fix: wait for app user secret before starting initdb#8663
Merged
leonardoce merged 4 commits intomainfrom Oct 2, 2025
Merged
Conversation
Contributor
|
❗ By default, the pull request is configured to backport to all release branches.
|
armru
commented
Sep 25, 2025
Member
Author
|
/test limit=local |
Contributor
|
@armru, here's the link to the E2E on CNPG workflow run: https://github.com/cloudnative-pg/cloudnative-pg/actions/runs/18003840131 |
Member
Author
|
/test limit=local |
Contributor
|
@armru, here's the link to the E2E on CNPG workflow run: https://github.com/cloudnative-pg/cloudnative-pg/actions/runs/18012162947 |
b416c6d to
5d37c09
Compare
Member
Author
|
/test limit=local |
Contributor
|
@armru, here's the link to the E2E on CNPG workflow run: https://github.com/cloudnative-pg/cloudnative-pg/actions/runs/18058199848 |
armru
commented
Sep 27, 2025
Comment on lines
+393
to
+404
| job.Spec.Template.Spec.Containers[0].Env = append(job.Spec.Template.Spec.Containers[0].Env, corev1.EnvVar{ | ||
| Name: "APP_USERNAME", | ||
| ValueFrom: &corev1.EnvVarSource{ | ||
| SecretKeyRef: &corev1.SecretKeySelector{ | ||
| LocalObjectReference: corev1.LocalObjectReference{Name: cluster.GetApplicationSecretName()}, | ||
| Key: "username", | ||
| Optional: ptr.To(false), | ||
| }, | ||
| }, | ||
| }) | ||
| } | ||
|
|
Member
Author
There was a problem hiding this comment.
Potentially we could use the container envfrom field to mount the whole secret, but I felt like for what we want to achieve this minimalistic approach that exposes only the username to the job is the best
Member
Author
|
/test limit=local |
Contributor
|
@armru, here's the link to the E2E on CNPG workflow run: https://github.com/cloudnative-pg/cloudnative-pg/actions/runs/18099907008 |
|
do we have any ETA for a release once this is merged? :) this would help us remove a very ugly workaround |
Signed-off-by: Armando Ruocco <armando.ruocco@enterprisedb.com>
Signed-off-by: Armando Ruocco <armando.ruocco@enterprisedb.com>
Signed-off-by: Armando Ruocco <armando.ruocco@enterprisedb.com>
Signed-off-by: Armando Ruocco <armando.ruocco@enterprisedb.com>
leonardoce
approved these changes
Oct 2, 2025
mnencia
approved these changes
Oct 2, 2025
cnpg-bot
pushed a commit
that referenced
this pull request
Oct 2, 2025
This patch ensures that the operator waits for the application user secret to be available before running `initdb`. The change is implemented with minimal impact by adding a reference to the secret in the Pod created by the `initdb` Job. The username is exposed as an environment variable, which is not currently used, but guarantees that the Job cannot start until the secret exists. Closes: #6069 Signed-off-by: Armando Ruocco <armando.ruocco@enterprisedb.com> (cherry picked from commit 9d4ec08)
cnpg-bot
pushed a commit
that referenced
this pull request
Oct 2, 2025
This patch ensures that the operator waits for the application user secret to be available before running `initdb`. The change is implemented with minimal impact by adding a reference to the secret in the Pod created by the `initdb` Job. The username is exposed as an environment variable, which is not currently used, but guarantees that the Job cannot start until the secret exists. Closes: #6069 Signed-off-by: Armando Ruocco <armando.ruocco@enterprisedb.com> (cherry picked from commit 9d4ec08)
cnpg-bot
pushed a commit
that referenced
this pull request
Oct 2, 2025
This patch ensures that the operator waits for the application user secret to be available before running `initdb`. The change is implemented with minimal impact by adding a reference to the secret in the Pod created by the `initdb` Job. The username is exposed as an environment variable, which is not currently used, but guarantees that the Job cannot start until the secret exists. Closes: #6069 Signed-off-by: Armando Ruocco <armando.ruocco@enterprisedb.com> (cherry picked from commit 9d4ec08)
rossigee
pushed a commit
to rossigee/cloudnative-pg
that referenced
this pull request
Oct 2, 2025
…tive-pg#8663) This patch ensures that the operator waits for the application user secret to be available before running `initdb`. The change is implemented with minimal impact by adding a reference to the secret in the Pod created by the `initdb` Job. The username is exposed as an environment variable, which is not currently used, but guarantees that the Job cannot start until the secret exists. Closes: cloudnative-pg#6069 Signed-off-by: Armando Ruocco <armando.ruocco@enterprisedb.com>
|
@armru Will this fix also work for secrets of managed roles? If not should I open a new issue or do we keep the existing issue open for that? |
4 tasks
THE-BRAHMA
pushed a commit
to THE-BRAHMA/cloudnative-pg
that referenced
this pull request
Oct 30, 2025
…tive-pg#8663) This patch ensures that the operator waits for the application user secret to be available before running `initdb`. The change is implemented with minimal impact by adding a reference to the secret in the Pod created by the `initdb` Job. The username is exposed as an environment variable, which is not currently used, but guarantees that the Job cannot start until the secret exists. Closes: cloudnative-pg#6069 Signed-off-by: Armando Ruocco <armando.ruocco@enterprisedb.com> Signed-off-by: theBrahma <office.utpal.brahma@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The scope of this PR is to address #6069 with minimally invasive changes
Closes #6069