmngr libpython2.7-stdlib libpython2.7-minimal \
                 postgresql-server-dev-$PG_MAJOR git gcc make autoconf \
-                libc6-dev flex libcurl4-gnutls-dev libicu-dev libkrb5-dev liblz4-dev \
+                libc6-dev flex libicu-dev libkrb5-dev liblz4-dev \
                 libpam0g-dev libreadline-dev libselinux1-dev libssl-dev libxslt1-dev libzstd-dev uuid-dev \
     && apt-get autoremove -y \
     && apt-get clean -y \
@@ -174,16 +176,17 @@ WORKDIR $PGHOME
 
 RUN sed -i 's/env python/&3/' /patroni*.py \
     # "fix" patroni configs
-    && sed -i 's/^\(  connect_address:\|  - host\)/#&/' postgres?.yml \
     && sed -i 's/^  listen: 127.0.0.1/  listen: 0.0.0.0/' postgres?.yml \
     && sed -i "s|^\(  data_dir: \).*|\1$PGDATA|" postgres?.yml \
     && sed -i "s|^#\(  bin_dir: \).*|\1$PGBIN|" postgres?.yml \
     && sed -i 's/^  - encoding: UTF8/  - locale: en_US.UTF-8\n&/' postgres?.yml \
     && sed -i 's/^scope:/log:\n  loggers:\n    patroni.postgresql.citus: DEBUG\n#&/' postgres?.yml \
-    && sed -i 's/^\(name\|etcd\|  host\|  authentication\|  pg_hba\|  parameters\):/#&/' postgres?.yml \
+    && sed -i 's/^\(name\|etcd\|  host\|  authentication\|  connect_address\|  parameters\):/#&/' postgres?.yml \
     && sed -i 's/^    \(replication\|superuser\|rewind\|unix_socket_directories\|\(\(  \)\{0,1\}\(username\|password\)\)\):/#&/' postgres?.yml \
     && sed -i 's/^postgresql:/&\n  basebackup:\n    checkpoint: fast/' postgres?.yml \
-    && sed -i 's|^      parameters:|      pg_hba:\n      - local all all trust\n      - hostssl replication all all md5 clientcert=verify-ca\n      - hostssl all all all md5 clientcert=verify-ca\n&\n        max_connections: 100\n        shared_buffers: 16MB\n        ssl: "on"\n        ssl_ca_file: /etc/ssl/certs/ssl-cert-snakeoil.pem\n        ssl_cert_file: /etc/ssl/certs/ssl-cert-snakeoil.pem\n        ssl_key_file: /etc/ssl/private/ssl-cert-snakeoil.key\n        citus.node_conninfo: "sslrootcert=/etc/ssl/certs/ssl-cert-snakeoil.pem sslkey=/etc/ssl/private/ssl-cert-snakeoil.key sslcert=/etc/ssl/certs/ssl-cert-snakeoil.pem sslmode=verify-ca"|'  postgres?.yml \
+    && sed -i 's|^      parameters:|&\n        max_connections: 100\n        shared_buffers: 16MB\n        ssl: "on"\n        ssl_ca_file: /etc/ssl/certs/ssl-cert-snakeoil.pem\n        ssl_cert_file: /etc/ssl/certs/ssl-cert-snakeoil.pem\n        ssl_key_file: /etc/ssl/private/ssl-cert-snakeoil.key\n        citus.node_conninfo: "sslrootcert=/etc/ssl/certs/ssl-cert-snakeoil.pem sslkey=/etc/ssl/private/ssl-cert-snakeoil.key sslcert=/etc/ssl/certs/ssl-cert-snakeoil.pem sslmode=verify-ca"|'  postgres?.yml \
+    && sed -i 's/^      pg_hba:/&\n      - local all all trust/' postgres?.yml \
+    && sed -i 's/^\(.*\) \(.*\) \(.*\) \(.*\) \(.*\) md5.*$/\1 hostssl \3 \4 all md5 clientcert=verify-ca/' postgres?.yml \
     && sed -i 's/^#\(ctl\|  certfile\|  keyfile\)/\1/' postgres?.yml \
     && sed -i 's|^#  cafile: .*$|  verify_client: required\n  cafile: /etc/ssl/certs/ssl-cert-snakeoil.pem|' postgres?.yml \
     && sed -i 's|^#  cacert: .*$|  cacert: /etc/ssl/certs/ssl-cert-snakeoil.pem|' postgres?.yml \
diff --git a/README.rst b/README.rst
index c8cf44b0..c26daf9a 100644
--- a/README.rst
+++ b/README.rst
@@ -49,7 +49,7 @@ We report new releases information `here <https://github.com/zalando/patroni/rel
 Community
 =========
 
