mirror of
https://github.com/cozystack/cozystack.git
synced 2026-11-03 18:47:04 +09:00
Myasnikov Daniil
d316cefde4
Since botocore ~1.36 (early 2025) the default RequestChecksumCalculation is when_supported, so barman-cloud's boto3 attaches a flexible checksum to every PutObject. AWS S3 accepts it, but non-AWS S3-compatible backends - Ceph RADOS Gateway, the platform's own SeaweedFS system bucket, some MinIO / Cloudflare R2 builds - reject it with "InvalidArgument: x-amz-content-sha256 must be UNSIGNED-PAYLOAD, ...", which fails every backup and WAL-archive upload. Set AWS_REQUEST_CHECKSUM_CALCULATION=when_required through the CNPG Cluster's spec.env, which reaches the instance pods and therefore the barman-cloud subprocess the instance manager execs. This is a release-1.5-native equivalent of #3417 rather than a cherry-pick of it. That change sets spec.instanceSidecarConfiguration.env on barmancloud.cnpg.io ObjectStore objects, and release-1.5 has no barman-cloud plugin: there is no ObjectStore CRD on the branch and the rendered Cluster carries no spec.plugins, so those objects would template cleanly and then fail to apply, referenced by nothing. release-1.5 still uses CNPG's native in-tree spec.backup.barmanObjectStore, which shells out to the same barman-cloud client, so the bug is reachable here - the plugin is the packaging difference, not the cause. One spec.env covers all three paths on this branch at once: the chart-rendered legacy barmanObjectStore, the same field SSA-patched by the CNPG backup driver in the useSystemBucket flow, and externalClusters recovery. No Go change is needed - the driver's patch type carries only spec.backup and spec.bootstrap, so it cannot express or remove the Helm-owned spec.env. keycloak is out of scope on this branch. Its chart renders a CNPG Cluster but configures no backup at all - no backup key in values, no backup template - so it has no barman-cloud path to fix, and the upstream hunk for it references values that do not exist here. Verified against CNPG 1.27.3: spec.env is accepted by the webhook and stored unmodified, appears in the instance manager's own environment, and botocore inside the instance image then resolves request_checksum_calculation as when_required instead of its when_supported default. Adding the field to an already-running Cluster converges back to healthy after CNPG recreates the instance pod, which is the in-place upgrade path for existing releases with backups enabled. Assisted-By: Claude <noreply@anthropic.com> Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>