plugin-barman-cloud/internal/cnpgi/instance/manager.go
Armando Ruocco 43a9a2888f fix(rbac): reconcile Role when ObjectStore spec changes
When an ObjectStore's credentials change (e.g., secret rename), the
RBAC Role granting the Cluster's ServiceAccount access to those secrets
was not updated because nothing triggered a Cluster reconciliation.

Implement the ObjectStore controller's Reconcile to detect referencing
Clusters and update their Roles directly. Extract ensureRole into a
shared rbac.EnsureRole function used by both the Pre hook and the
ObjectStore controller.

Handle concurrent modifications between the Pre hook and ObjectStore
controller gracefully: AlreadyExists on Create and Conflict on Patch
are retried once to avoid propagating transient errors as gRPC failures
to CNPG.

Replace the custom setOwnerReference helper (ownership.go) with
controllerutil.SetControllerReference for both Role and RoleBinding.
The old helper read the GVK from the object's metadata and replaced
all owner references unconditionally. The new function reads the GVK
from the scheme and appends to existing owner references, refusing to
overwrite if another controller already owns the object. Both produce
identical results for our use case since the Role is always freshly
built. The GVK is now resolved from the scheme configured via
CUSTOM_CNPG_GROUP/CUSTOM_CNPG_VERSION, which must match the actual
CNPG API group (same requirement as the instance sidecar).

Add dynamic CNPG scheme registration (internal/scheme) to the operator,
instance, and restore managers, replacing hardcoded cnpgv1.AddToScheme
calls. Add RBAC permission for the plugin to list/watch Clusters.

Signed-off-by: Armando Ruocco <armando.ruocco@enterprisedb.com>
2026-04-10 10:03:00 +02:00

133 lines
4.1 KiB
Go

/*
Copyright © contributors to CloudNativePG, established as
CloudNativePG a Series of LF Projects, LLC.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
SPDX-License-Identifier: Apache-2.0
*/
package instance
import (
"context"
"path"
cnpgv1 "github.com/cloudnative-pg/cloudnative-pg/api/v1"
"github.com/cloudnative-pg/machinery/pkg/log"
"github.com/spf13/viper"
corev1 "k8s.io/api/core/v1"
"k8s.io/apimachinery/pkg/runtime"
"k8s.io/apimachinery/pkg/types"
utilruntime "k8s.io/apimachinery/pkg/util/runtime"
clientgoscheme "k8s.io/client-go/kubernetes/scheme"
ctrl "sigs.k8s.io/controller-runtime"
"sigs.k8s.io/controller-runtime/pkg/client"
barmancloudv1 "github.com/cloudnative-pg/plugin-barman-cloud/api/v1"
extendedclient "github.com/cloudnative-pg/plugin-barman-cloud/internal/cnpgi/instance/internal/client"
pluginscheme "github.com/cloudnative-pg/plugin-barman-cloud/internal/scheme"
)
// Start starts the sidecar informers and CNPG-i server
func Start(ctx context.Context) error {
scheme := generateScheme(ctx)
setupLog := log.FromContext(ctx)
setupLog.Info("Starting barman cloud instance plugin")
podName := viper.GetString("pod-name")
clusterName := viper.GetString("cluster-name")
namespace := viper.GetString("namespace")
controllerOptions := ctrl.Options{
PprofBindAddress: viper.GetString("pprof-server"),
Scheme: scheme,
Client: client.Options{
// Important: the caching options below are used by
// controller-runtime only.
// The plugin code uses an enhanced client with a
// custom caching strategy specifically for ObjectStores
// and Clusters.
//
// This custom strategy is necessary because we lack
// permission to list these resources at the namespace
// level. Additionally, controller-runtime does not
// support caching a closed (explicit) set of objects
// within a namespace - it can only cache either individual
// objects or all objects in a namespace.
Cache: &client.CacheOptions{
DisableFor: []client.Object{
&corev1.Secret{},
&barmancloudv1.ObjectStore{},
&cnpgv1.Cluster{},
&cnpgv1.Backup{},
},
},
},
}
mgr, err := ctrl.NewManager(ctrl.GetConfigOrDie(), controllerOptions)
if err != nil {
setupLog.Error(err, "unable to start manager")
return err
}
customCacheClient := extendedclient.NewExtendedClient(mgr.GetClient())
if err := mgr.Add(&CNPGI{
Client: customCacheClient,
InstanceName: podName,
PGDataPath: viper.GetString("pgdata"),
PGWALPath: path.Join(viper.GetString("pgdata"), "pg_wal"),
SpoolDirectory: viper.GetString("spool-directory"),
PluginPath: viper.GetString("plugin-path"),
}); err != nil {
setupLog.Error(err, "unable to create CNPGI runnable")
return err
}
if err := mgr.Add(&CatalogMaintenanceRunnable{
Client: customCacheClient,
//nolint:staticcheck // SA1019: old API required for RBAC compatibility
Recorder: mgr.GetEventRecorderFor("policy-runnable"),
ClusterKey: types.NamespacedName{
Namespace: namespace,
Name: clusterName,
},
CurrentPodName: podName,
}); err != nil {
setupLog.Error(err, "unable to policy enforcement runnable")
return err
}
if err := mgr.Start(ctx); err != nil {
return err
}
return nil
}
// generateScheme creates a runtime.Scheme object with all the
// definition needed to support the sidecar. This allows
// the plugin to be used in every CNPG-based operator.
func generateScheme(ctx context.Context) *runtime.Scheme {
result := runtime.NewScheme()
utilruntime.Must(barmancloudv1.AddToScheme(result))
utilruntime.Must(clientgoscheme.AddToScheme(result))
pluginscheme.AddCNPGToScheme(ctx, result)
return result
}