Skip to content
This repository was archived by the owner on Sep 10, 2025. It is now read-only.

merge upstream#2

Merged
richardgeico merged 836 commits intomainfrom
upstream
Sep 9, 2025
Merged

merge upstream#2
richardgeico merged 836 commits intomainfrom
upstream

Conversation

@ardentperf
Copy link
Collaborator

NiccoloFei and others added 30 commits May 19, 2025 20:20
…Es (cloudnative-pg#7303)

This patch goes together with
cloudnative-pg/postgres-trunk-containers#80.
The goal is to allow configuring a custom repository (in this case the
`postgresql-trunk`) instead of the default ones (via an env variable),
which will be used to fetch the target images required to perform the
major upgrade scenarios.
This will allow us to test major upgrades to development versions of
PG18.

Closes cloudnative-pg#7302


Signed-off-by: Niccolò Fei <niccolo.fei@enterprisedb.com>
Signed-off-by: Armando Ruocco <armando.ruocco@enterprisedb.com>
Co-authored-by: Armando Ruocco <armando.ruocco@enterprisedb.com>
…loudnative-pg#7588)

Enable customization of in-place major upgrades using a CNPG-I plugin by
passing optional arguments for `pg_upgrade` and `initdb`, and specify
alternative executable paths for `initdb` if needed.

Closes cloudnative-pg#7587

Signed-off-by: Marco Nenciarini <marco.nenciarini@enterprisedb.com>
Hashicorp Vault, though commonly used, does have a restrictive, BUSL
license that most organizations cannot use.

Adding a mention to https://openbao.org, which is released under the
MPL license.

Signed-off-by: Gustavo Fernandes de Carvalho <17139678+gusfcarvalho@users.noreply.github.com>
Signed-off-by: Gabriele Bartolini <gabriele.bartolini@enterprisedb.com>
Co-authored-by: Gabriele Bartolini <gabriele.bartolini@enterprisedb.com>
Closes cloudnative-pg#7593

Signed-off-by: Gabriele Bartolini <gabriele.bartolini@enterprisedb.com>
…7604)

Closes cloudnative-pg#7580

Signed-off-by: Gabriele Bartolini <gabriele.bartolini@enterprisedb.com>
Update the versions used to test the operator on public cloud providers

Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: public-cloud-k8s-versions-check <public-cloud-k8s-versions-check@users.noreply.github.com>
Closes cloudnative-pg#7605

Signed-off-by: Marco Nenciarini <marco.nenciarini@enterprisedb.com>
The Cluster API included some extra fields to cache the compiled regexp
and the related errors.
Unfortunately, this prevents the API from being used with
[controllerutil.CreateOrUpdate](1).

This patch removes the cache, compiling the regexp when needed.

Closes: cloudnative-pg#6605

Signed-off-by: Leonardo Cecchi <leonardo.cecchi@enterprisedb.com>

[1]:

https://pkg.go.dev/sigs.k8s.io/controller-runtime@v0.19.4/pkg/controller/controllerutil#CreateOrUpdate

Signed-off-by: Armando Ruocco <armando.ruocco@enterprisedb.com>
Signed-off-by: Marco Nenciarini <marco.nenciarini@enterprisedb.com>
Co-authored-by: Armando Ruocco <armando.ruocco@enterprisedb.com>
Co-authored-by: Marco Nenciarini <marco.nenciarini@enterprisedb.com>
…pg#7608)

Removed support for Kubernetes (and OpenShift) versions older than 1.29.

Closes cloudnative-pg#7607

Signed-off-by: Gabriele Bartolini <gabriele.bartolini@enterprisedb.com>
…udnative-pg#7581)

With the introduction of the CNPG-I interface and official support for
the Barman Cloud Plugin, the backup and recovery documentation has been
reorganised to reflect the new plugin-based architecture.

This is the first step toward a more modular and extensible approach.
Further work is planned outside the core CloudNativePG repository,
including maintaining an inventory of available plugins and migrating
volume snapshot support into a dedicated plugin.

Closes cloudnative-pg#6876

Signed-off-by: Gabriele Bartolini <gabriele.bartolini@enterprisedb.com>
Signed-off-by: Francesco Canovai <francesco.canovai@enterprisedb.com>
Co-authored-by: Francesco Canovai <francesco.canovai@enterprisedb.com>
…er (cloudnative-pg#7602)

Closes cloudnative-pg#7601

Signed-off-by: Marco Nenciarini <marco.nenciarini@enterprisedb.com>
…ssues (cloudnative-pg#7600)

Defining an OpenAPI default for a field within an optional section (such
as `spec.postgresql.synchronous`) causes OLM to treat the entire section
as required. This leads to validation errors when other mandatory fields
in that section are not set.

