feat: serve restore hooks from the instance sidecar - #1025
Open
armru wants to merge 3 commits into
Open
Conversation
dosubot
Bot
added
size:M
mnencia
force-pushed
the
dev/instance-restore-hooks
branch
from
July 24, 2026 09:49
3a0c140 to
cfb58a6
Compare
mnencia
requested review from
NiccoloFei,
fcanovai,
gbartolini,
leonardoce and
mnencia
as code owners
July 24, 2026 09:49
mnencia
approved these changes
Jul 24, 2026
mnencia
force-pushed
the
dev/instance-restore-hooks
branch
from
July 27, 2026 10:35
1bcf222 to
6cd7d39
Compare
The bootstrap that used to run in a dedicated recovery Job now happens in-process inside the instance pod before PostgreSQL starts, so the sidecar shipped in that pod must answer the same Restore RPC the operator sends over the plugin sockets. The instance mode now registers the restore job hooks and advertises the restore-job service capability so the operator can reach them. A cluster that only bootstraps from an object store, without continued archiving, previously received no sidecar in its instance pods; the injection condition is widened to match what the plugin configuration already considers valid, so those clusters get the sidecar too. Signed-off-by: Armando Ruocco <armando.ruocco@enterprisedb.com>
Validate() and the instance sidecar injection condition each independently re-encoded "is any of BarmanObjectName, RecoveryBarmanObjectName or ReplicaSourceBarmanObjectName set". The injection condition had already drifted from Validate() once, missing RecoveryBarmanObjectName until this PR added it back. Extract a single HasAnyBarmanObjectStore() method so the two checks can no longer drift apart the same way again. Signed-off-by: Marco Nenciarini <marco.nenciarini@enterprisedb.com>
mnencia
force-pushed
the
dev/instance-restore-hooks
branch
from
July 27, 2026 14:38
6cd7d39 to
4c089ce
Compare
A cluster bootstrapped only via RecoveryBarmanObjectName, with no continuing archiving or replica source, only ever needs the sidecar for its one-time bootstrap restore. Gate its injection on cluster.IsInitialized() so it stops being added once the cluster is up. This makes the operator's own drift-check see the already-running pod's spec as outdated right after initialization completes, and roll it out to drop the sidecar. That is deliberately accepted rather than engineered around: it is one deterministic rollout using the same machinery the operator already uses for every other pod-spec change (a switchover if a replica is available, an in-place restart otherwise), not a new or fragile risk. Signed-off-by: Marco Nenciarini <marco.nenciarini@enterprisedb.com>
mnencia
force-pushed
the
dev/instance-restore-hooks
branch
from
July 27, 2026 18:26
bb0d217 to
e95b91d
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
CloudNativePG is moving the bootstrap of new instances from dedicated Jobs into the instance pod itself (cloudnative-pg/cloudnative-pg#11228): the restore that used to run in a recovery Job now happens in-process inside the instance pod before PostgreSQL starts. The sidecar shipped in that pod must therefore answer the same Restore RPC the operator sends over the plugin sockets, so the instance mode now registers the restore-job hooks and advertises the restore-job service capability.
A cluster that only bootstraps from an object store, without continued archiving, previously received no sidecar at all in its instance pods; under the new flow that leaves the bootstrap without a plugin socket, both for the Restore RPC and for
wal-restoreduring the recovery replay. The injection condition is widened to match what the plugin configuration already considers valid, so recovery-only clusters get the sidecar too.