-There are two places to connect with the Patroni community: `on github <https://github.com/zalando/patroni>`__, via Issues and PRs, and on channel `#patroni <https://postgresteam.slack.com/archives/C9XPYG92A>`__ in the `PostgreSQL Slack <https://join.slack.com/t/postgresteam/shared_invite/zt-1qj14i9sj-E9WqIFlvcOiHsEk2yFEMjA>`__.  If you're using Patroni, or just interested, please join us.
+There are two places to connect with the Patroni community: `on github <https://github.com/zalando/patroni>`__, via Issues and PRs, and on channel `#patroni <https://postgresteam.slack.com/archives/C9XPYG92A>`__ in the `PostgreSQL Slack <https://pgtreats.info/slack-invite>`__.  If you're using Patroni, or just interested, please join us.
 
 ===================================
 Technical Requirements/Installation
diff --git a/docs/CONTRIBUTING.rst b/docs/CONTRIBUTING.rst
index a4ce4d38..58e5f7bc 100644
--- a/docs/CONTRIBUTING.rst
+++ b/docs/CONTRIBUTING.rst
@@ -8,7 +8,7 @@ Wanna contribute to Patroni? Yay - here is how!
 Chatting
 --------
 
-Just want to chat with other Patroni users?  Looking for interactive troubleshooting help? Join us on channel `#patroni <https://postgresteam.slack.com/archives/C9XPYG92A>`__ in the `PostgreSQL Slack <https://join.slack.com/t/postgresteam/shared_invite/zt-1qj14i9sj-E9WqIFlvcOiHsEk2yFEMjA>`__.
+Just want to chat with other Patroni users?  Looking for interactive troubleshooting help? Join us on channel `#patroni <https://postgresteam.slack.com/archives/C9XPYG92A>`__ in the `PostgreSQL Slack <https://pgtreats.info/slack-invite>`__.
 
 Running tests
 -------------
diff --git a/docs/dynamic_configuration.rst b/docs/dynamic_configuration.rst
index 85121d7c..5486bf6e 100644
--- a/docs/dynamic_configuration.rst
+++ b/docs/dynamic_configuration.rst
@@ -26,6 +26,16 @@ In order to change the dynamic configuration you can use either ``patronictl edi
    -  **recovery\_conf**: additional configuration settings written to recovery.conf when configuring follower. There is no recovery.conf anymore in PostgreSQL 12, but you may continue using this section, because Patroni handles it transparently.
    -  **parameters**: list of configuration settings for Postgres.
 
+   -  **pg\_hba**: list of lines that Patroni will use to generate ``pg_hba.conf``. Patroni ignores this parameter if ``hba_file`` PostgreSQL parameter is set to a non-default value.
+
+      -  **- host all all 0.0.0.0/0 md5**
+      -  **- host replication replicator 127.0.0.1/32 md5**: A line like this is required for replication.
+
+   -  **pg\_ident**: list of lines that Patroni will use to generate ``pg_ident.conf``. Patroni ignores this parameter if ``ident_file`` PostgreSQL parameter is set to a non-default value.
+
+      -  **- mapname1 systemname1 pguser1**
+      -  **- mapname1 systemname2 pguser2**
+
 -  **standby\_cluster**: if this section is defined, we want to bootstrap a standby cluster.
 
