mirror of
https://github.com/cloudnative-pg/plugin-barman-cloud.git
synced 2026-07-07 10:12:21 +02:00
fe445b154f
When an ObjectStore's credentials change (e.g., secret rename), the RBAC Role granting the Cluster's ServiceAccount access to those secrets was not updated because nothing triggered a Cluster reconciliation. Implement the ObjectStore controller's Reconcile to detect referencing Clusters and update their Roles directly. Extract ensureRole into a shared rbac.EnsureRole function used by both the Pre hook and the ObjectStore controller. Handle concurrent modifications between the Pre hook and ObjectStore controller gracefully: AlreadyExists on Create and Conflict on Patch are retried once to avoid propagating transient errors as gRPC failures to CNPG. Replace the custom setOwnerReference helper (ownership.go) with controllerutil.SetControllerReference for both Role and RoleBinding. The old helper read the GVK from the object's metadata and replaced all owner references unconditionally. The new function reads the GVK from the scheme and appends to existing owner references, refusing to overwrite if another controller already owns the object. Both produce identical results for our use case since the Role is always freshly built. The GVK is now resolved from the scheme configured via CUSTOM_CNPG_GROUP/CUSTOM_CNPG_VERSION, which must match the actual CNPG API group (same requirement as the instance sidecar). Add dynamic CNPG scheme registration (internal/scheme) to the operator, instance, and restore managers, replacing hardcoded cnpgv1.AddToScheme calls. Add RBAC permission for the plugin to list/watch Clusters. Signed-off-by: Armando Ruocco <armando.ruocco@enterprisedb.com>
110 lines
3.5 KiB
Go
110 lines
3.5 KiB
Go
/*
|
|
Copyright © contributors to CloudNativePG, established as
|
|
CloudNativePG a Series of LF Projects, LLC.
|
|
|
|
Licensed under the Apache License, Version 2.0 (the "License");
|
|
you may not use this file except in compliance with the License.
|
|
You may obtain a copy of the License at
|
|
|
|
http://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
Unless required by applicable law or agreed to in writing, software
|
|
distributed under the License is distributed on an "AS IS" BASIS,
|
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
See the License for the specific language governing permissions and
|
|
limitations under the License.
|
|
|
|
SPDX-License-Identifier: Apache-2.0
|
|
*/
|
|
|
|
// Package operator is the entrypoint of operator plugin
|
|
package operator
|
|
|
|
import (
|
|
"fmt"
|
|
|
|
"github.com/spf13/cobra"
|
|
"github.com/spf13/viper"
|
|
|
|
"github.com/cloudnative-pg/plugin-barman-cloud/internal/cnpgi/operator"
|
|
)
|
|
|
|
// NewCmd creates a new operator command
|
|
func NewCmd() *cobra.Command {
|
|
cmd := &cobra.Command{
|
|
Use: "operator",
|
|
Short: "Starts the BarmanObjectStore reconciler and the Barman Cloud CNPG-i plugin",
|
|
RunE: func(cmd *cobra.Command, _ []string) error {
|
|
if len(viper.GetString("sidecar-image")) == 0 {
|
|
return fmt.Errorf("missing required SIDECAR_IMAGE environment variable")
|
|
}
|
|
|
|
return operator.Start(cmd.Context())
|
|
},
|
|
PersistentPreRunE: func(_ *cobra.Command, _ []string) error {
|
|
return nil
|
|
},
|
|
}
|
|
|
|
cmd.Flags().String("metrics-bind-address", "0", "The address the metrics endpoint binds to. "+
|
|
"Use :8443 for HTTPS or :8080 for HTTP, or leave as 0 to disable the metrics service.")
|
|
_ = viper.BindPFlag("metrics-bind-address", cmd.Flags().Lookup("metrics-bind-address"))
|
|
|
|
cmd.Flags().String("health-probe-bind-address", ":8081", "The address the probe endpoint binds to.")
|
|
_ = viper.BindPFlag("health-probe-bind-address", cmd.Flags().Lookup("health-probe-bind-address"))
|
|
|
|
cmd.Flags().Bool("leader-elect", false,
|
|
"Enable leader election for controller manager. "+
|
|
"Enabling this will ensure there is only one active controller manager.")
|
|
_ = viper.BindPFlag("leader-elect", cmd.Flags().Lookup("leader-elect"))
|
|
|
|
cmd.Flags().Bool("metrics-secure", true,
|
|
"If set, the metrics endpoint is served securely via HTTPS. Use --metrics-secure=false to use HTTP instead.")
|
|
_ = viper.BindPFlag("metrics-secure", cmd.Flags().Lookup("metrics-secure"))
|
|
|
|
cmd.Flags().Bool("enable-http2", false,
|
|
"If set, HTTP/2 will be enabled for the metrics and webhook servers")
|
|
_ = viper.BindPFlag("enable-http2", cmd.Flags().Lookup("enable-http2"))
|
|
|
|
cmd.Flags().String(
|
|
"plugin-path",
|
|
"",
|
|
"The plugins socket path",
|
|
)
|
|
_ = viper.BindPFlag("plugin-path", cmd.Flags().Lookup("plugin-path"))
|
|
|
|
cmd.Flags().String(
|
|
"server-cert",
|
|
"",
|
|
"The public key to be used for the server process",
|
|
)
|
|
_ = viper.BindPFlag("server-cert", cmd.Flags().Lookup("server-cert"))
|
|
|
|
cmd.Flags().String(
|
|
"server-key",
|
|
"",
|
|
"The key to be used for the server process",
|
|
)
|
|
_ = viper.BindPFlag("server-key", cmd.Flags().Lookup("server-key"))
|
|
|
|
cmd.Flags().String(
|
|
"client-cert",
|
|
"",
|
|
"The client public key to verify the connection",
|
|
)
|
|
_ = viper.BindPFlag("client-cert", cmd.Flags().Lookup("client-cert"))
|
|
|
|
cmd.Flags().String(
|
|
"server-address",
|
|
"",
|
|
"The address where to listen (i.e. 0:9090)",
|
|
)
|
|
_ = viper.BindPFlag("server-address", cmd.Flags().Lookup("server-address"))
|
|
|
|
_ = viper.BindEnv("sidecar-image", "SIDECAR_IMAGE")
|
|
_ = viper.BindEnv("custom-cnpg-group", "CUSTOM_CNPG_GROUP")
|
|
_ = viper.BindEnv("custom-cnpg-version", "CUSTOM_CNPG_VERSION")
|
|
|
|
return cmd
|
|
}
|