fix: discover affected Roles by label instead of listing Clusters

The ObjectStore controller now lists Roles by a label
(barmancloud.cnpg.io/cluster) set by the Pre hook, inspects their
rules to find which ObjectStores they reference, then fetches those
ObjectStores and rebuilds the rules. This removes the clusters
get/list/watch permission. Conflict handling uses RetryOnConflict to
match the existing project pattern, and partial failures across Roles
are aggregated with errors.Join instead of failing on the first one.

Pre-existing Roles without the label won't be found by the ObjectStore
controller until the Pre hook adds it on the next Cluster
reconciliation. Same staleness window as the current main branch.

Signed-off-by: Marco Nenciarini <marco.nenciarini@enterprisedb.com>

.github/workflows/ci.yml

@@ -44,7 +44,7 @@ jobs:
       - name: Install Dagger
         env:
           # renovate: datasource=github-tags depName=dagger/dagger versioning=semver
-          DAGGER_VERSION: 0.20.5
+          DAGGER_VERSION: 0.20.4
         run: |
           curl -L https://dl.dagger.io/dagger/install.sh | BIN_DIR=$HOME/.local/bin sh
       - name: Run CI task

.github/workflows/release-please.yml

@@ -31,7 +31,7 @@ jobs:
       - name: Install Dagger
         env:
           # renovate: datasource=github-tags depName=dagger/dagger versioning=semver
-          DAGGER_VERSION: 0.20.5
+          DAGGER_VERSION: 0.20.4
         run: |
           curl -L https://dl.dagger.io/dagger/install.sh | BIN_DIR=$HOME/.local/bin sh
       - name: Create image and manifest

.github/workflows/release-publish.yml

@@ -21,7 +21,7 @@ jobs:
       - name: Install Dagger
         env:
           # renovate: datasource=github-tags depName=dagger/dagger versioning=semver
-          DAGGER_VERSION: 0.20.5
+          DAGGER_VERSION: 0.20.4
         run: |
           curl -L https://dl.dagger.io/dagger/install.sh | BIN_DIR=$HOME/.local/bin sh
       - name: Create image and manifest

Taskfile.yml

@@ -206,7 +206,7 @@ tasks:
       - start-build-network
     vars:
       # renovate: datasource=github-tags depName=dagger/dagger versioning=semver
-      DAGGER_VERSION: 0.20.5
+      DAGGER_VERSION: 0.20.4
       DAGGER_ENGINE_IMAGE: registry.dagger.io/engine:v{{ .DAGGER_VERSION }}
     cmds:
       - >

internal/cmd/operator/main.go

@@ -102,6 +102,8 @@ func NewCmd() *cobra.Command {
 	_ = viper.BindPFlag("server-address", cmd.Flags().Lookup("server-address"))
 
 	_ = viper.BindEnv("sidecar-image", "SIDECAR_IMAGE")
+	_ = viper.BindEnv("custom-cnpg-group", "CUSTOM_CNPG_GROUP")
+	_ = viper.BindEnv("custom-cnpg-version", "CUSTOM_CNPG_VERSION")
 
 	return cmd
 }

internal/cnpgi/operator/manager.go

@@ -37,24 +37,33 @@ import (
 
 	barmancloudv1 "github.com/cloudnative-pg/plugin-barman-cloud/api/v1"
 	"github.com/cloudnative-pg/plugin-barman-cloud/internal/controller"
+	pluginscheme "github.com/cloudnative-pg/plugin-barman-cloud/internal/scheme"
 
 	// Import all Kubernetes client auth plugins (e.g. Azure, GCP, OIDC, etc.)
 	// to ensure that exec-entrypoint and run can make use of them.
 	_ "k8s.io/client-go/plugin/pkg/client/auth"
 )
 
-var scheme = runtime.NewScheme()
+// generateScheme creates a runtime.Scheme with all type definitions
+// needed by the operator. CNPG types are registered under a
+// configurable API group to support custom CNPG-based operators.
+func generateScheme(ctx context.Context) *runtime.Scheme {
+	result := runtime.NewScheme()
 
-func init() {
+	utilruntime.Must(clientgoscheme.AddToScheme(result))
-	utilruntime.Must(clientgoscheme.AddToScheme(scheme))
+	utilruntime.Must(barmancloudv1.AddToScheme(result))
-	utilruntime.Must(barmancloudv1.AddToScheme(scheme))
+	pluginscheme.AddCNPGToScheme(ctx, result)
 	// +kubebuilder:scaffold:scheme
+
+	return result
 }
 
