Merge branch 'main' into local-build

Author: benjaminjb

.editorconfig

@@ -14,7 +14,7 @@ trim_trailing_whitespace = true
 indent_size = tab
 indent_style = tab
 
-[*.{md,yml,yaml}]
+[*.{jq,md,yml,yaml}]
 indent_size = 2
 indent_style = space
 

.github/actions/trivy/action.yaml

@@ -39,7 +39,7 @@ inputs:
       The value "skip" fetches no Trivy data at all.
 
   setup:
-    default: v0.62.1,cache
+    default: v0.65.0,cache
     description: >-
       How to install Trivy; one or more of version, none, or cache.
       The value "none" does not install Trivy at all.
@@ -84,7 +84,7 @@ runs:
     # Install Trivy as requested.
     # NOTE: `setup-trivy` can download a "latest" version but cannot cache it.
     - if: ${{ ! contains(fromJSON(steps.parsed.outputs.setup), 'none') }}
-      uses: aquasecurity/[email protected].3
+      uses: aquasecurity/[email protected].4
       with:
         cache: ${{ contains(fromJSON(steps.parsed.outputs.setup), 'cache') }}
         version: ${{ steps.parsed.outputs.version }}

.github/workflows/codeql-analysis.yaml

@@ -9,11 +9,6 @@ on:
   schedule:
     - cron: '10 18 * * 2'
 
-env:
-  # Use the Go toolchain installed by setup-go
-  # https://github.com/actions/setup-go/issues/457
-  GOTOOLCHAIN: local
-
 jobs:
   analyze:
     if: ${{ github.repository == 'CrunchyData/postgres-operator' }}
@@ -25,7 +20,7 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@v5
-      - uses: actions/setup-go@v5
+      - uses: actions/setup-go@v6
         with: { go-version: stable }
 
       - name: Initialize CodeQL

.github/workflows/govulncheck.yaml

@@ -10,6 +10,8 @@ on:
 env:
   # Use the Go toolchain installed by setup-go
   # https://github.com/actions/setup-go/issues/457
+  #
+  # TODO(govulncheck): Remove when "golang/govulncheck-action" uses "actions/setup-go" v6 or newer
   GOTOOLCHAIN: local
 
 jobs:

.github/workflows/lint.yaml

@@ -3,11 +3,6 @@ name: Linters
 on:
   pull_request:
 
-env:
-  # Use the Go toolchain installed by setup-go
-  # https://github.com/actions/setup-go/issues/457
-  GOTOOLCHAIN: local
-
 jobs:
   golangci-lint:
     runs-on: ubuntu-24.04
@@ -16,7 +11,7 @@ jobs:
       checks: write
     steps:
       - uses: actions/checkout@v5
-      - uses: actions/setup-go@v5
+      - uses: actions/setup-go@v6
         with: { go-version: stable }
 
       - uses: golangci/golangci-lint-action@v8

.github/workflows/test.yaml

@@ -6,21 +6,16 @@ on:
     branches:
       - main
 
-env:
-  # Use the Go toolchain installed by setup-go
-  # https://github.com/actions/setup-go/issues/457
-  GOTOOLCHAIN: local
-
 jobs:
   go-test:
     runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@v5
-      - uses: actions/setup-go@v5
+      - uses: actions/setup-go@v6
         with: { go-version: stable }
 
       - name: Ensure go.mod is tidy
-        run: go mod tidy && git diff --exit-code -- go.mod
+        run: go mod tidy --diff
       - name: Ensure generated files are committed
         run: make check-generate
       - run: make check
@@ -34,7 +29,7 @@ jobs:
         kubernetes: ['default']
     steps:
       - uses: actions/checkout@v5
-      - uses: actions/setup-go@v5
+      - uses: actions/setup-go@v6
         with: { go-version: stable }
 
       - run: go mod download
@@ -58,20 +53,20 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        kubernetes: [v1.33, v1.28]
+        kubernetes: [v1.30, v1.33]
     steps:
       - uses: actions/checkout@v5
-      - uses: actions/setup-go@v5
+      - uses: actions/setup-go@v6
         with: { go-version: stable }
 
       - name: Start k3s
         uses: ./.github/actions/k3d
         with:
           k3s-channel: "${{ matrix.kubernetes }}"
           prefetch-images: |
-            registry.developers.crunchydata.com/crunchydata/crunchy-pgbackrest:ubi9-2.54.2-2520
-            registry.developers.crunchydata.com/crunchydata/crunchy-pgbouncer:ubi9-1.24-2520
-            registry.developers.crunchydata.com/crunchydata/crunchy-postgres:ubi9-16.9-2520
+            registry.developers.crunchydata.com/crunchydata/crunchy-pgbackrest:ubi9-2.56.0-2534
+            registry.developers.crunchydata.com/crunchydata/crunchy-pgbouncer:ubi9-1.24-2534
+            registry.developers.crunchydata.com/crunchydata/crunchy-postgres:ubi9-16.10-2534
 
