feat(plugins): allow plugin defintion

[pha91]

Allow to add plugins to the Cluster definition fixes #634
Prepare migration to the new Barman Cloud Plugin including the ObjectStore.

[eriksjolund]

trailing spaces after memory: 256Mi

[Const-antine]

As far as I can see, the new objectStore.yaml template does not support the spec.retentionPolicy knob. More information on migrating this functionality here.

[pha91]

Added the retentionPolicy to the ObjectStore. Thanks @Const-antine for the reminder

[ChrisTomAlxHitachi]

@itay-grudev Is there anything pending on this PR?

[eriksjolund]

I tried out the PR with such a values file:

type: postgresql

version:
  # -- PostgreSQL major version to use
  postgresql: "16"
  # -- If using TimescaleDB, specify the version
  timescaledb: "2.15"
  # -- If using PostGIS, specify the version
  postgis: "3.4"

mode: standalone

cluster:
  # -- Number of instances
  instances: 3

  storage:
    size: 4Gi
    storageClass: ""

  resources:
    limits:
      cpu: 500m
      memory: 1Gi
    requests:
      cpu: 500m
      memory: 1Gi

  plugins:
     - name: barman-cloud.cloudnative-pg.io
       enabled: true
       isWALArchiver: true
       parameters:
          barmanObjectName: my-postgres-cluster-object-store
          serverName:

backups:
  enabled: true
  endpointURL: "https://s3.example.com"

  destinationPath: "s3://mybucket/testcnpg1"
  provider: s3
  secret:
    # -- Whether to create a secret for the backup credentials
    create: false
    # -- Name of the backup credentials secret
    name: netapp-s3-creds

  scheduledBackups:
    - name: daily-backup
      schedule: "0 2 14 * * *"

  # -- Retention policy for backups
  retentionPolicy: "30d"

It worked. One thing though, I was not able to use

    accessKey: "AWS_ACCESS_KEY_ID"
    secretKey: "AWS_SECRET_ACCESS_KEY"

(but that's not so important).

To make it work I had to use

          barmanObjectName: my-postgres-cluster-object-store

together with

helm upgrade --install -n my-namespace my-postgres -f ~/values.yaml  ./cluster

It seems barmanObjectName should be set to my-postgres + -cluster-object-store

(I used my-postgres as helm release name)

Regarding the software design:

I haven't really thought it through yet, but maybe it would be better to store the S3 configurations under under parameters: together with a name field? Such S3 configurations could then be referenced by name under backup: and under recovery:. Has anyone else been thinking about this too?

[pha91]

Hi @eriksjolund,
just to understand your issue with the accessKey & secretKey:
Where did you set the key?

    accessKey: "AWS_ACCESS_KEY_ID"
    secretKey: "AWS_SECRET_ACCESS_KEY"

As a parameter in the plugin definiton section or in the barmanObjectStore config?
Because I've not changed the behaviour of the barmanObjectStoreConfig function in the template where the keys should be set.

The idea was to use that config in the BarmanObjectStore CRD and reference this object in the plugin like documented here: Defining ObjectStore

[eriksjolund]

I have one configuration that is working fine:

helm  --kubeconfig  ~/Downloads/cluster.yaml upgrade --install  -n testing my-postgres -f ~/values.yaml  ./cluster

The cluster, scheduledbackup and the backup are created just fine.

As a test I wanted to see if there is a way to modify ~/values.yaml so that the names in my secret netapp-s3-creds could be changed from

data:
  ACCESS_KEY_ID: retracted
  ACCESS_SECRET_KEY: retracted

to

data:
  AWS_ACCESS_KEY_ID: retracted
  AWS_SECRET_ACCESS_KEY: retracted

My idea was to add:

 % diff -U6 -u  ~/values.yaml ~/values2.yaml
--- /Users/myuser/values.yaml   2025-11-03 16:58:22
+++ /Users/myuser/values2.yaml  2025-11-24 15:16:12
@@ -37,17 +37,20 @@
 backups:
   enabled: true
   endpointURL: "https://s3.example.com"

   destinationPath: "s3://mybucket/testcnpg"
   provider: s3
+  s3:
+    accessKey: "AWS_ACCESS_KEY_ID"
+    secretKey: "AWS_SECRET_ACCESS_KEY"
   secret:
     # -- Whether to create a secret for the backup credentials
     create: false
     # -- Name of the backup credentials secret
     name: netapp-s3-creds

   scheduledBackups:
     - name: daily-backup
       schedule: "0 2 14 * * *"

   # -- Retention policy for backups

When I tried it out, the backup failed with the error message plugin failed rpc error: code = Unknown desc = missing key ACCESS_KEY_ID, inside secret netapp-s3-creds

For details, see this command

% kubectl  --kubeconfig  ~/Downloads/cluster.yaml get -n testing backup.postgresql.cnpg.io  | grep failed
my-postgres-cluster-daily-backup-20251124141718            6m25s   my-postgres-cluster            plugin   failed      rpc error: code = Unknown desc = missing key ACCESS_KEY_ID, inside secret netapp-s3-creds

(I don't know if it should be possible change the names in the secret)

[pha91]

@itay-grudev do you need any other features or informations to merge this PR?