Address the two blocking findings in PR #3562:
- Restore into a differently-named target now authenticates with the
TARGET cluster's own S3 credentials instead of the source's. The
backupSource carried the source release's -s3-creds Secret, which is
deleted together with the source app — the disaster-recovery case
backups exist for — leaving a to-copy restore unable to reach S3. The
restore replays into the target (gated on backup.enabled just above),
whose own -s3-creds Secret is present and grants access to the same
bucket; only the credential reference is swapped, bucket/prefix/endpoint
still come from the source archive. Falls back to the source reference
when the target declares no discoverable s3 credentials (in-place
restore resolves to the same Secret, so it is a no-op there).
- A non-string recoveryTime (spec.options is free-form runtime.RawExtension,
so {"recoveryTime": 20260805} passes admission) no longer silently
degrades a PITR request to a plain snapshot restore reported Succeeded.
When the typed decode fails and the blob carries a recoveryTime key, the
RestoreJob now fails terminally — the same guarantee pitrSpec already
makes for a malformed RFC3339 string.
Minor findings also addressed:
- BackupJob tolerates a not-yet-present MongoDB app CR with the same
bounded grace the psmdb-CR existence gate uses, instead of failing
terminally on a GitOps single-commit ordering race.
- examples: the to-copy target writes into its OWN S3 prefix
(mongodb-target/) rather than the source's, so the two clusters' oplog
and backup metadata no longer interleave under shared keys (both run
replset rs0).
- examples: wait_psmdb_ready no longer treats a transient state=error as
terminal — the cluster state is recomputed each reconcile and can blip
through error during replset init before converging to ready.
Unit tests cover the target-credential selector (preferred/default/sole
storage) and the load-bearing recoveryTime-key detection.
Signed-off-by: Andrey Kolkov <androndo@gmail.com>
PITR: replace the bespoke spec.options.pitr{type,date} blob with a single
spec.options.recoveryTime RFC3339 string, matching the CNPG strategy's option
exactly (CNPGRestoreOptions.RecoveryTime). The driver converts recoveryTime to
the psmdb Restore's pitr{type:date,date} in the operator's "YYYY-MM-DD HH:MM:SS"
UTC format. An empty recoveryTime restores the snapshot as-taken (documented
difference from CNPG, whose empty value means latest WAL — a psmdb logical
backup is already consistent). A non-RFC3339 recoveryTime fails terminally.
Unknown options: parseMongoDBRestoreOptions now also returns the set of
spec.options keys the driver does not recognise; reconcileMongoDBRestore emits a
UnknownRestoreOption Warning event per unknown key (and logs it) instead of
silently ignoring it — so a "recoverytime" typo no longer silently degrades a
PITR restore to a snapshot restore. (BackupJob carries no spec.options blob, so
there is no backup-path equivalent; the only backup-time input is the free-form
BackupClass parameters used as template vars.)
Docs + examples updated to recoveryTime; tests cover the RFC3339→UTC mapping,
empty/invalid recoveryTime, and unknown-key reporting.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Signed-off-by: Andrey Kolkov <androndo@gmail.com>
Adds a MongoDB (Percona Server for MongoDB / psmdb) backup-strategy driver so
`apps.cozystack.io/MongoDB` reaches feature parity with the CNPG, MariaDB and
ClickHouse native drivers — logical backups, restore-to-differently-named
instances, and point-in-time recovery through the unified
BackupJob/RestoreJob/BackupClass/Plan interface (closes#3545).
The driver orchestrates the operator's PerconaServerMongoDBBackup /
PerconaServerMongoDBRestore CRDs:
- BackupJob: creates a one-shot PerconaServerMongoDBBackup, polls
status.state, and persists the S3 destination + storage descriptor
(by-reference, no credentials) onto the Cozystack Backup artifact.
- RestoreJob: drives PerconaServerMongoDBRestore via backupSource (read back
from the source backup status, snapshot fallback) so the same artifact
restores in-place or into a differently-named instance; PITR via
spec.options.pitr (date/latest).
Because psmdb resolves the backup storage by name against the cluster's
spec.backup.storages, the driver names the chart's storage (s3-storage) via the
cozy-default-mongodb Strategy rather than injecting it, and surfaces a clear
Ready=False precondition when a target has backups disabled.
Wiring:
- api/backups/strategy/v1alpha1: MongoDB strategy type + generated CRD/deepcopy.
- internal/backupcontroller: psmdbstrategy_controller + psmdbtypes/mongodbapp
partial-schema mirrors; dispatch, supported-kinds and scheme registration.
- backupstrategy-controller: cozy-default MongoDB route, cozy-default-mongodb
Strategy CR, and psmdb.percona.com RBAC.
- apps/mongodb: backup.insecureSkipTLSVerify knob (psmdb s3 storage has no
CA-bundle field) so backups can target Cozystack's self-signed seaweedfs.
Tests + e2e:
- unit tests for the driver (validation, ensure-idempotency, precondition,
backupSource resolution, snapshot round-trip, PITR option parsing).
- examples/backups/mongodb + a mongodb-2-backup-roundtrip Chainsaw suite that
drives run-all.sh end-to-end (sentinel document round-trips through S3 into a
restored copy while the source stays untouched), per docs/agents/e2e-testing.md.
- docs/operations/backup-classes.md updated.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Signed-off-by: Andrey Kolkov <androndo@gmail.com>
Andrey Kolkov