From fb6fdb8e3c199dc8ac962e4f881b8e1c84d6a2de Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Tue, 20 Oct 2026 12:47:56 +0000 Subject: [PATCH 1/3] fix(deps): update module github.com/cloudnative-pg/barman-cloud to v0.7.0 | datasource | package | from | to | | ---------- | -------------------------------------- | ------ | ------ | | go | github.com/cloudnative-pg/barman-cloud | v0.6.0 | v0.7.0 | Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> --- go.mod | 4 ++-- go.sum | 8 ++++---- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/go.mod b/go.mod index 9e349027..f1473462 100644 --- a/go.mod +++ b/go.mod @@ -5,7 +5,7 @@ go 1.26.6 require ( github.com/cert-manager/cert-manager v1.21.2 github.com/cloudnative-pg/api v1.30.0 - github.com/cloudnative-pg/barman-cloud v0.6.0 + github.com/cloudnative-pg/barman-cloud v0.7.0 github.com/cloudnative-pg/cloudnative-pg v1.30.1 github.com/cloudnative-pg/cnpg-i v0.6.0 github.com/cloudnative-pg/cnpg-i-machinery v0.4.2 @@ -113,7 +113,7 @@ require ( golang.org/x/net v0.58.0 // indirect golang.org/x/oauth2 v0.36.0 // indirect golang.org/x/sync v0.22.0 // indirect - golang.org/x/sys v0.48.0 // indirect + golang.org/x/sys v0.49.0 // indirect golang.org/x/term v0.46.0 // indirect golang.org/x/text v0.41.0 // indirect golang.org/x/time v0.15.0 // indirect diff --git a/go.sum b/go.sum index 6bd6e301..1859cd6c 100644 --- a/go.sum +++ b/go.sum @@ -20,8 +20,8 @@ github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UF github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs= github.com/cloudnative-pg/api v1.30.0 h1:L8hnvV/tPEQA1xYEi41FUBFA7FUNVGju8+SlgFlDDjI= github.com/cloudnative-pg/api v1.30.0/go.mod h1:XrKBbOWObL33si0FNuwX4uHNf5JShiZyOUqd6LxbJQo= -github.com/cloudnative-pg/barman-cloud v0.6.0 h1:OtBFmCDyVUAcgFa++FIoCCJwPfd5TtqK3PH6DGPcpkA= -github.com/cloudnative-pg/barman-cloud v0.6.0/go.mod h1:eqSPRGz/s8M0Mea8mkqiVQUTkoSquAhvJF49feh+Ks4= +github.com/cloudnative-pg/barman-cloud v0.7.0 h1:F6U2qNzucaHss4pZbznOZ1ZdVVubRgpCI0iEcuO3IK4= +github.com/cloudnative-pg/barman-cloud v0.7.0/go.mod h1:PVldcjsh/1VCS18Ka7w0dqXEx6tAyXzW+BnuvYLaulY= github.com/cloudnative-pg/cloudnative-pg v1.30.1 h1:d1jxp0jQi7/3zrEhsv9ycD+G5ssmkNvDvTmogaGccCw= github.com/cloudnative-pg/cloudnative-pg v1.30.1/go.mod h1:k931EKEiGsGwHid+Lwo3vt4ZvnmnaIUYS0SJ29Bpivw= github.com/cloudnative-pg/cnpg-i v0.6.0 h1:LA//DLkFOLIjU0ASOpFkydZhGir9IAIDfgSsTTX9IpU= @@ -269,8 +269,8 @@ golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs= golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q= golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek= golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0= -golang.org/x/sys v0.48.0 h1:bbX/i/6MgT9BVLM9RT1thmxL04yeTAhbEz4SyadbXoo= -golang.org/x/sys v0.48.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og= +golang.org/x/sys v0.49.0 h1:XbzkgYJHdqh/8m2Uu0W/dQv8nktxx4BFHp1M0gROTXA= +golang.org/x/sys v0.49.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og= golang.org/x/term v0.46.0 h1:3+OXuTbaKDgwk8jTi3aSLHRlmWqHEUDUtxnbFigO4YE= golang.org/x/term v0.46.0/go.mod h1:+K02xbkittuwc0Am4abfA3Fc+XRGXkvBXNO88NCXPoc= golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8= From a77e3e9fc47f2112e21a61b263ae1bbcc2ba6a54 Mon Sep 17 00:00:00 2001 From: Marco Nenciarini Date: Tue, 20 Oct 2026 16:33:42 +0200 Subject: [PATCH 2/3] chore(deps): regenerate CRD and manifest for barman-cloud v0.7.0 Signed-off-by: Marco Nenciarini --- .../barmancloud.cnpg.io_objectstores.yaml | 37 ++++++++++++++++++- manifest.yaml | 37 ++++++++++++++++++- 2 files changed, 72 insertions(+), 2 deletions(-) diff --git a/config/crd/bases/barmancloud.cnpg.io_objectstores.yaml b/config/crd/bases/barmancloud.cnpg.io_objectstores.yaml index 09de0b90..fe68d871 100644 --- a/config/crd/bases/barmancloud.cnpg.io_objectstores.yaml +++ b/config/crd/bases/barmancloud.cnpg.io_objectstores.yaml @@ -144,12 +144,13 @@ spec: description: |- Compress a backup file (a tar file per tablespace) while streaming it to the object store. Available options are empty string (no - compression, default), `gzip`, `bzip2`, `lz4`, and `snappy`. + compression, default), `gzip`, `bzip2`, `lz4`, `snappy`, and `zstd`. enum: - bzip2 - gzip - lz4 - snappy + - zstd type: string encryption: description: |- @@ -255,6 +256,16 @@ spec: HistoryTags is a list of key value pairs that will be passed to the Barman --history-tags option. type: object + s3AddressingStyle: + description: |- + How bucket names appear in S3 requests: `virtual` (bucket.endpoint/key), + `path` (endpoint/bucket/key) or `auto` (boto3 decides, same as unset). + Requires s3Credentials and Barman 3.18 or later. + enum: + - auto + - virtual + - path + type: string s3Credentials: description: The credentials to use to upload data to S3 properties: @@ -315,6 +326,26 @@ spec: - key - name type: object + sseCustomerKey: + description: |- + Reference to the secret holding the key for Server-Side Encryption with + Customer-provided keys (SSE-C): a base64-encoded 256-bit AES key. + barman-cloud uses it to encrypt the objects it uploads and to read them + back. Meant for S3-compatible providers that only support SSE-C + (e.g. Hetzner Object Storage). Cannot be combined with `encryption`. + Works with any authentication method. Changing the key makes the + existing objects unreadable: use a new `destinationPath` or `serverName`. + properties: + key: + description: The key to select + type: string + name: + description: Name of the referent. + type: string + required: + - key + - name + type: object type: object serverName: description: |- @@ -412,6 +443,10 @@ spec: message: use the 'serverName' plugin parameter in the Cluster resource reason: FieldValueForbidden rule: '!has(self.serverName)' + - fieldPath: .s3AddressingStyle + message: s3AddressingStyle requires s3Credentials + reason: FieldValueForbidden + rule: '!has(self.s3AddressingStyle) || has(self.s3Credentials)' instanceSidecarConfiguration: description: The configuration for the sidecar that runs in the instance pods diff --git a/manifest.yaml b/manifest.yaml index 5ff82310..bc89a459 100644 --- a/manifest.yaml +++ b/manifest.yaml @@ -143,12 +143,13 @@ spec: description: |- Compress a backup file (a tar file per tablespace) while streaming it to the object store. Available options are empty string (no - compression, default), `gzip`, `bzip2`, `lz4`, and `snappy`. + compression, default), `gzip`, `bzip2`, `lz4`, `snappy`, and `zstd`. enum: - bzip2 - gzip - lz4 - snappy + - zstd type: string encryption: description: |- @@ -254,6 +255,16 @@ spec: HistoryTags is a list of key value pairs that will be passed to the Barman --history-tags option. type: object + s3AddressingStyle: + description: |- + How bucket names appear in S3 requests: `virtual` (bucket.endpoint/key), + `path` (endpoint/bucket/key) or `auto` (boto3 decides, same as unset). + Requires s3Credentials and Barman 3.18 or later. + enum: + - auto + - virtual + - path + type: string s3Credentials: description: The credentials to use to upload data to S3 properties: @@ -314,6 +325,26 @@ spec: - key - name type: object + sseCustomerKey: + description: |- + Reference to the secret holding the key for Server-Side Encryption with + Customer-provided keys (SSE-C): a base64-encoded 256-bit AES key. + barman-cloud uses it to encrypt the objects it uploads and to read them + back. Meant for S3-compatible providers that only support SSE-C + (e.g. Hetzner Object Storage). Cannot be combined with `encryption`. + Works with any authentication method. Changing the key makes the + existing objects unreadable: use a new `destinationPath` or `serverName`. + properties: + key: + description: The key to select + type: string + name: + description: Name of the referent. + type: string + required: + - key + - name + type: object type: object serverName: description: |- @@ -411,6 +442,10 @@ spec: message: use the 'serverName' plugin parameter in the Cluster resource reason: FieldValueForbidden rule: '!has(self.serverName)' + - fieldPath: .s3AddressingStyle + message: s3AddressingStyle requires s3Credentials + reason: FieldValueForbidden + rule: '!has(self.s3AddressingStyle) || has(self.s3Credentials)' instanceSidecarConfiguration: description: The configuration for the sidecar that runs in the instance pods From 86c7c903bee67dd1ada77f5dd5b025c4d19a1b12 Mon Sep 17 00:00:00 2001 From: Marco Nenciarini Date: Tue, 20 Oct 2026 18:31:52 +0200 Subject: [PATCH 3/3] chore(deps): silence deprecation lint until #993 lands The end-of-wal-stream API migration is already carried by #993. Suppress the staticcheck deprecation warnings meanwhile. Signed-off-by: Marco Nenciarini --- internal/cnpgi/common/wal.go | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/internal/cnpgi/common/wal.go b/internal/cnpgi/common/wal.go index 4efc6738..3d36c18f 100644 --- a/internal/cnpgi/common/wal.go +++ b/internal/cnpgi/common/wal.go @@ -424,7 +424,7 @@ func (w WALServiceImplementation) restoreFromBarmanObjectStore( contextLogger.Info( "Set end-of-wal-stream flag as one of the WAL files to be prefetched was not found") - err = walRestorer.SetEndOfWALStream() + err = walRestorer.SetEndOfWALStream() //nolint:staticcheck // remove when #993 merges if err != nil { return err } @@ -560,13 +560,13 @@ func gatherWALFilesToRestore(walName string, parallel int) (walList []string, er // checkEndOfWALStreamFlag returns ErrEndOfWALStreamReached if the flag is set in the restorer. func checkEndOfWALStreamFlag(walRestorer *barmanRestorer.WALRestorer) error { - contain, err := walRestorer.IsEndOfWALStream() + contain, err := walRestorer.IsEndOfWALStream() //nolint:staticcheck // remove when #993 merges if err != nil { return err } if contain { - err := walRestorer.ResetEndOfWalStream() + err := walRestorer.ResetEndOfWalStream() //nolint:staticcheck // remove when #993 merges if err != nil { return err } @@ -581,13 +581,13 @@ func checkEndOfWALStreamFlag(walRestorer *barmanRestorer.WALRestorer) error { // restoring on behalf of pg_rewind, which must not abort on a flag it did not // set itself. func clearEndOfWALStreamFlag(walRestorer *barmanRestorer.WALRestorer) error { - contain, err := walRestorer.IsEndOfWALStream() + contain, err := walRestorer.IsEndOfWALStream() //nolint:staticcheck // remove when #993 merges if err != nil { return err } if contain { - return walRestorer.ResetEndOfWalStream() + return walRestorer.ResetEndOfWalStream() //nolint:staticcheck // remove when #993 merges } return nil }