 // Start starts the manager
 func Start(ctx context.Context) error {
 	setupLog := log.FromContext(ctx)
 
+	scheme := generateScheme(ctx)
+
 	var tlsOpts []func(*tls.Config)
 
 	// if the enable-http2 flag is false (the default), http/2 should be disabled

internal/cnpgi/operator/rbac/doc.go

@@ -1,22 +0,0 @@
-/*
-Copyright © contributors to CloudNativePG, established as
-CloudNativePG a Series of LF Projects, LLC.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-
-SPDX-License-Identifier: Apache-2.0
-*/
-
-// Package rbac contains utilities to reconcile RBAC resources
-// for the barman-cloud plugin.
-package rbac

internal/cnpgi/operator/rbac/ensure.go

@@ -17,6 +17,8 @@ limitations under the License.
 SPDX-License-Identifier: Apache-2.0
 */
 
+// Package rbac contains utilities to reconcile RBAC resources
+// for the barman-cloud plugin.
 package rbac
 
 import (
@@ -29,6 +31,7 @@ import (
 	apierrs "k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/client-go/util/retry"
 	"sigs.k8s.io/controller-runtime/pkg/client"
+	"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
 
 	barmancloudv1 "github.com/cloudnative-pg/plugin-barman-cloud/api/v1"
 	"github.com/cloudnative-pg/plugin-barman-cloud/internal/cnpgi/metadata"
@@ -103,7 +106,7 @@ func ensureRoleExists(
 		return err
 	}
 
-	if err := specs.SetControllerReference(cluster, newRole); err != nil {
+	if err := controllerutil.SetControllerReference(cluster, newRole, c.Scheme()); err != nil {
 		return err
 	}
 

internal/cnpgi/operator/rbac/ensure_test.go

@@ -49,10 +49,6 @@ func newScheme() *runtime.Scheme {
 
 func newCluster(name, namespace string) *cnpgv1.Cluster {
 	return &cnpgv1.Cluster{
-		TypeMeta: metav1.TypeMeta{
-			APIVersion: cnpgv1.SchemeGroupVersion.String(),
-			Kind:       cnpgv1.ClusterKind,
-		},
 		ObjectMeta: metav1.ObjectMeta{
 			Name:      name,
 			Namespace: namespace,

internal/cnpgi/operator/reconciler.go

@@ -30,6 +30,7 @@ import (
 	rbacv1 "k8s.io/api/rbac/v1"
 	apierrs "k8s.io/apimachinery/pkg/api/errors"
 	"sigs.k8s.io/controller-runtime/pkg/client"
+	"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
 
 	barmancloudv1 "github.com/cloudnative-pg/plugin-barman-cloud/api/v1"
 	"github.com/cloudnative-pg/plugin-barman-cloud/internal/cnpgi/operator/config"
@@ -162,7 +163,7 @@ func (r ReconcilerImplementation) createRoleBinding(
 	cluster *cnpgv1.Cluster,
 ) error {
 	roleBinding := specs.BuildRoleBinding(cluster)
-	if err := specs.SetControllerReference(cluster, roleBinding); err != nil {
+	if err := controllerutil.SetControllerReference(cluster, roleBinding, r.Client.Scheme()); err != nil {
 		return err
 	}
 	return r.Client.Create(ctx, roleBinding)

internal/cnpgi/operator/specs/ownership.go

@@ -1,59 +0,0 @@
-/*
-Copyright © contributors to CloudNativePG, established as
-CloudNativePG a Series of LF Projects, LLC.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-
-SPDX-License-Identifier: Apache-2.0
-*/
-
-package specs
-
-import (
-	"fmt"
-
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/utils/ptr"
-)
-
-// SetControllerReference sets an owner reference on controlled
-// pointing to owner, reading the GVK from the owner object's
-// metadata rather than from a scheme. This is necessary because
-// the operator does not know the CNPG API group at compile time
-// (it may be customized), while the Cluster object decoded from
-// the gRPC request carries the correct GVK in its TypeMeta.
-func SetControllerReference(owner, controlled metav1.Object) error {
-	ro, ok := owner.(runtime.Object)
-	if !ok {
-		return fmt.Errorf("%T is not a runtime.Object, cannot call SetControllerReference", owner)
-	}
-
-	gvk := ro.GetObjectKind().GroupVersionKind()
-	if gvk.Kind == "" {
-		return fmt.Errorf("%T has no GVK set in its metadata, cannot call SetControllerReference", owner)
-	}
-
-	controlled.SetOwnerReferences([]metav1.OwnerReference{
-		{
-			APIVersion:         gvk.GroupVersion().String(),
-			Kind:               gvk.Kind,
-			Name:               owner.GetName(),
-			UID:                owner.GetUID(),
-			BlockOwnerDeletion: ptr.To(true),
-			Controller:         ptr.To(true),
-		},
-	})
-
-	return nil
-}