To resolve this, the defaulting logic for
`spec.postgresql.synchronous.dataDurability` has been moved from the CRD
schema to the defaulting webhook.

Closes cloudnative-pg#7599

Signed-off-by: Jonathan Gonzalez V. <jonathan.gonzalez@enterprisedb.com>
Signed-off-by: Marco Nenciarini <marco.nenciarini@enterprisedb.com>
Co-authored-by: Marco Nenciarini <marco.nenciarini@enterprisedb.com>
Added some missing fields in the section `spec.postgresql.synchronous`
and `spec.probes` for the OLM UI look better.

Partially-closes cloudnative-pg#7616

Signed-off-by: Jonathan Gonzalez V. <jonathan.gonzalez@enterprisedb.com>
Closes cloudnative-pg#7550

Signed-off-by: Gabriele Bartolini <gabriele.bartolini@enterprisedb.com>
Signed-off-by: Marco Nenciarini <marco.nenciarini@enterprisedb.com>
Co-authored-by: Marco Nenciarini <marco.nenciarini@enterprisedb.com>
…#7620)

Closes cloudnative-pg#7550

Signed-off-by: Marco Nenciarini <marco.nenciarini@enterprisedb.com>
Signed-off-by: Marco Nenciarini <marco.nenciarini@enterprisedb.com>
Signed-off-by: Marco Nenciarini <marco.nenciarini@enterprisedb.com>
Signed-off-by: Marco Nenciarini <marco.nenciarini@enterprisedb.com>
Signed-off-by: Jonathan Gonzalez V. <jonathan.gonzalez@enterprisedb.com>
Co-authored-by: Jonathan Gonzalez V. <jonathan.gonzalez@enterprisedb.com>
Signed-off-by: Marco Nenciarini <marco.nenciarini@enterprisedb.com>
Signed-off-by: Marco Nenciarini <marco.nenciarini@enterprisedb.com>
Co-authored-by: Marco Nenciarini <marco.nenciarini@enterprisedb.com>
Adds DocumentDB Operator to the ADOPTERS list

Signed-off-by: German Eichberger <xgerman@users.noreply.github.com>
…tive-pg#7650)

The branch release-1.24 is now locked, and no changes should be made to
it. The new branch added to the list is release-1.26.

Closes cloudnative-pg#7649

Signed-off-by: Jonathan Gonzalez V. <jonathan.gonzalez@enterprisedb.com>
Update the versions used to test the operator on public cloud providers

Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: public-cloud-k8s-versions-check <public-cloud-k8s-versions-check@users.noreply.github.com>
Fixes some cases in the e2e where the tests would race to the next test
when the operator is not ready yet, or when the nodes are not ready.

Refactor the code to improve reuse and simplify signatures.

Closes cloudnative-pg#7589

Signed-off-by: Francesco Canovai <francesco.canovai@enterprisedb.com>
Signed-off-by: Niccolò Fei <niccolo.fei@enterprisedb.com>
Co-authored-by: Niccolò Fei <niccolo.fei@enterprisedb.com>
…ative-pg#7648)

The architectures 386 and arm5/6/7 aren't way too used, and just
removing these architectures we reduce to half the amount of os/arch
we build for the plugin.

Closes cloudnative-pg#7564

Signed-off-by: Jonathan Gonzalez V. <jonathan.gonzalez@enterprisedb.com>
…7652)

The bundle and catalog for OLM wasn't being created due to the lack of
permission to push to the registry.

Closes cloudnative-pg#7630

Signed-off-by: Jonathan Gonzalez V. <jonathan.gonzalez@enterprisedb.com>
cloudnative-pg#7544)

The corev1.Endpoints() has been deprecated on Kubernetes API 1.33
and replaced by discoveryv1.EndpointSlice().