    -  **host**: an address of remote node
diff --git a/docs/yaml_configuration.rst b/docs/yaml_configuration.rst
index 51f769ca..dd84f7cb 100644
--- a/docs/yaml_configuration.rst
+++ b/docs/yaml_configuration.rst
@@ -43,10 +43,6 @@ Bootstrap configuration
       -  **- data-checksums**: Must be enabled when pg_rewind is needed on 9.3.
       -  **- encoding: UTF8**: default encoding for new databases.
       -  **- locale: UTF8**: default locale for new databases.
-   -  **pg\_hba**: list of lines that you should add to pg\_hba.conf.
-
-      -  **- host all all 0.0.0.0/0 md5**.
-      -  **- host replication replicator 127.0.0.1/32 md5**: A line like this is required for replication.
    -  **users**: Some additional users which need to be created after initializing new cluster
 
       -  **admin**: the name of user
@@ -270,18 +266,18 @@ PostgreSQL
    -  **recovery\_conf**: additional configuration settings written to recovery.conf when configuring follower.
    -  **custom\_conf** : path to an optional custom ``postgresql.conf`` file, that will be used in place of ``postgresql.base.conf``. The file must exist on all cluster nodes, be readable by PostgreSQL and will be included from its location on the real ``postgresql.conf``. Note that Patroni will not monitor this file for changes, nor backup it. However, its settings can still be overridden by Patroni's own configuration facilities - see :ref:`dynamic configuration <patroni_configuration>` for details.
    -  **parameters**: list of configuration settings for Postgres. Many of these are required for replication to work.
-   -  **pg\_hba**: list of lines that Patroni will use to generate ``pg_hba.conf``. This parameter has higher priority than ``bootstrap.pg_hba``. Together with :ref:`dynamic configuration <dynamic_configuration>` it simplifies management of ``pg_hba.conf``.
+   -  **pg\_hba**: list of lines that Patroni will use to generate ``pg_hba.conf``. Patroni ignores this parameter if ``hba_file`` PostgreSQL parameter is set to a non-default value. Together with :ref:`dynamic configuration <dynamic_configuration>` this parameter simplifies management of ``pg_hba.conf``.
 
-      -  **- host all all 0.0.0.0/0 md5**.
+      -  **- host all all 0.0.0.0/0 md5**
       -  **- host replication replicator 127.0.0.1/32 md5**: A line like this is required for replication.
-   -  **pg\_ident**: list of lines that Patroni will use to generate ``pg_ident.conf``. Together with :ref:`dynamic configuration <dynamic_configuration>` it simplifies management of ``pg_ident.conf``.
+   -  **pg\_ident**: list of lines that Patroni will use to generate ``pg_ident.conf``. Patroni ignores this parameter if ``ident_file`` PostgreSQL parameter is set to a non-default value. Together with :ref:`dynamic configuration <dynamic_configuration>` this parameter simplifies management of ``pg_ident.conf``.
 