       - run: make createnamespaces check-envtest-existing
         env:
@@ -92,26 +87,27 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        kubernetes: [v1.33, v1.28]
+        kubernetes: [v1.30, v1.33]
     steps:
       - uses: actions/checkout@v5
-      - uses: actions/setup-go@v5
+      - uses: actions/setup-go@v6
         with: { go-version: stable }
 
       - name: Start k3s
         uses: ./.github/actions/k3d
         with:
           k3s-channel: "${{ matrix.kubernetes }}"
           prefetch-images: |
-            registry.developers.crunchydata.com/crunchydata/crunchy-pgbackrest:ubi9-2.54.2-2520
-            registry.developers.crunchydata.com/crunchydata/crunchy-pgbouncer:ubi9-1.24-2520
-            registry.developers.crunchydata.com/crunchydata/crunchy-postgres-exporter:ubi9-0.17.1-2520
-            registry.developers.crunchydata.com/crunchydata/crunchy-postgres:ubi9-17.5-2520
-            registry.developers.crunchydata.com/crunchydata/crunchy-postgres:ubi9-16.9-2520
-            registry.developers.crunchydata.com/crunchydata/crunchy-postgres-gis:ubi9-16.9-3.3-2520
-            registry.developers.crunchydata.com/crunchydata/crunchy-postgres-gis:ubi9-16.9-3.4-2520
-            registry.developers.crunchydata.com/crunchydata/crunchy-upgrade:ubi9-17.5-2520
-            registry.developers.crunchydata.com/crunchydata/crunchy-postgres-gis:ubi9-17.5-3.4-2520
+            registry.developers.crunchydata.com/crunchydata/crunchy-pgbackrest:ubi9-2.56.0-2534
+            registry.developers.crunchydata.com/crunchydata/crunchy-pgbouncer:ubi9-1.24-2534
+            registry.developers.crunchydata.com/crunchydata/crunchy-postgres-exporter:ubi9-0.17.1-2534
+            registry.developers.crunchydata.com/crunchydata/crunchy-postgres:ubi9-17.6-2534
+            registry.developers.crunchydata.com/crunchydata/crunchy-postgres:ubi9-16.10-2534
+            registry.developers.crunchydata.com/crunchydata/crunchy-postgres-gis:ubi9-16.10-3.3-2534
+            registry.developers.crunchydata.com/crunchydata/crunchy-postgres-gis:ubi9-16.10-3.4-2534
+            registry.developers.crunchydata.com/crunchydata/crunchy-upgrade:ubi9-17.6-2534
+            registry.developers.crunchydata.com/crunchydata/crunchy-postgres-gis:ubi9-17.6-3.4-2534
+            registry.developers.crunchydata.com/crunchydata/crunchy-postgres-gis:ubi9-17.6-3.5-2534
 
       - name: Get pgMonitor files.
         run: make get-pgmonitor
@@ -131,17 +127,18 @@ jobs:
             --env 'CHECK_FOR_UPGRADES=false' \
             --env 'QUERIES_CONFIG_DIR=/mnt/hack/tools/queries' \
             --env 'KUBECONFIG=hack/.kube/postgres-operator/pgo' \
-            --env 'RELATED_IMAGE_PGBACKREST=registry.developers.crunchydata.com/crunchydata/crunchy-pgbackrest:ubi9-2.54.2-2520' \
-            --env 'RELATED_IMAGE_PGBOUNCER=registry.developers.crunchydata.com/crunchydata/crunchy-pgbouncer:ubi9-1.24-2520' \
-            --env 'RELATED_IMAGE_PGEXPORTER=registry.developers.crunchydata.com/crunchydata/crunchy-postgres-exporter:ubi9-0.17.1-2520' \
-            --env 'RELATED_IMAGE_PGUPGRADE=registry.developers.crunchydata.com/crunchydata/crunchy-upgrade:ubi9-17.5-2520' \
-            --env 'RELATED_IMAGE_POSTGRES_16=registry.developers.crunchydata.com/crunchydata/crunchy-postgres:ubi9-16.9-2520' \
-            --env 'RELATED_IMAGE_POSTGRES_16_GIS_3.3=registry.developers.crunchydata.com/crunchydata/crunchy-postgres-gis:ubi9-16.9-3.3-2520' \
-            --env 'RELATED_IMAGE_POSTGRES_16_GIS_3.4=registry.developers.crunchydata.com/crunchydata/crunchy-postgres-gis:ubi9-16.9-3.4-2520' \
-            --env 'RELATED_IMAGE_POSTGRES_17=registry.developers.crunchydata.com/crunchydata/crunchy-postgres:ubi9-17.5-2520' \
-            --env 'RELATED_IMAGE_POSTGRES_17_GIS_3.4=registry.developers.crunchydata.com/crunchydata/crunchy-postgres-gis:ubi9-17.5-3.4-2520' \
-            --env 'RELATED_IMAGE_STANDALONE_PGADMIN=registry.developers.crunchydata.com/crunchydata/crunchy-pgadmin4:ubi9-9.2-2520' \
-            --env 'RELATED_IMAGE_COLLECTOR=registry.developers.crunchydata.com/crunchydata/postgres-operator:ubi9-5.8.2-0' \
+            --env 'RELATED_IMAGE_PGBACKREST=registry.developers.crunchydata.com/crunchydata/crunchy-pgbackrest:ubi9-2.56.0-2534' \
+            --env 'RELATED_IMAGE_PGBOUNCER=registry.developers.crunchydata.com/crunchydata/crunchy-pgbouncer:ubi9-1.24-2534' \
+            --env 'RELATED_IMAGE_PGEXPORTER=registry.developers.crunchydata.com/crunchydata/crunchy-postgres-exporter:ubi9-0.17.1-2534' \
+            --env 'RELATED_IMAGE_PGUPGRADE=registry.developers.crunchydata.com/crunchydata/crunchy-upgrade:ubi9-17.6-2534' \
+            --env 'RELATED_IMAGE_POSTGRES_16=registry.developers.crunchydata.com/crunchydata/crunchy-postgres:ubi9-16.10-2534' \
+            --env 'RELATED_IMAGE_POSTGRES_16_GIS_3.3=registry.developers.crunchydata.com/crunchydata/crunchy-postgres-gis:ubi9-16.10-3.3-2534' \
+            --env 'RELATED_IMAGE_POSTGRES_16_GIS_3.4=registry.developers.crunchydata.com/crunchydata/crunchy-postgres-gis:ubi9-16.10-3.4-2534' \
+            --env 'RELATED_IMAGE_POSTGRES_17=registry.developers.crunchydata.com/crunchydata/crunchy-postgres:ubi9-17.6-2534' \
+            --env 'RELATED_IMAGE_POSTGRES_17_GIS_3.4=registry.developers.crunchydata.com/crunchydata/crunchy-postgres-gis:ubi9-17.6-3.4-2534' \
+            --env 'RELATED_IMAGE_POSTGRES_17_GIS_3.5=registry.developers.crunchydata.com/crunchydata/crunchy-postgres-gis:ubi9-17.6-3.5-2534' \
+            --env 'RELATED_IMAGE_STANDALONE_PGADMIN=registry.developers.crunchydata.com/crunchydata/crunchy-pgadmin4:ubi9-9.2-2534' \
+            --env 'RELATED_IMAGE_COLLECTOR=registry.developers.crunchydata.com/crunchydata/postgres-operator:ubi9-5.8.3-0' \
             --env 'PGO_FEATURE_GATES=TablespaceVolumes=true,OpenTelemetryLogs=true,OpenTelemetryMetrics=true' \
             --name 'postgres-operator' localhost/postgres-operator
 