Closes cloudnative-pg#7543

Signed-off-by: Jonathan Gonzalez V. <jonathan.gonzalez@enterprisedb.com>
Signed-off-by: Armando Ruocco <armando.ruocco@enterprisedb.com>
Co-authored-by: Armando Ruocco <armando.ruocco@enterprisedb.com>
Reworded the contributing file slightly for grammar and clarity 🙏

Signed-off-by: Floor Drees <floordrees@gmail.com>
…pg#7485)

This PR contains the following updates:

https://github.com/kubernetes/api `v0.32.3` -> `v0.33.1`
https://github.com/kubernetes/apiextensions-apiserver `v0.32.3` -> `v0.33.1`
https://github.com/kubernetes/apimachinery `v0.32.3` -> `v0.33.1`
https://github.com/kubernetes/cli-runtime `v0.32.3` -> `v0.33.1`
https://github.com/kubernetes/client-go `v0.32.3` -> `v0.33.1` 

Signed-off-by: Jonathan Gonzalez V. <jonathan.gonzalez@enterprisedb.com>
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
…g#7667)

This PR contains the following updates:

https://github.com/docker/bake-action `76f9fa3` -> `37816e7`
https://github.com/docker/build-push-action `14487ce` -> `2634353`
https://github.com/github/codeql-action `60168ef` -> `ff0a06e`
https://github.com/kubernetes-sigs/kind `v0.27.0` -> `v0.29.0`
https://github.com/rojopolis/spellcheck-github-actions `0.48.0` -> `0.49.0`
https://github.com/sigstore/cosign-installer `d7d6bc7` -> `3454372`

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
cnpg-bot and others added 27 commits August 27, 2025 14:08
Update the versions used to test the operator on public cloud providers

Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Signed-off-by: Jonathan Gonzalez V. <jonathan.gonzalez@enterprisedb.com>
Co-authored-by: public-cloud-k8s-versions-check <public-cloud-k8s-versions-check@users.noreply.github.com>
…g#8419)

This PR contains the following updates:

https://github.com/google-github-actions/setup-gcloud `6189d56` -> `cb1e50a`
https://github.com/kubernetes-sigs/kind `v0.29.0` -> `v0.30.0`
snyk/actions `ae57bdf` -> `e222141`
With the latest version of shellcheck the test SC2329 was added looking
for unused functions, or explicitly ignore that test, in our case, the functions
are called indirectly and always used.

Closes cloudnative-pg#8455

Signed-off-by: Jonathan Gonzalez V. <jonathan.gonzalez@enterprisedb.com>
Update the versions used to test the operator on public cloud providers

Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Signed-off-by: Jonathan Gonzalez V. <jonathan.gonzalez@enterprisedb.com>
Co-authored-by: public-cloud-k8s-versions-check <public-cloud-k8s-versions-check@users.noreply.github.com>
…pg#8449)

This PR contains the following updates:

https://github.com/kubernetes/api `v0.33.4` -> `v0.34.0`
https://github.com/kubernetes/apiextensions-apiserver `v0.33.4` -> `v0.34.0`
https://github.com/kubernetes/apimachinery `v0.33.4` -> `v0.34.0`
https://github.com/kubernetes/cli-runtime `v0.33.4` -> `v0.34.0`
https://github.com/kubernetes/client-go `v0.33.4` -> `v0.34.0`


Signed-off-by: Jonathan Gonzalez V. <jonathan.gonzalez@enterprisedb.com>
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: Jonathan Gonzalez V. <jonathan.gonzalez@enterprisedb.com>
Signed-off-by: Armando Ruocco <armando.ruocco@enterprisedb.com>
Signed-off-by: Marco Nenciarini <marco.nenciarini@enterprisedb.com>
Co-authored-by: Marco Nenciarini <marco.nenciarini@enterprisedb.com>
Update the Postgres versions used in E2E tests

Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Signed-off-by: Jonathan Gonzalez V. <jonathan.gonzalez@enterprisedb.com>
Co-authored-by: postgres-versions-updater <postgres-versions-updater@users.noreply.github.com>
Refresh the licenses directory

Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Signed-off-by: Jonathan Gonzalez V. <jonathan.gonzalez@enterprisedb.com>
Co-authored-by: license-updater <license-updater@users.noreply.github.com>
Add `usestdlibvars` linter to the list of golangci linters
Fix issues throw by the new linter

Closes cloudnative-pg#8484

Signed-off-by: Pascal Bourdier <pascal.bourdier@gmail.com>
Closes cloudnative-pg#8457

Signed-off-by: Jonathan Gonzalez V. <jonathan.gonzalez@enterprisedb.com>
Update the Postgres versions used in E2E tests

Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Signed-off-by: Jonathan Gonzalez V. <jonathan.gonzalez@enterprisedb.com>
Co-authored-by: postgres-versions-updater <postgres-versions-updater@users.noreply.github.com>
…cloudnative-pg#8486)

This patch addresses a regression introduced by cloudnative-pg#8320 that does not
affect any released version.

