Repository navigation
[Bug]: Mutating and validating webhooks certificate bundles disappear during reconciliation (CNPG 1.26.0-rc3 + Barman-Pluing 0.4.0) #7597
Description
Is there an existing issue already for this bug?
- I have searched for an existing issue, and could not find anything. I believe this is a new bug.
I have read the troubleshooting guide
- I have read the troubleshooting guide and I think this is a new bug.
I am running a supported version of CloudNativePG
- I have read the troubleshooting guide and I think this is a new bug.
Contact Details
Version
1.26.0-rc3
What version of Kubernetes are you using?
1.31
What is your Kubernetes environment?
Self-managed: RKE
How did you install the operator?
Other
What happened?
First thing to mention - we have all manifests applied to K8s cluster via ArgoCD.
Now to the point: When there is CNPG v1.26.0-rc3 deployed together with barman-plugin 0.4.0, each time a new cluster is provisioned or deprovisioned all certificate bundles disappear from both validating and mutating webhooks, breaking operator completely. After operator's pod restart all certificates are back there, but any consecutive PGSQL cluster provision/deprovision make them disappear again. I think it happens actually during any reconciliation.
There is nothing in both operator's and plugin's logs that show any certificate actions.
After barman-plugin removal problem disappears.
Cluster resource
Relevant log output
Code of Conduct
- I agree to follow this project's Code of Conduct
Reacted by dosubot
Activity
MichaluxPL commentedon May 21, 2025
OK, I think I've found it.
Setting Replace=false in ArgoCD application config for operator's namespace like this:
spec:
syncPolicy:
syncOptions:
- Replace=true
fixes the problem.
So I'm closing this one.
alexbarcelo commentedon Jan 10, 2026
Sorry, @MichaluxPL can you confirm whether the solution is to put
Replace=trueorReplace=false? I suppose the latter, but there is an instance of each one in your last comment.I am in the scenario where the webhooks are broken and I have several database clusters in my k8s. After some restarts or reconciliations or whatever, CNPG is not working properly. How can I fix it? Maybe is obvious, but I am a bit confused. Removing the webhooks and letting them be resync-ed is not a solution.
MichaluxPL commentedon Jan 12, 2026
Hmmm ... Indeed I haven't put it clearly ... I guess it was False, but do be honest I don't remember this case right now. Feel free to check both options :)