internal/cnpgi/operator/specs/ownership_test.go

@@ -1,90 +0,0 @@
-/*
-Copyright © contributors to CloudNativePG, established as
-CloudNativePG a Series of LF Projects, LLC.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-
-SPDX-License-Identifier: Apache-2.0
-*/
-
-package specs
-
-import (
-	cnpgv1 "github.com/cloudnative-pg/cloudnative-pg/api/v1"
-	. "github.com/onsi/ginkgo/v2"
-	. "github.com/onsi/gomega"
-	rbacv1 "k8s.io/api/rbac/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/types"
-)
-
-var _ = Describe("SetControllerReference", func() {
-	It("should set the owner reference from the owner's TypeMeta", func() {
-		owner := &cnpgv1.Cluster{
-			TypeMeta: metav1.TypeMeta{
-				APIVersion: "postgresql.cnpg.io/v1",
-				Kind:       "Cluster",
-			},
-			ObjectMeta: metav1.ObjectMeta{
-				Name:      "my-cluster",
-				Namespace: "default",
-				UID:       types.UID("test-uid"),
-			},
-		}
-		controlled := &rbacv1.Role{
-			ObjectMeta: metav1.ObjectMeta{
-				Name:      "my-role",
-				Namespace: "default",
-			},
-		}
-
-		Expect(SetControllerReference(owner, controlled)).To(Succeed())
-		Expect(controlled.OwnerReferences).To(HaveLen(1))
-		Expect(controlled.OwnerReferences[0].APIVersion).To(Equal("postgresql.cnpg.io/v1"))
-		Expect(controlled.OwnerReferences[0].Kind).To(Equal("Cluster"))
-		Expect(controlled.OwnerReferences[0].Name).To(Equal("my-cluster"))
-		Expect(controlled.OwnerReferences[0].UID).To(Equal(types.UID("test-uid")))
-		Expect(*controlled.OwnerReferences[0].Controller).To(BeTrue())
-		Expect(*controlled.OwnerReferences[0].BlockOwnerDeletion).To(BeTrue())
-	})
-
-	It("should work with a custom CNPG API group", func() {
-		owner := &cnpgv1.Cluster{
-			TypeMeta: metav1.TypeMeta{
-				APIVersion: "mycompany.io/v1",
-				Kind:       "Cluster",
-			},
-			ObjectMeta: metav1.ObjectMeta{
-				Name: "my-cluster",
-				UID:  types.UID("test-uid"),
-			},
-		}
-		controlled := &rbacv1.Role{}
-
-		Expect(SetControllerReference(owner, controlled)).To(Succeed())
-		Expect(controlled.OwnerReferences[0].APIVersion).To(Equal("mycompany.io/v1"))
-	})
-
-	It("should fail when the owner has no GVK set", func() {
-		owner := &cnpgv1.Cluster{
-			ObjectMeta: metav1.ObjectMeta{
-				Name: "my-cluster",
-			},
-		}
-		controlled := &rbacv1.Role{}
-
-		err := SetControllerReference(owner, controlled)
-		Expect(err).To(HaveOccurred())
-		Expect(err.Error()).To(ContainSubstring("has no GVK set"))
-	})
-})

internal/scheme/cnpg.go

@@ -17,6 +17,8 @@ limitations under the License.
 SPDX-License-Identifier: Apache-2.0
 */
 
+// Package scheme provides utilities for building runtime schemes
+// with support for custom CNPG API groups.
 package scheme
 
 import (

internal/scheme/doc.go

@@ -1,22 +0,0 @@
-/*
-Copyright © contributors to CloudNativePG, established as
-CloudNativePG a Series of LF Projects, LLC.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-
-SPDX-License-Identifier: Apache-2.0
-*/
-
-// Package scheme provides utilities for building runtime schemes
-// with support for custom CNPG API groups.
-package scheme