cannot set blockOwnerDeletion if an ownerReference refers to a resource you can't set finalizers on

[peacememories]

We are currently trying to migrate to the Barman Cloud Plugin from the Built-in CloudNativePG Backup on our OKD cluster.

When recreating a Cluster and trying to do a WAL restore, the plugin gives the following error message:

Error while handling GRPC request","info":{"Server":{"Client":{}},"FullMethod":"/cnpgi.reconciler.v1.ReconcilerHooks/Pre"},"error":"roles.rbac.authorization.k8s.io \"menueplan-be-postgres-barman-cloud\" is forbidden: cannot set blockOwnerDeletion if an ownerReference refers to a resource you can't set finalizers on: , <nil>

This seems to be a problem with additional permissions being required on OKD/Openshift. We already tried adding explicit permissions for setting finalizers on CronJobs to the plugins ClusterRole, but this does not seem to help.

Do we need to add this permission to another resource? Unfortunately I don't know where the plugin tries to set blockOwnerDeletion

[peacememories]

Looking at the source code

plugin-barman-cloud/internal/cnpgi/operator/reconciler.go

Line 144 in a225902

if err := setOwnerReference(cluster, newRole); err != nil {

and

plugin-barman-cloud/internal/cnpgi/operator/reconciler.go

Line 197 in a225902

if err := setOwnerReference(cluster, roleBinding); err != nil {

it seems that the resource this permission is needed for might be Cluster. We will try on Monday whether this fixes the problem.

[NoOverflow]

Observed on Openshift 4.17 with barman cloud plugin 0.5.0:

Barman plugin controller logs:

{"level":"error","ts":"2025-07-02T13:28:49.241484147Z","msg":"Error while handling GRPC request","info":{"Server":{"Client":{}},"FullMethod":"/cnpgi.reconciler.v1.ReconcilerHooks/Pre"},"error":"roles.rbac.authorization.k8s.io \"cluster-sample-barman-plugin-barman-cloud\" is forbidden: cannot set blockOwnerDeletion if an ownerReference refers to a resource you can't set finalizers on: , <nil>","stacktrace":"github.com/cloudnative-pg/machinery/pkg/log.(*logger).Error\n\t/go/pkg/mod/github.com/cloudnative-pg/machinery@v0.2.0/pkg/log/log.go:125\ngithub.com/cloudnative-pg/cnpg-i-machinery/pkg/pluginhelper/http.(*Server).Start.logFailedRequestsUnaryServerInterceptor.func2\n\t/go/pkg/mod/github.com/cloudnative-pg/cnpg-i-machinery@v0.3.0/pkg/pluginhelper/http/grpc.go:51\ngoogle.golang.org/grpc.NewServer.chainUnaryServerInterceptors.chainUnaryInterceptors.func1\n\t/go/pkg/mod/google.golang.org/grpc@v1.72.2/server.go:1208\ngithub.com/cloudnative-pg/cnpg-i/pkg/reconciler._ReconcilerHooks_Pre_Handler\n\t/go/pkg/mod/github.com/cloudnative-pg/cnpg-i@v0.2.1/pkg/reconciler/reconciler_grpc.pb.go:174\ngoogle.golang.org/grpc.(*Server).processUnaryRPC\n\t/go/pkg/mod/google.golang.org/grpc@v1.72.2/server.go:1405\ngoogle.golang.org/grpc.(*Server).handleStream\n\t/go/pkg/mod/google.golang.org/grpc@v1.72.2/server.go:1815\ngoogle.golang.org/grpc.(*Server).serveStreams.func2.1\n\t/go/pkg/mod/google.golang.org/grpc@v1.72.2/server.go:1035"}

Looking into the CNPG controller pod reveals more info, and shows that the missing permission is related to cnpg.io Clusters objects:

{"level":"error","ts":"2025-07-02T13:28:50.736534446Z","msg":"Reconciler error","controller":"cluster","controllerGroup":"postgresql.cnpg.io","controllerKind":"**Cluster**","Cluster":{"name":"cluster-sample-barman-plugin","namespace":"prod-dummy-app-database-srv"},"namespace":"prod-dummy-app-database-srv","name":"cluster-sample-barman-plugin","reconcileID":"9efc60ca-d994-4a30-bc35-e0c13346051d","error":"rpc error: code = Unknown desc = roles.rbac.authorization.k8s.io \"cluster-sample-barman-plugin-barman-cloud\" is forbidden: cannot set blockOwnerDeletion if an ownerReference refers to a resource you can't set finalizers on: , <nil>","stacktrace":"sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\tpkg/mod/sigs.k8s.io/controller-runtime@v0.20.4/pkg/internal/controller/controller.go:347\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\tpkg/mod/sigs.k8s.io/controller-runtime@v0.20.4/pkg/internal/controller/controller.go:294\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.2\n\tpkg/mod/sigs.k8s.io/controller-runtime@v0.20.4/pkg/internal/controller/controller.go:255"}

This is a common issue with Openshift / OKD due to the fact that Openshift clusters' enforce the following admission controller OwnerReferencesPermissionEnforcement

This admission controller also protects the access to metadata.ownerReferences[x].blockOwnerDeletion of an object, so that only users with update permission to the finalizers subresource of the referenced owner can change it.

The fix would be to add the following permissions to the existing cluster role for the Barman plugin pods:

- verbs:
      - update
    apiGroups:
      - postgresql.cnpg.io
    resources:
      - clusters/finalizers

Ideally this should also be implemented in both the helm chart and the release.

[NoOverflow]

Opening a PR for a fix. Should also be taken into consideration in cloudnative-pg/charts#598

[mnencia]

Closed by #465