feat(cluster): make plugin ObjectStore Helm hook optional for ArgoCD

charts/cluster/Chart.yaml

@@ -22,7 +22,7 @@ description: Deploys and manages a CloudNativePG cluster and its associated reso
 kubeVersion: ">=1.29.0-0"
 icon: https://raw.githubusercontent.com/cloudnative-pg/artwork/main/cloudnativepg-logo.svg
 type: application
-version: 0.8.1
+version: 0.9.0
 sources:
   - https://github.com/cloudnative-pg/charts
 keywords:

charts/cluster/README.md

@@ -174,6 +174,8 @@ Kubernetes: `>=1.29.0-0`
 | backups.google.path | string | `"/"` |  |
 | backups.instanceSidecarConfiguration | object | `{}` | The configuration for the Barman Cloud Plugin sidecar that runs in the instance pods. See: https://cloudnative-pg.io/plugin-barman-cloud/docs/next/plugin-barman-cloud.v1/#instancesidecarconfiguration |
 | backups.method | string | `"barmanObjectStore"` | One of `barmanObjectStore` (default) or `plugin` |
+| backups.objectStore.annotations | object | `{}` | Extra annotations for the plugin `ObjectStore` resources only (unlike `cluster.annotations`, these are not applied to the Cluster). Handy for `argocd.argoproj.io/sync-wave: "-1"` when helmHook is false. |
+| backups.objectStore.helmHook | bool | `true` | Render the `ObjectStore` as a Helm hook (pre-install,pre-upgrade,pre-rollback) so it is applied before the Cluster. Set to false for GitOps tools (ArgoCD/Flux) that treat Helm hooks as ephemeral resources: as a hook the ObjectStore gets pruned and WAL archiving breaks. When false, order the ObjectStore yourself via the annotations below (e.g. an ArgoCD sync-wave). |
 | backups.pluginConfiguration | object | `{}` |  |
 | backups.provider | string | `"s3"` | One of `s3`, `azure` or `google` |
 | backups.retentionPolicy | string | `"30d"` | Retention policy for backups |

charts/cluster/templates/backup-objectstore.yaml

@@ -4,11 +4,18 @@ kind: ObjectStore
 metadata:
   name: {{ include "cluster.fullname" . }}-backups
   namespace: {{ include "cluster.namespace" . }}
+  {{- if or .Values.backups.objectStore.helmHook .Values.cluster.annotations .Values.backups.objectStore.annotations }}
   annotations:
+    {{- if .Values.backups.objectStore.helmHook }}
     "helm.sh/hook": pre-install,pre-upgrade,pre-rollback
+    {{- end }}
     {{- with .Values.cluster.annotations }}
       {{- toYaml . | nindent 4 }}
     {{- end }}
+    {{- with .Values.backups.objectStore.annotations }}
+      {{- toYaml . | nindent 4 }}
+    {{- end }}
+  {{- end }}
   labels:
     cnpg.io/cluster: {{ include "cluster.fullname" . }}
     {{- include "cluster.labels" . | nindent 4 }}

charts/cluster/templates/recovery-objectstore.yaml

@@ -4,11 +4,18 @@ kind: ObjectStore
 metadata:
   name: {{ include "cluster.fullname" . }}-recovery
   namespace: {{ include "cluster.namespace" . }}
+  {{- if or .Values.backups.objectStore.helmHook .Values.cluster.annotations .Values.backups.objectStore.annotations }}
   annotations:
+    {{- if .Values.backups.objectStore.helmHook }}
     "helm.sh/hook": pre-install,pre-upgrade,pre-rollback
+    {{- end }}
     {{- with .Values.cluster.annotations }}
       {{- toYaml . | nindent 4 }}
     {{- end }}
+    {{- with .Values.backups.objectStore.annotations }}
+      {{- toYaml . | nindent 4 }}
+    {{- end }}
+  {{- end }}
   labels:
     cnpg.io/cluster: {{ include "cluster.fullname" . }}
     {{- include "cluster.labels" . | nindent 4 }}

charts/cluster/test/barman-plugin-objectstore-hook/01-objectstore_hook_disabled_cluster-assert.yaml

@@ -0,0 +1,15 @@
+apiVersion: postgresql.cnpg.io/v1
+kind: Cluster
+metadata:
+  name: objectstore-hook-cluster
+status:
+  readyInstances: 1
+---
+apiVersion: barmancloud.cnpg.io/v1
+kind: ObjectStore
+metadata:
+  name: objectstore-hook-cluster-backups
+  annotations:
+    argocd.argoproj.io/sync-wave: "-1"
+  # the Helm hook annotation must be absent when helmHook is false (chainsaw assertion expression)
+  '(annotations."helm.sh/hook")': null

charts/cluster/test/barman-plugin-objectstore-hook/01-objectstore_hook_disabled_cluster.yaml

