fix(postgresql): restore cnpg-backup credentials to bucket-owner user#71
Open
TheMeinerLP wants to merge 1 commit into
Open
fix(postgresql): restore cnpg-backup credentials to bucket-owner user#71TheMeinerLP wants to merge 1 commit into
TheMeinerLP wants to merge 1 commit into
Conversation
The 2026-07-14 provisioner fix caused every long-pending ObjectBucketClaim to bind and hijack ownership of its already-populated bucket from the app's own CephObjectStoreUser to a freshly minted obc-<ns>-<name>-<uuid> ghost user (see docs/buckets.md). 13 of 15 real buckets were affected; bucket ownership has now been re-linked back to each app's static user via radosgw-admin. feather-core-cluster-pg-backup was a special case: an earlier session had already worked around the AccessDenied by repointing cnpg-backup's SOPS secret at the ghost owner's own key pair (3d44843), which was correct at the time but is now stale now that ownership points back at postgresql-cluster-backup. Switch the secret back to that static user's key pair so credentials and bucket ownership agree again. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
619fde4) let every long-pendingObjectBucketClaimfinally bind on 2026-07-14 — and each one hijacked ownership of its already-populated bucket from the app's ownCephObjectStoreUserto a freshly mintedobc-<ns>-<name>-<uuid>ghost user. 13 of 15 real buckets were affected (discovered viaAccessDeniedExceptions in Tempo traces from an external Minecraft server's BlueMap plugin). Ownership has already been re-linked back to each app's static user live viaradosgw-admin bucket link(out-of-band, not part of this diff — RGW admin state, not something git tracks).feather-core-cluster-pg-backup(CNPG WAL archiving) was a special case: an earlier session (3d44843) had already worked around the same symptom by repointingcnpg-backup's SOPS secret at the ghost owner's own key pair — correct at the time, but now stale since bucket ownership points back atpostgresql-cluster-backup. This PR switches the secret back to that static user's key pair so credentials and bucket ownership agree again.docs/buckets.md, including the "two mutually exclusive fixes" trap this PR itself had to resolve, so it doesn't happen again.Test plan
radosgw-admin bucket statsthat all 15 affected buckets are now owned by their correct staticCephObjectStoreUser.Survival-1/BlueMap'sAccessDeniedExceptions stopped after the relink and a previously-failing PUT succeeded.sops -dthats3-backup.envnow decrypts to thepostgresql-cluster-backupuser's access key.flux reconcile kustomization configs --with-sourcepicks up the new secret and CNPG'splugin-barman-cloudcontainer stops loggingAccessDenied(currently still failing onmainsince the secret isn't live yet).🤖 Generated with Claude Code