fix(backups): report sizeBytes for MariaDB and CNPG backup artifacts - #5015

What this PR does

Fixes #4316. Backup.status.artifact.sizeBytes was only ever set by the etcd strategy; MariaDB and CNPG backups always arrived without a size.

MariaDB — size is now measured. The issue suggested a HEAD on the artifact URI, but that URI is synthetic (s3://<bucket>/<prefix>/<operator Backup name>) and no object lives there. mariadb-operator writes each logical dump as <prefix>/backup.<RFC3339>[.<compression>].sql, and the default strategy uses one prefix per application (<namespace>/<app>/), so every backup of the app shares it. On completion the driver now:

1. builds an S3 client from the same Secrets, region and TLS/CA settings the operator Backup was rendered with (the controller already has cluster-wide get on Secrets, uncached, for the credentials projector);
2. lists the prefix non-recursively, as mariadb-operator does, and keeps the dumps that fall within the operator Backup's lifetime (creationTimestamp to Complete, ±1 min of slack) by both the timestamp in the file name (the backup pod's clock) and the object's LastModified (the object store's clock). A single skewed clock therefore leaves the size unset, and a neighbouring run's dump is never taken for this one. Both dump name layouts are accepted, backup.<ts>.<alg>.sql (v25.10) and backup.<ts>.sql.<ext> (later releases), with the compression token checked. The default MariaDB prefix is the same <namespace>/<name>/ path as the default CNPG destinationPath, so a recursive listing would walk a same-named Postgres's WAL archive;
3. writes the size only when exactly one dump matches.

On any error (no Secret, bucket unreachable, listing denied) or when 0 or 2+ dumps match, sizeBytes stays unset and the backup still succeeds. The probe runs once, when the Backup is created. Its timeout is 10s, because the BackupJob controller has a single worker and a hanging endpoint delays every other BackupJob. Failures to measure are logged at info, since the chart runs the controller at that level. An S3 endpoint behind a path prefix cannot be addressed by minio-go, which refuses it (a bare trailing slash is accepted); the CNPG probe refuses it too, because it parses endpointURL itself and dropping the path would probe another location. A listing cut short by the timeout is treated as a failure rather than summed, and a reconcile that finds the Backup already created returns it without probing again. That check, and the existing AlreadyExists refetch, read from the API server rather than the cache, so a retry right after a successful Create is not mistaken for a failure. A failed read in that check is logged and the driver goes on to Create: the check only saves a probe, so a transient apiserver error must not fail a backup that succeeded. If Create then collides with the existing Backup and reading it back also fails, the reconcile is retried with backoff instead of failing the BackupJob, with Ready=False (reason BackupNotReadBack) on it meanwhile. When the existence check itself fails, the size probe is skipped: the Backup may well exist, so a probe would only be discarded, and a read that keeps failing would rerun it on every retry. The S3 client is minio-go, which is new to this tree: this PR adds it as a direct dependency, and internal/backupcontroller/artifact_size.go is its only importer. The still-open Bucket strategy PR (#4235) chose the same client, so the two would share it rather than bring in two S3 SDKs.

Contract. The API doc for sizeBytes now says what the value covers: the stored size of the files one backup owns, such as the dump of a MariaDB backup or the base backup of a CNPG one, without the WAL archive the server's backups share. Strategies that cannot attribute stored bytes to one backup, such as Velero's, leave it unset, and drivers never write 0 for a size they cannot measure, so a missing value means "unknown", not "empty".

Velero. The strategy explicitly leaves the field unset and the code says why. Kopia stores data content-addressed across backups, so there is no stored size per backup. DataUpload.status.progress.totalBytes is the number of bytes read, not stored, so it does not belong under "artifact size".

CNPG — size is now measured. cnpg.io/Backup status has no size, but it has backupId, and barman-cloud uploads every base backup under <destinationPath>/<serverName>/base/<backupId>/ (backup.info plus the data and tablespace tarballs, possibly split into parts — see os.path.join(path, server_name, "base", backup_id) in barman's cloud.py). On completion the driver lists that prefix with the s3Credentials and endpointCA of the rendered barmanObjectStore and the effective serverName, and records the total. No time-window matching is needed here: the prefix belongs to exactly one backup. The WAL archive is not counted, because it is one continuous stream shared by every base backup of the server, even though a restore also needs it. The field stays unset when backupId is empty, s3Credentials is absent, the destination is not s3://, the bucket cannot be read, or nothing is stored under the prefix.

The S3 client (s3Connection → s3ObjectLister) and the Secret lookup are shared by both drivers in artifact_size.go. An endpoint CA is trusted the way the backup writer trusts it: on top of the system roots for MariaDB (mariadb-operator appends it to the system pool), instead of them for CNPG (barman-cloud receives it as AWS_CA_BUNDLE). A custom endpoint CA is added to the RootCAs of minio.DefaultTransport, so the proxy and timeout settings are kept.

Tests: for MariaDB, the unit tests cover file-name parsing, prefix normalisation, window matching (single, ambiguous, none, clock skew) and the error paths. For CNPG, they cover destination-path parsing, the barman prefix, summing split tarballs, custom credential keys plus the endpoint CA, and every unset path. Both drivers have artifact-wiring tests. The real minio client signs a ListObjectsV2 against an httptest stub with credentials from a Secret, and the tests assert the recursive/non-recursive listing per driver. A TLS stub with a self-signed certificate is trusted only through endpointCA. Mutating the CA branch, the recursion flag of either driver, or the MariaDB CA lookup fails the suite. The CRD description was updated by hand to match controller-gen output, because make generate does not run on a Go 1.27 toolchain locally.

Screenshots

N/A — no UI changes.

Downstream repositories

Walked the trigger map against the diff: the only API/CRD change is the description of an existing Backup.status field, with no new field, value, schema or enum. Neither cozystack/website nor cozystack/terraform-provider-cozystack references sizeBytes.

• No downstream repository is affected by this change
• cozystack/website - follow-up:
• cozystack/terraform-provider-cozystack - follow-up:
• cozystack/ansible-cozystack - follow-up:
• cozystack/ccp - follow-up:
• cozystack/talm - follow-up:
• cozystack/cozyhr - follow-up:
• cozystack/cozy-proxy - follow-up:
• cozystack/cozystack-telemetry-server - follow-up:
• cozystack/external-apps-example - follow-up:
• cozystack/examples - follow-up:
• cozystack/community - follow-up:

Release note

fix(backups): MariaDB and CNPG (Postgres) backups stored in S3 now report `status.artifact.sizeBytes`: the size of the dump mariadb-operator uploaded, or the total size of the barman base backup (WAL archive excluded). When the size cannot be measured reliably, the field is left unset rather than set to 0. Velero-based backups intentionally keep it unset.