fix(operator): drop stale klio-wal from container allowlist - #86
Open
armru wants to merge 1 commit into
Open
Conversation
armru
force-pushed
the
fix/drop-stale-klio-wal-allowlist
branch
2 times, most recently
from
August 12, 2026 12:18
9f1a251 to
0788126
Compare
The plugin injects a single klio-plugin sidecar covering both base backups and WAL streaming, and Spec.Containers is only ever read for klio-plugin and klio-restore (operator/internal/cnpgi/lifecycle.go). A user-defined klio-wal override therefore passed validation and was then silently ignored. Remove klio-wal from the CEL allowlist and from the merge-behavior comment, lower MaxItems to 2, and regenerate the CRD, the Helm chart CRD and the API docs. The CSV spec descriptor is hand-maintained and updated in place. This narrows validation: a PluginConfiguration that still carries a klio-wal entry is rejected on any update that touches spec.containers. On clusters without CRD validation ratcheting (Kubernetes before 1.30, or the gate explicitly disabled) any update to the object is rejected. Removing the entry is always safe, since the sidecar it named no longer exists. Closes #68 Signed-off-by: Armando Ruocco <armando.ruocco@enterprisedb.com>
gabriele-wolfox
force-pushed
the
fix/drop-stale-klio-wal-allowlist
branch
from
August 12, 2026 12:50
0788126 to
9b2074d
Compare
gabriele-wolfox
approved these changes
Aug 12, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
PluginConfiguration.Spec.Containersstill accepted aklio-waloverridelong after that sidecar stopped existing. The plugin injects a single
klio-pluginsidecar covering both base backups and WAL streaming, and thefield is only ever read for
klio-pluginandklio-restore(
operator/internal/cnpgi/lifecycle.go:217,364). A user-definedklio-walcontainer therefore passed CEL validation and was then silently dropped on
the floor: no error, no sidecar, no hint that the customization did nothing.
This removes
klio-walfrom the CEL allowlist and the merge-behaviorcomment, lowers
MaxItemsto 2, and regenerates the CRD, the Helm chart CRDand the API docs. The CSV spec descriptor is hand-maintained and updated in
place.
Compatibility
The change narrows CRD validation, enforced by the API server (the operator
has no admission webhook). An existing
PluginConfigurationcarrying aklio-walentry stays in etcd and is rejected on any update that touchesspec.containers; on clusters without CRD validation ratcheting (Kubernetesbefore 1.30, or the gate explicitly disabled) any update to the object is
rejected. Removing the entry is always safe, since the sidecar it named no
longer exists.
Closes #68