-      -  **- mapname1 systemname1 pguser1**.
-      -  **- mapname1 systemname2 pguser2**.
+      -  **- mapname1 systemname1 pguser1**
+      -  **- mapname1 systemname2 pguser2**
    -  **pg\_ctl\_timeout**: How long should pg_ctl wait when doing ``start``, ``stop`` or ``restart``. Default value is 60 seconds.
    -  **use\_pg\_rewind**: try to use pg\_rewind on the former leader when it joins cluster as a replica.
    -  **remove\_data\_directory\_on\_rewind\_failure**: If this option is enabled, Patroni will remove the PostgreSQL data directory and recreate the replica. Otherwise it will try to follow the new leader. Default value is **false**.
-   -  **remove\_data\_directory\_on\_diverged\_timelines**: Patroni will remove the PostgreSQL data directory and recreate the replica if it notices that timelines are diverging and the former primary can not start streaming from the new primary. This option is useful when ``pg_rewind`` can not be used. While performing timelines divergence check on PostgreSQL v10 and older Patroni will try to connect with replication credential to the "postgres" database. Hence, such access should be allowed in the  pg_hba.conf. Default value is **false**.
+   -  **remove\_data\_directory\_on\_diverged\_timelines**: Patroni will remove the PostgreSQL data directory and recreate the replica if it notices that timelines are diverging and the former primary can not start streaming from the new primary. This option is useful when ``pg_rewind`` can not be used. While performing timelines divergence check on PostgreSQL v10 and older Patroni will try to connect with replication credential to the "postgres" database. Hence, such access should be allowed in the pg_hba.conf. Default value is **false**.
    -  **replica\_method**: for each create_replica_methods other than basebackup, you would add a configuration section of the same name. At a minimum, this should include "command" with a full path to the actual script to be executed. Other configuration parameters will be passed along to the script in the form "parameter=value".
    -  **pre\_promote**: a fencing script that executes during a failover after acquiring the leader lock but before promoting the replica. If the script exits with a non-zero code, Patroni does not promote the replica and removes the leader key from DCS.
    -  **before\_stop**: a script that executes immediately prior to stopping postgres. As opposed to a callback, this script runs synchronously, blocking shutdown until it has completed. The return code of this script does not impact whether shutdown proceeds afterwards.
diff --git a/kubernetes/Dockerfile.citus b/kubernetes/Dockerfile.citus
index de3ecb0b..e61850c7 100644
--- a/kubernetes/Dockerfile.citus
+++ b/kubernetes/Dockerfile.citus
@@ -10,8 +10,10 @@ RUN export DEBIAN_FRONTEND=noninteractive \
             | xargs apt-get install -y busybox vim-tiny curl jq less locales git python3-pip python3-wheel \
     ## Make sure we have a en_US.UTF-8 locale available
     && localedef -i en_US -c -f UTF-8 -A /usr/share/locale/locale.alias en_US.UTF-8 \
-    && curl https://install.citusdata.com/community/deb.sh | bash \
-    && apt-get -y install postgresql-15-citus-11.2 \
+    && echo "deb [signed-by=/etc/apt/trusted.gpg.d/citusdata_community.gpg] https://packagecloud.io/citusdata/community/debian/ $(lsb_release -cs) main" > /etc/apt/sources.list.d/citusdata_community.list \
+    && curl -sL https://packagecloud.io/citusdata/community/gpgkey | gpg --dearmor > /etc/apt/trusted.gpg.d/citusdata_community.gpg \
+    && apt-get update -y \
+    && apt-get -y install postgresql-$PG_MAJOR-citus-11.3 \
     && pip3 install setuptools \
     && pip3 install 'git+https://github.com/zalando/patroni.git#egg=patroni[kubernetes]' \
     && PGHOME=/home/postgres \
@@ -32,7 +34,9 @@ ADD entrypoint.sh /
 ENV PGSSLMODE=verify-ca PGSSLKEY=/etc/ssl/private/ssl-cert-snakeoil.key PGSSLCERT=/etc/ssl/certs/ssl-cert-snakeoil.pem PGSSLROOTCERT=/etc/ssl/certs/ssl-cert-snakeoil.pem
 
