Skip to content

Commit cce29e2

Browse files
androndoclaude
androndo
and
claude
committed
fix(keycloak): back up keycloak-db via the barman-cloud plugin
The keycloak-db backup added in #3174 uses the in-tree native spec.backup.barmanObjectStore, whose barman-cloud-* binaries ship only in the CNPG system image variant; keycloak-db is pinned to the standard variant, so base backups fail with 'barman-cloud-backup: executable file not found'. The proposed workaround (#3306) switches keycloak-db to the deprecated system image variant when backups are enabled. Migrate keycloak-db to the barman-cloud plugin instead, matching the rest of this PR: render spec.plugins referencing a barmancloud.cnpg.io ObjectStore (the S3/barman config moves there) and a method=plugin ScheduledBackup, keeping the Cluster on the standard image (the plugin runs the barman tooling in a sidecar). This removes the need for the system-variant workaround entirely, so #3306 can be closed. #3300. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]> Signed-off-by: Andrey Kolkov <[email protected]>
1 parent 2ffe43e commit cce29e2

2 files changed

Lines changed: 42 additions & 21 deletions

File tree

‎packages/system/keycloak/templates/backup.yaml‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,8 +3,8 @@
33

44
Rendered only when backup.enabled, backup.destinationPath and
55
backup.schedule are all set. The destinationPath gate must match db.yaml /
6-
backup-secret.yaml: without it the Cluster gets no spec.backup.barmanObjectStore,
7-
so a ScheduledBackup would target a Cluster with no object store and CNPG
6+
backup-secret.yaml: without it the Cluster gets no spec.plugins / ObjectStore,
7+
so a ScheduledBackup would target a Cluster with no backup wiring and CNPG
88
would perpetually fail it. CNPG also rejects an empty schedule.
99

1010
NOTE: schedule is a 6-field cron (leading seconds field), not the 5-field
@@ -18,6 +18,9 @@ metadata:
1818
spec:
1919
schedule: {{ .Values.backup.schedule | quote }}
2020
backupOwnerReference: self
21+
method: plugin
22+
pluginConfiguration:
23+
name: barman-cloud.cloudnative-pg.io
2124
cluster:
2225
name: keycloak-db
2326
{{- end }}

‎packages/system/keycloak/templates/db.yaml‎

Lines changed: 37 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -18,30 +18,48 @@ spec:
1818
cnpg.io/cluster: keycloak-db
1919
{{- end }}
2020
{{- end }}
21-
{{- if and .Values.backup.enabled .Values.backup.destinationPath }}
2221
{{- $credSecret := .Values.backup.existingSecretName | default "keycloak-db-backup-s3-creds" }}
23-
backup:
24-
barmanObjectStore:
25-
destinationPath: {{ .Values.backup.destinationPath | quote }}
26-
{{- with .Values.backup.endpointURL }}
27-
endpointURL: {{ . | quote }}
28-
{{- end }}
29-
s3Credentials:
30-
accessKeyId:
31-
name: {{ $credSecret }}
32-
key: AWS_ACCESS_KEY_ID
33-
secretAccessKey:
34-
name: {{ $credSecret }}
35-
key: AWS_SECRET_ACCESS_KEY
36-
data:
37-
compression: gzip
38-
wal:
39-
compression: gzip
40-
retentionPolicy: {{ .Values.backup.retentionPolicy | quote }}
22+
{{- if and .Values.backup.enabled .Values.backup.destinationPath }}
23+
# Barman Cloud plugin. The S3/barman settings live in the ObjectStore CR
24+
# rendered at the bottom of this file; the Cluster only references it by name.
25+
# Native spec.backup.barmanObjectStore is deprecated in CNPG 1.27 and removed
26+
# in 1.29, and the standard image variant keycloak-db pins no longer ships the
27+
# barman-cloud-* binaries. The plugin runs them in a sidecar, so keycloak-db
28+
# stays on the standard variant (no need for the deprecated system variant).
29+
plugins:
30+
- name: barman-cloud.cloudnative-pg.io
31+
isWALArchiver: true
32+
parameters:
33+
barmanObjectName: keycloak-db
4134
{{- end }}
4235
monitoring:
4336
enablePodMonitor: true
4437

4538
inheritedMetadata:
4639
labels:
4740
policy.cozystack.io/allow-to-apiserver: "true"
41+
{{- if and .Values.backup.enabled .Values.backup.destinationPath }}
42+
---
43+
apiVersion: barmancloud.cnpg.io/v1
44+
kind: ObjectStore
45+
metadata:
46+
name: keycloak-db
47+
spec:
48+
retentionPolicy: {{ .Values.backup.retentionPolicy | quote }}
49+
configuration:
50+
destinationPath: {{ .Values.backup.destinationPath | quote }}
51+
{{- with .Values.backup.endpointURL }}
52+
endpointURL: {{ . | quote }}
53+
{{- end }}
54+
s3Credentials:
55+
accessKeyId:
56+
name: {{ $credSecret }}
57+
key: AWS_ACCESS_KEY_ID
58+
secretAccessKey:
59+
name: {{ $credSecret }}
60+
key: AWS_SECRET_ACCESS_KEY
61+
data:
62+
compression: gzip
63+
wal:
64+
compression: gzip
65+
{{- end }}

0 commit comments

Comments
 (0)