plugin-barman-cloud

mirror of https://github.com/cloudnative-pg/plugin-barman-cloud.git synced 2026-07-10 03:32:21 +02:00

Author	SHA1	Message	Date
Marco Nenciarini	521822f616	fix(e2e): use correct image name in kustomize overlay Closes #840 The e2e kustomize overlay matches docker.io/library/plugin-barman-cloud but the base kustomization at kubernetes/kustomization.yaml matches the bare plugin-barman-cloud name from kubernetes/deployment.yaml and replaces it with the GHCR image. Since the overlay name never matches, the locally-built image is never deployed and e2e tests always run against the main branch code from GHCR. Use the bare image name so the overlay rule overrides the base rule. Broken since `b7daaac` (#89) changed the base kustomization's newName from docker.io/library/plugin-barman-cloud to the GHCR image without updating the e2e overlay. Signed-off-by: Marco Nenciarini <marco.nenciarini@enterprisedb.com>	2026-04-10 18:47:32 +02:00
Gabriele Quaresima	134b45fc0e	chore: add unit tests, improve log and code readability (#839 ) - Add 'namespace' structured field to the error log in Reconcile when a role reconciliation fails - Rename misleading local variable 'role' to 'roleBinding' in ensureRoleBinding to match the actual type - Add EnsureRole tests: transient Role creation error is propagated; pre-existing unrelated labels are preserved after patch - Add SetControllerReference test: returns an error when the owner does not implement runtime.Object - Add ObjectStoreReconciler tests: Role list failure and ObjectStore Get transient error both surface through the reconcile return value - Add scheme tests: AddCNPGToScheme with default and custom group/version Assisted-by: Claude Opus 4.6 Signed-off-by: Gabriele Quaresima <gabriele.quaresima@enterprisedb.com> Signed-off-by: Marco Nenciarini <marco.nenciarini@enterprisedb.com> Co-authored-by: Marco Nenciarini <marco.nenciarini@enterprisedb.com>	2026-04-10 17:18:36 +02:00
Marco Nenciarini	4c7eb5eb25	test: add e2e test for credential rotation Add an e2e test that verifies the ObjectStore controller updates the RBAC Role when an ObjectStore's secret reference changes. The test creates a Cluster with a MinIO ObjectStore, verifies the Role has the cluster label and references the original secret, then updates the ObjectStore to point to a new secret and waits for the Role to be patched accordingly. Signed-off-by: Marco Nenciarini <marco.nenciarini@enterprisedb.com>	2026-04-10 16:57:39 +02:00
Marco Nenciarini	0475daa589	fix: read owner GVK from object metadata instead of scheme The operator does not know the CNPG API group at runtime (it is not a sidecar injected by the CNPG operator, so CUSTOM_CNPG_GROUP and CUSTOM_CNPG_VERSION are not available). Move SetControllerReference to the specs package and read the GVK from the decoded Cluster's TypeMeta rather than looking it up in the scheme. Remove CNPG types from the operator's scheme and the env var bindings from cmd/operator since they are no longer needed. Signed-off-by: Marco Nenciarini <marco.nenciarini@enterprisedb.com>	2026-04-10 11:23:35 +02:00
Marco Nenciarini	8b4fac41d0	fix: discover affected Roles by label instead of listing Clusters The ObjectStore controller now lists Roles by a label (barmancloud.cnpg.io/cluster) set by the Pre hook, inspects their rules to find which ObjectStores they reference, then fetches those ObjectStores and rebuilds the rules. This removes the clusters get/list/watch permission. Conflict handling uses RetryOnConflict to match the existing project pattern, and partial failures across Roles are aggregated with errors.Join instead of failing on the first one. Pre-existing Roles without the label won't be found by the ObjectStore controller until the Pre hook adds it on the next Cluster reconciliation. Same staleness window as the current main branch. Signed-off-by: Marco Nenciarini <marco.nenciarini@enterprisedb.com>	2026-04-10 10:03:00 +02:00
Armando Ruocco	43a9a2888f	fix(rbac): reconcile Role when ObjectStore spec changes When an ObjectStore's credentials change (e.g., secret rename), the RBAC Role granting the Cluster's ServiceAccount access to those secrets was not updated because nothing triggered a Cluster reconciliation. Implement the ObjectStore controller's Reconcile to detect referencing Clusters and update their Roles directly. Extract ensureRole into a shared rbac.EnsureRole function used by both the Pre hook and the ObjectStore controller. Handle concurrent modifications between the Pre hook and ObjectStore controller gracefully: AlreadyExists on Create and Conflict on Patch are retried once to avoid propagating transient errors as gRPC failures to CNPG. Replace the custom setOwnerReference helper (ownership.go) with controllerutil.SetControllerReference for both Role and RoleBinding. The old helper read the GVK from the object's metadata and replaced all owner references unconditionally. The new function reads the GVK from the scheme and appends to existing owner references, refusing to overwrite if another controller already owns the object. Both produce identical results for our use case since the Role is always freshly built. The GVK is now resolved from the scheme configured via CUSTOM_CNPG_GROUP/CUSTOM_CNPG_VERSION, which must match the actual CNPG API group (same requirement as the instance sidecar). Add dynamic CNPG scheme registration (internal/scheme) to the operator, instance, and restore managers, replacing hardcoded cnpgv1.AddToScheme calls. Add RBAC permission for the plugin to list/watch Clusters. Signed-off-by: Armando Ruocco <armando.ruocco@enterprisedb.com>	2026-04-10 10:03:00 +02:00

2 changed files with 683 additions and 348 deletions

									
										3

web/package.json
									
										View File
										
					@ -44,8 +44,5 @@

					  },

					  },

					  "engines": {

					  "engines": {

					    "node": ">=18.0"

					    "node": ">=18.0"

					  },

					  "resolutions": {

					    "webpackbar": "^7.0.0"

					  }

					  }

					}

					}

1028

web/yarn.lock

View File

File diff suppressed because it is too large Load Diff

Compare commits

6 Commits

1f876c27ef ... 521822f616

3

web/package.json

View File

1028

web/yarn.lock

View File

Compare commits

6 Commits 1f876c27ef ... 521822f616

3 web/package.json Unescape Escape View File

1028 web/yarn.lock View File

6 Commits

1f876c27ef ... 521822f616

3

web/package.json

View File

1028

web/yarn.lock

View File