 RUN sed -i 's/^postgresql:/&\n  basebackup:\n    checkpoint: fast/' /entrypoint.sh \
-    && sed -i "s|^    postgresql:|&\n      pg_hba:\n      - local all all trust\n      - hostssl replication all all md5 clientcert=$PGSSLMODE\n      - hostssl all all all md5 clientcert=$PGSSLMODE\n      parameters:\n        max_connections: 100\n        shared_buffers: 16MB\n        ssl: 'on'\n        ssl_ca_file: $PGSSLROOTCERT\n        ssl_cert_file: $PGSSLCERT\n        ssl_key_file: $PGSSLKEY\n        citus.node_conninfo: 'sslrootcert=$PGSSLROOTCERT sslkey=$PGSSLKEY sslcert=$PGSSLCERT sslmode=$PGSSLMODE'|"  /entrypoint.sh \
+    && sed -i "s|^    postgresql:|&\n      parameters:\n        max_connections: 100\n        shared_buffers: 16MB\n        ssl: 'on'\n        ssl_ca_file: $PGSSLROOTCERT\n        ssl_cert_file: $PGSSLCERT\n        ssl_key_file: $PGSSLKEY\n        citus.node_conninfo: 'sslrootcert=$PGSSLROOTCERT sslkey=$PGSSLKEY sslcert=$PGSSLCERT sslmode=$PGSSLMODE'|"  /entrypoint.sh \
+    && sed -i 's/^      pg_hba:/&\n      - local all all trust/' /entrypoint.sh \
+    && sed -i "s/^\(.*\) \(.*\) \(.*\) \(.*\) \(.*\) md5.*$/\1 hostssl \3 \4 all md5 clientcert=$PGSSLMODE/" /entrypoint.sh \
     && sed -i "s#^    \(superuser\|replication\):#&\n      sslmode: $PGSSLMODE\n      sslkey: $PGSSLKEY\n      sslcert: $PGSSLCERT\n      sslrootcert: $PGSSLROOTCERT#" /entrypoint.sh
 
 EXPOSE 5432 8008
diff --git a/kubernetes/entrypoint.sh b/kubernetes/entrypoint.sh
index b4fa58be..ad7f6263 100755
--- a/kubernetes/entrypoint.sh
+++ b/kubernetes/entrypoint.sh
@@ -12,15 +12,15 @@ bootstrap:
   dcs:
     postgresql:
       use_pg_rewind: true
+      pg_hba:
+      - host all all 0.0.0.0/0 md5
+      - host replication ${PATRONI_REPLICATION_USERNAME} ${PATRONI_KUBERNETES_POD_IP}/16 md5
   initdb:
   - auth-host: md5
   - auth-local: trust
   - encoding: UTF8
   - locale: en_US.UTF-8
   - data-checksums
-  pg_hba:
-  - host all all 0.0.0.0/0 md5
-  - host replication ${PATRONI_REPLICATION_USERNAME} ${PATRONI_KUBERNETES_POD_IP}/16 md5
 restapi:
   connect_address: '${PATRONI_KUBERNETES_POD_IP}:8008'
 postgresql:
diff --git a/patroni/exceptions.py b/patroni/exceptions.py
index 88edfe07..f8bf6df1 100644
--- a/patroni/exceptions.py
+++ b/patroni/exceptions.py
@@ -8,13 +8,6 @@ class PatroniException(Exception):
     def __init__(self, value: Any) -> None:
         self.value = value
 
-    def __str__(self) -> str:
-        """
-        >>> str(PatroniException('foo'))
-        "'foo'"
-        """
-        return repr(self.value)
-
 
 class PatroniFatalException(PatroniException):
     pass
diff --git a/patroni/validator.py b/patroni/validator.py
index 3d30ca2c..ccf41fd0 100644
--- a/patroni/validator.py
+++ b/patroni/validator.py
@@ -773,7 +773,6 @@ schema = Schema({
             Optional("retry_timeout"): int,
             Optional("maximum_lag_on_failover"): int
         },
-        "pg_hba": [str],
         "initdb": [Or(str, dict)]
     },
     Or(*available_dcs): Case({
diff --git a/postgres0.yml b/postgres0.yml
index 7aed19b9..2e83c7e1 100644
--- a/postgres0.yml
+++ b/postgres0.yml
@@ -59,6 +59,13 @@ bootstrap:
       #primary_slot_name: patroni
     postgresql:
       use_pg_rewind: true
+      pg_hba:
+      # For kerberos gss based connectivity (discard @.*$)
+      #- host replication replicator 127.0.0.1/32 gss include_realm=0
+      #- host all all 0.0.0.0/0 gss include_realm=0
+      - host replication replicator 127.0.0.1/32 md5
+      - host all all 0.0.0.0/0 md5
+      #  - hostssl all all 0.0.0.0/0 md5
 #      use_slots: true
       parameters:
 #        wal_level: hot_standby
@@ -83,14 +90,6 @@ bootstrap:
   - encoding: UTF8
   - data-checksums
 
