[pashagolub]

Summary

Reported in discussion #1610: pgwatch cannot monitor a Patroni cluster whose etcd only listens on TLS.

NewHostConfig built every etcd endpoint as http://host. etcd client v3 maps the http scheme to CredsDrop (client.go credentialsForEndpoint), so the client discarded our TLS config. pgwatch parsed ca_file, cert_file and key_file, then never used them.

 NewHostConfig(etcd://h1:2379,h2:2379/ns/scope?ca_file=...)
+  if cert_file and key_file are not both set or both empty
+    return error
-  endpoints = http:// + host
+  if any of ca_file, cert_file, key_file is set
+    endpoints = https:// + host
+  else
+    endpoints = http:// + host

 getTransport(hc)
+  if no TLS params
+    return nil
-  load client cert only when ca_file is also set
+  load client cert whenever cert_file and key_file are set
-  ignore a CA file with no PEM certificates
+  return error for a CA file with no PEM certificates

The Patroni how-to now states when pgwatch uses HTTPS and that cert_file and key_file go together.

Evidence

• Before: NewHostConfig("etcd://host1:2379/...?ca_file=/ca.crt") returned DcsEndpoints == ["http://host1:2379"]. getTransport with only cert_file and key_file returned a TLS config without client certificates.
  After: the same URI returns ["https://host1:2379"]. The new TestGetTransport covers: no params gives nil; CA only; client cert without CA (uses the system pool); a CA file with no certificates and a bad key both return errors. TestNewHostConfig_BasicParsing adds cases for the https scheme and for a half-set cert/key pair.

go test -p 1 ./internal/sources and golangci-lint run ./internal/sources/... pass.

Merge Danger

Door: two-way

Reverting is a code-only change. Nothing about schemas or stored data changes.

Blast Radius: etcd sources

Two etcd setups that worked by accident now fail:

• an etcd source with TLS params pointing at a plain-HTTP etcd. The params were ignored before; now pgwatch tries TLS.
• a source that sets only one of cert_file and key_file. It now fails to parse instead of silently connecting without a client cert.

ZooKeeper and Consul sources are unchanged.

AI & Automation Policy

• I am the human author and take full personal responsibility for every change in this PR.
• No AI or automated generative tool was used in any part of this PR OR I have disclosed all tool(s) below.

AI/automation tools used (leave blank if none):

Checklist

• Code compiles and existing tests pass locally.
• New or updated tests are included where applicable.
• Documentation is updated where applicable.

[coveralls]

Coverage Report for CI Build 39576519490

Coverage increased (+0.3%) to 88.104%

Details

• Coverage increased (+0.3%) from the base build.
• Patch coverage: 31 of 31 lines across 1 file are fully covered (100%).
• No coverage regressions found.

Uncovered Changes

No uncovered changes found.

Coverage Regressions

No coverage regressions found.

---

Coverage Stats

Relevant Lines:	6204
Covered Lines:	5466
Line Coverage:	88.1%
Coverage Strength:	1.0 hits per line

---

💛 - Coveralls