Barman Cloud CNPG-I backup plugin
Go to file
Armando Ruocco 064864ba72 fix(rbac): reconcile Role when ObjectStore spec changes
When an ObjectStore's credentials change (e.g., secret rename), the
RBAC Role granting the Cluster's ServiceAccount access to those secrets
was not updated because nothing triggered a Cluster reconciliation.

Implement the ObjectStore controller's Reconcile to detect referencing
Clusters and update their Roles directly. Extract ensureRole into a
shared rbac.EnsureRole function used by both the Pre hook and the
ObjectStore controller.

The shared EnsureRole accepts optional beforeCreate callbacks so the
Pre hook can set owner references on Role creation, while the
ObjectStore controller path skips ownership (it only updates existing
Roles).

Handle deleted ObjectStores gracefully by skipping NotFound errors
during Role reconciliation, and filter status-only changes with
GenerationChangedPredicate.

Add RBAC permission for the plugin to list/watch Clusters so the
ObjectStore controller can find affected Clusters. Regenerate
config/rbac/role.yaml.

Signed-off-by: Armando Ruocco <armando.ruocco@enterprisedb.com>
2026-03-27 11:21:34 +01:00
.github/workflows chore(deps): update docker/setup-qemu-action action to v4 (#794) 2026-03-06 18:56:22 +01:00
api/v1 feat(ip): assign copyright to the Linux Foundation (#571) 2025-10-07 18:06:06 +02:00
cmd/manager feat(ip): assign copyright to the Linux Foundation (#571) 2025-10-07 18:06:06 +02:00
config fix(rbac): reconcile Role when ObjectStore spec changes 2026-03-27 11:21:34 +01:00
containers chore(deps): update dependency setuptools to v82 (#796) 2026-03-09 16:00:57 +01:00
dagger chore: update dagger modules 2026-03-11 18:31:59 +01:00
hack docs(apidoc): filter Optional markers from validation column (#723) 2026-02-04 13:46:51 +01:00
internal fix(rbac): reconcile Role when ObjectStore spec changes 2026-03-27 11:21:34 +01:00
kubernetes fix: controller and sidecar containers run as non-root (#225) 2025-03-23 17:00:52 +01:00
logo Initial commit 2024-09-24 14:52:25 +02:00
scripts feat(ip): assign copyright to the Linux Foundation (#571) 2025-10-07 18:06:06 +02:00
test/e2e chore(deps): update fsouza/fake-gcs-server docker tag to v1.54.0 (#791) 2026-03-06 18:55:28 +01:00
web chore(deps): lock file maintenance (#810) 2026-03-12 09:33:24 +01:00
.dockerignore chore: scaffold (#2) 2024-09-26 11:52:56 +02:00
.gitignore ci: add e2e kustomization.yaml to .gitignore (#112) 2024-12-16 11:04:39 +01:00
.golangci.yml chore(deps): update golangci/golangci-lint docker tag to v2.2.1 (#430) 2025-07-01 17:34:08 +02:00
.release-please-manifest.json chore(main): release 0.11.0 (#717) 2026-01-30 16:32:12 +01:00
.spellcheck.yaml chore: limit the spellchecking to a fixed list of directories (#294) 2025-05-05 10:21:18 +02:00
.wordlist.txt feat: add support for DefaultAzureCredential authentication mechanism (#681) 2026-01-08 14:58:27 +01:00
CHANGELOG.md chore(main): release 0.11.0 (#717) 2026-01-30 16:32:12 +01:00
CODE_OF_CONDUCT.md Initial commit 2024-09-24 14:52:25 +02:00
CODEOWNERS Initial commit 2024-09-24 14:52:25 +02:00
commitlint.config.js ci: warn on long commit body line (#12) 2024-09-27 10:07:47 +02:00
CONTRIBUTING.md docs: add CONTRIBUTING.md file 2026-03-02 17:03:09 +11:00
go.mod fix(deps): update module google.golang.org/grpc to v1.79.3 [security] (#819) 2026-03-19 09:42:16 +01:00
go.sum fix(deps): update module google.golang.org/grpc to v1.79.3 [security] (#819) 2026-03-19 09:42:16 +01:00
GOVERNANCE.md Initial commit 2024-09-24 14:52:25 +02:00
LICENSE Initial commit 2024-09-24 14:52:25 +02:00
Makefile fix: add cluster/finalizers update permission (#465) 2025-08-14 22:55:25 +02:00
manifest.yaml chore(deps): update all cloudnative-pg daggerverse dependencies to 9d731d1 (#805) 2026-03-12 12:08:21 +01:00
PROJECT chore: scaffold (#2) 2024-09-26 11:52:56 +02:00
README.md docs: release procedure (#373) 2025-05-29 17:52:44 +02:00
release-please-config.json ci: update version in metadata (#229) 2025-03-25 17:21:56 +01:00
RELEASE-PROCEDURE.md docs: release procedure (#373) 2025-05-29 17:52:44 +02:00
renovate.json5 fix: resolve WAL archiving performance and memory issues (#746) 2026-01-29 16:43:55 +01:00
Taskfile.yml chore(deps): update all cloudnative-pg daggerverse dependencies to 9d731d1 (#805) 2026-03-12 12:08:21 +01:00

CloudNativePG

Barman Cloud CNPG-I plugin for CloudNativePG

The documentation for the Barman Cloud Plugin for CloudNativePG is available at https://cloudnative-pg.io/plugin-barman-cloud.


The Barman Cloud CNPG-I plugin is a component of the CloudNativePG project and adheres to the same community-driven governance model under the CNCF.

CNCF logo


CloudNativePG was originally built and sponsored by EDB.

EDB logo


Postgres, PostgreSQL, and the Slonik Logo are trademarks or registered trademarks of the PostgreSQL Community Association of Canada, and used with their permission.