We were not exaggerating when we said Patroni was difficult to defeat. If a system operator was ignorant of Patroni's presence, they might attempt to stop the PostgreSQL service with pg_ctl or some other system-level script. Upon noticing the outage, Patroni would immediately restart the database instance.
If the outage was on the primary node, Patroni would promote another node to leader status and begin the process of converting the old leader into a replica. It's extremely likely that this cycle will complete before the system administrator is able to even verify the PostgreSQL service was stopped.
Patroni considers itself the true arbiter of the PostgreSQL systems it manages. So the only way to actually prevent the comical ...