The regression made it impossible to perform backups using a plugin, as
the controller would incorrectly require and validate the `spec.backup`
field even when the backup method was set to plugin. With this change,
validating the `spec.backup` field is skipped when using plugin-based
backups, restoring the expected behavior for plugin users.

Signed-off-by: Armando Ruocco <armando.ruocco@enterprisedb.com>
…#8485)

Fix the incorrect API group reported by the Pooler and Backup
admission webhook.

Signed-off-by: Armando Ruocco <armando.ruocco@enterprisedb.com>
… recovery source (cloudnative-pg#8506)

Treat WAL archiving as active if either Backup.BarmanObjectStore is set
or a WAL-archiver plugin is enabled.

Closes cloudnative-pg#8507

Signed-off-by: Armando Ruocco <armando.ruocco@enterprisedb.com>
Signed-off-by: Marco Nenciarini <marco.nenciarini@enterprisedb.com>
Signed-off-by: Niccolò Fei <niccolo.fei@enterprisedb.com>
Co-authored-by: Marco Nenciarini <marco.nenciarini@enterprisedb.com>
Co-authored-by: Niccolò Fei <niccolo.fei@enterprisedb.com>
…e-pg#8545)

Closes cloudnative-pg#8544

Signed-off-by: Gabriele Bartolini <gabriele.bartolini@enterprisedb.com>
…8543)

Signed-off-by: Gabriele Bartolini <gabriele.bartolini@enterprisedb.com>
Comment on lines +1978 to +1981
name: Install operator-sdk
run: |
make operator-sdk
-

Check failure

Code scanning / CodeQL

Checkout of untrusted code in a privileged context Critical

Potential execution of untrusted code on a privileged workflow (
issue_comment
)
Comment on lines +1982 to +1985
name: Install preflight
run: |
make preflight
-

Check failure

Code scanning / CodeQL

Checkout of untrusted code in a privileged context Critical

Potential execution of untrusted code on a privileged workflow (
issue_comment
)
ctx context.Context,
operationType plugin.OperationVerb,
cluster client.Object,
object client.Object,

Check failure

Code scanning / CodeQL

Clear-text logging of sensitive information High

Sensitive data returned by an access to PgadminPassword
flows to a logging call.
Sensitive data returned by an access to pgadminPassword
flows to a logging call.
Sensitive data returned by an access to PgadminPassword
flows to a logging call.
Sensitive data returned by an access to SecretKeyRef
flows to a logging call.
Sensitive data returned by an access to SecretKeyRef
flows to a logging call.
Sensitive data returned by an access to SecretKeyRef
flows to a logging call.
Sensitive data returned by an access to SecretKeyRef
flows to a logging call.
Sensitive data returned by an access to password
flows to a logging call.
Sensitive data returned by an access to password
flows to a logging call.
Sensitive data returned by an access to password
flows to a logging call.
Sensitive data returned by an access to SecretKeyRef
flows to a logging call.
Sensitive data returned by an access to SecretKeyRef
flows to a logging call.
Sensitive data returned by an access to Password
flows to a logging call.
Sensitive data returned by an access to Password
flows to a logging call.
}

query := fmt.Sprintf("COMMENT ON ROLE %s IS %s",
pgx.Identifier{role.Name}.Sanitize(), pq.QuoteLiteral(role.Comment))
contextLog.Debug("Updating comment", "query", query)
_, err := sm.superUserDB.ExecContext(ctx, query)
_, err := db.ExecContext(ctx, query)

Check failure

Code scanning / CodeQL

Clear-text logging of sensitive information High

Sensitive data returned by an access to ignorePassword
flows to a logging call.
Sensitive data returned by an access to password
flows to a logging call.
@@ -54,9 +57,18 @@
// for the <cluster>-rw service, which would cause a name verification error.
caCertPool := x509.NewCertPool()
caCertPool.AppendCertsFromPEM(caCertificate)

Check failure

Code scanning / CodeQL

Disabled TLS certificate check High

InsecureSkipVerify should not be used in production code.
@richardgeico richardgeico merged commit effb15d into main Sep 9, 2025
2 of 3 checks passed
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.