-  pg_hba:  # Add following lines to pg_hba.conf after running 'initdb'
-  # For kerberos gss based connectivity (discard @.*$)
-  #- host replication replicator 127.0.0.1/32 gss include_realm=0
-  #- host all all 0.0.0.0/0 gss include_realm=0
-  - host replication replicator 127.0.0.1/32 md5
-  - host all all 0.0.0.0/0 md5
-#  - hostssl all all 0.0.0.0/0 md5
-
   # Additional script to be launched after initial cluster creation (will be passed the connection URL as parameter)
 # post_init: /usr/local/bin/setup_cluster.sh
 
diff --git a/postgres1.yml b/postgres1.yml
index ce7d1ee2..e8b2806d 100644
--- a/postgres1.yml
+++ b/postgres1.yml
@@ -53,6 +53,13 @@ bootstrap:
     maximum_lag_on_failover: 1048576
     postgresql:
       use_pg_rewind: true
+      pg_hba:
+      # For kerberos gss based connectivity (discard @.*$)
+      #- host replication replicator 127.0.0.1/32 gss include_realm=0
+      #- host all all 0.0.0.0/0 gss include_realm=0
+      - host replication replicator 127.0.0.1/32 md5
+      - host all all 0.0.0.0/0 md5
+      #  - hostssl all all 0.0.0.0/0 md5
 #      use_slots: true
       parameters:
 #        wal_level: hot_standby
@@ -77,14 +84,6 @@ bootstrap:
   - encoding: UTF8
   - data-checksums
 
-  pg_hba:  # Add following lines to pg_hba.conf after running 'initdb'
-  # For kerberos gss based connectivity (discard @.*$)
-  #- host replication replicator 127.0.0.1/32 gss include_realm=0
-  #- host all all 0.0.0.0/0 gss include_realm=0
-  - host replication replicator 127.0.0.1/32 md5
-  - host all all 0.0.0.0/0 md5
-#  - hostssl all all 0.0.0.0/0 md5
-
   # Additional script to be launched after initial cluster creation (will be passed the connection URL as parameter)
 # post_init: /usr/local/bin/setup_cluster.sh
 
diff --git a/postgres2.yml b/postgres2.yml
index 5ca44cd0..8272e3ba 100644
--- a/postgres2.yml
+++ b/postgres2.yml
@@ -53,6 +53,13 @@ bootstrap:
     maximum_lag_on_failover: 1048576
     postgresql:
       use_pg_rewind: true
+      pg_hba:
+      # For kerberos gss based connectivity (discard @.*$)
+      #- host replication replicator 127.0.0.1/32 gss include_realm=0
+      #- host all all 0.0.0.0/0 gss include_realm=0
+      - host replication replicator 127.0.0.1/32 md5
+      - host all all 0.0.0.0/0 md5
+      #  - hostssl all all 0.0.0.0/0 md5
 #      use_slots: true
       parameters:
 #        wal_level: hot_standby
@@ -77,14 +84,6 @@ bootstrap:
   - encoding: UTF8
   - data-checksums
 
-  pg_hba:  # Add following lines to pg_hba.conf after running 'initdb'
-  # For kerberos gss based connectivity (discard @.*$)
-  #- host replication replicator 127.0.0.1/32 gss include_realm=0
-  #- host all all 0.0.0.0/0 gss include_realm=0
-  - host replication replicator 127.0.0.1/32 md5
-  - host all all 0.0.0.0/0 md5
-#  - hostssl all all 0.0.0.0/0 md5
-
   # Some additional users users which needs to be created after initializing new cluster
   users:
     admin:


Test patch:
diff --git a/tests/test_validator.py b/tests/test_validator.py
index 87ea78b7..cec1f140 100644
--- a/tests/test_validator.py
+++ b/tests/test_validator.py
@@ -24,7 +24,6 @@ config = {
             "retry_timeout": 1000,
             "maximum_lag_on_failover": 1000
         },
-        "pg_hba": ["string"],
         "initdb": ["string", {"key": "value"}]
     },
     "consul": {