@@ -0,0 +1,33 @@
+type: postgresql
+mode: standalone
+cluster:
+  instances: 1
+  storage:
+    size: 256Mi
+
+backups:
+  enabled: true
+  method: plugin
+  pluginConfiguration:
+    name: barman-cloud.cloudnative-pg.io
+  # The feature under test: no Helm hook on the ObjectStore, plus an ArgoCD-style ordering annotation.
+  objectStore:
+    helmHook: false
+    annotations:
+      argocd.argoproj.io/sync-wave: "-1"
+  provider: s3
+  endpointURL: "https://minio.minio.svc.cluster.local"
+  endpointCA:
+    name: kube-root-ca.crt
+    key: ca.crt
+  wal:
+    encryption: ""
+  data:
+    encryption: ""
+  s3:
+    bucket: "mybucket"
+    path: "/barman-plugin-objectstore-hook/v1"
+    accessKey: "minio"
+    secretKey: "minio123"
+    region: "local"
+  retentionPolicy: "30d"

charts/cluster/test/barman-plugin-objectstore-hook/chainsaw-test.yaml

@@ -0,0 +1,29 @@
+# Tests that the plugin ObjectStore can opt out of the Helm hook (for GitOps tools like ArgoCD)
+apiVersion: chainsaw.kyverno.io/v1alpha1
+kind: Test
+metadata:
+  name: barman-plugin-objectstore-hook
+spec:
+  timeouts:
+    apply: 1s
+    assert: 2m
+    cleanup: 5m
+  steps:
+    - name: Install a cluster with the ObjectStore Helm hook disabled and a custom annotation
+      try:
+        - script:
+            content: |
+              kubectl -n $NAMESPACE create secret generic kube-root-ca.crt --from-literal=ca.crt="$(kubectl -n kube-system get configmaps kube-root-ca.crt -o jsonpath='{.data.ca\.crt}')" --dry-run=client -o yaml | kubectl apply -f -
+              helm upgrade \
+                --install \
+                --namespace $NAMESPACE \
+                --values ./01-objectstore_hook_disabled_cluster.yaml \
+                --wait \
+                objectstore-hook-cluster ../../
+        - assert:
+            file: ./01-objectstore_hook_disabled_cluster-assert.yaml
+    - name: Cleanup
+      try:
+        - script:
+            content: |
+              helm --namespace $NAMESPACE uninstall objectstore-hook-cluster

charts/cluster/values.schema.json

@@ -133,6 +133,23 @@
           "description": "One of `barmanObjectStore` (default) or `plugin`",
           "type": "string"
         },
+        "objectStore": {
+          "properties": {
+            "annotations": {
+              "default": {},
+              "description": "Extra annotations for the plugin `ObjectStore` resources only (unlike `cluster.annotations`, these are not applied to the Cluster). Handy for `argocd.argoproj.io/sync-wave: \"-1\"` when helmHook is false.",
+              "required": [],
+              "type": "object"
+            },
+            "helmHook": {
+              "default": true,
+              "description": "Render the `ObjectStore` as a Helm hook (pre-install,pre-upgrade,pre-rollback) so it is applied before the Cluster. Set to false for GitOps tools (ArgoCD/Flux) that treat Helm hooks as ephemeral resources.",
+              "type": "boolean"
+            }
+          },
+          "required": [],
+          "type": "object"
+        },
         "pluginConfiguration": {
           "required": [],
           "type": "object"

charts/cluster/values.yaml

@@ -488,6 +488,14 @@ backups:
   pluginConfiguration: {}
 #    name: barman-cloud.cloudnative-pg.io
 
+  objectStore:
+    # -- Render the `ObjectStore` as a Helm hook (pre-install,pre-upgrade,pre-rollback) so it is applied before
+    # the Cluster. Set to false for GitOps tools (ArgoCD/Flux) that treat Helm hooks as ephemeral resources
+    helmHook: true
+    # -- Extra annotations for the plugin `ObjectStore` resources only. Handy
+    # for e.g. `argocd.argoproj.io/sync-wave: "-1"` when helmHook above is set to false.
+    annotations: {}
+
   # Barman Object Store configuration applicable to both `barmanObjectStore` and `plugin` methods when using
   # the `barman-cloud.cloudnative-pg.io` plugin.