Conversation
The MinIO images are no longer maintained. Replace them with RustFS in the e2e harness, in hack/ and in the docs, as cloudnative-pg did in #10865, and name the resources in provider-neutral terms (object-store, s3). The e2e Deployment mirrors core: an init container makes the data and log subdirectories writable for the non-root RustFS user, no fsGroup, glibc image, probes on /health. Credentials are longer because RustFS requires at least 3 characters for the access key and 8 for the secret. hack/minio becomes hack/object-store, keeping the cert-manager TLS setup, and the mc pod becomes an AWS CLI pod. The docs replace the MinIO operator section with a RustFS one; versioned docs are untouched. Verified with task e2e-ephemeral and task e2e-external-kind (all S3 specs green, the skipped ones are the pre-existing GCS specs), and by applying hack/object-store with cert-manager on kind: a plugin backup completed over TLS and the cleanup script emptied the bucket. Closes #624 Signed-off-by: Armando Ruocco <armando.ruocco@enterprisedb.com>
Signed-off-by: Niccolò Fei <niccolo.fei@enterprisedb.com>
gbartolini
reviewed
Sep 22, 2026
gbartolini
reviewed
Sep 22, 2026
gbartolini
reviewed
Sep 22, 2026
Signed-off-by: Niccolò Fei <niccolo.fei@enterprisedb.com>
Signed-off-by: Niccolò Fei <niccolo.fei@enterprisedb.com>
Signed-off-by: Niccolò Fei <niccolo.fei@enterprisedb.com>
Mimic the definition of object-store-deployment.yaml. The PVC is ReadWriteOnce: a rolling update would try to schedule the new pod while the old one still holds it. Signed-off-by: Niccolò Fei <niccolo.fei@enterprisedb.com>
…yment Signed-off-by: Niccolò Fei <niccolo.fei@enterprisedb.com>
Signed-off-by: Niccolò Fei <niccolo.fei@enterprisedb.com>
NiccoloFei
approved these changes
Sep 23, 2026
litaocdl
reviewed
Sep 24, 2026
litaocdl
reviewed
Sep 24, 2026
litaocdl
reviewed
Sep 24, 2026
litaocdl
reviewed
Sep 24, 2026
litaocdl
reviewed
Sep 24, 2026
litaocdl
approved these changes
Sep 24, 2026
mnencia
approved these changes
Sep 24, 2026
Apply Tao's review suggestions. Co-authored-by: Tao Li <tao.li@enterprisedb.com> Signed-off-by: Marco Nenciarini <marco.nenciarini@enterprisedb.com>
Drop all Linux capabilities on the init, object-store and s3-client containers, none of them need any. Add runAsNonRoot to object-store and s3-client; the init container still needs root to chmod the PVC-owned data and log directories. This is a dev/testing deployment, but anyone copying it as a starting point should get a secure default, not a baseline one. Signed-off-by: Marco Nenciarini <marco.nenciarini@enterprisedb.com>
A subPath mount doesn't pick up an updated Secret when cert-manager renews the certificate, so the cached CA would go stale until the pod restarts. The secret's items already remap tls.crt to ca.crt, so mounting the whole volume at /certs keeps AWS_CA_BUNDLE pointing at the same file while staying live-updated. Signed-off-by: Marco Nenciarini <marco.nenciarini@enterprisedb.com>
gbartolini
approved these changes
Sep 24, 2026
NiccoloFei
approved these changes
Sep 24, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The MinIO images are no longer maintained. Replace them with RustFS in the e2e harness, in hack/ and in the docs, as cloudnative-pg did in cloudnative-pg/cloudnative-pg#10865, and name the resources in provider-neutral terms (object-store, s3).
The e2e Deployment mirrors core: an init container makes the data and log subdirectories writable for the non-root RustFS user, no fsGroup, glibc image, probes on /health, containers run with dropped capabilities and non-root where possible. RustFS requires at least 3 characters for the access key and 8 for the secret; the e2e credentials meet that. hack/minio becomes hack/object-store, keeping the cert-manager TLS setup, and the mc pod becomes an AWS CLI Deployment. The docs replace the MinIO operator section with a RustFS one; versioned docs are untouched.
Verified with task e2e-ephemeral and task e2e-external-kind (all S3 specs green, the skipped ones are the pre-existing GCS specs), and by applying hack/object-store with cert-manager on kind: a plugin backup completed over TLS and the cleanup script emptied the bucket.
Closes #624