@@ -157,7 +154,7 @@ jobs:
           KUTTL_PG_UPGRADE_TO_VERSION: '17'
           KUTTL_PG_VERSION: '16'
           KUTTL_POSTGIS_VERSION: '3.4'
-          KUTTL_PSQL_IMAGE: 'registry.developers.crunchydata.com/crunchydata/crunchy-postgres:ubi9-16.9-2520'
+          KUTTL_PSQL_IMAGE: 'registry.developers.crunchydata.com/crunchydata/crunchy-postgres:ubi9-16.10-2534'
       - run: |
           make check-kuttl && exit
           failed=$?
@@ -175,7 +172,7 @@ jobs:
       - kubernetes-k3d
     steps:
       - uses: actions/checkout@v5
-      - uses: actions/setup-go@v5
+      - uses: actions/setup-go@v6
         with: { go-version: stable }
       - uses: actions/download-artifact@v5
         with: { path: download }

.github/workflows/trivy.yaml

@@ -8,10 +8,6 @@ on:
       - main
 
 env:
-  # Use the Go toolchain installed by setup-go
-  # https://github.com/actions/setup-go/issues/457
-  GOTOOLCHAIN: local
-
   # Use the committed Trivy configuration files.
   TRIVY_IGNOREFILE: .trivyignore.yaml
   TRIVY_SECRET_CONFIG: trivy-secret.yaml
@@ -48,7 +44,7 @@ jobs:
       - uses: actions/checkout@v5
 
       # Trivy needs a populated Go module cache to detect Go module licenses.
-      - uses: actions/setup-go@v5
+      - uses: actions/setup-go@v6
         with: { go-version: stable }
       - run: go mod download
 

.golangci.yaml

@@ -63,6 +63,11 @@ linters:
     - zerologlint
 
   settings:
+    dupword:
+      ignore:
+        # We might see duplicate instances of 'fi' if we end two bash 'if' statements
+        - fi
+
     depguard:
       rules:
         everything:
@@ -85,6 +90,8 @@ linters:
               desc: Should be used only in tests.
             - pkg: testing/*
               desc: The "testing" packages should be used only in tests.
+            - pkg: github.com/crunchydata/postgres-operator/internal/crd/*
+              desc: The "internal/crd" packages should be used only in tests.
             - pkg: github.com/crunchydata/postgres-operator/internal/testing/*
               desc: The "internal/testing" packages should be used only in tests.
             - pkg: k8s.io/client-go/discovery
@@ -111,6 +118,8 @@ linters:
     gomodguard:
       blocked:
         modules:
+          - go.yaml.in/yaml/v2: { recommendations: [sigs.k8s.io/yaml] }
+          - go.yaml.in/yaml/v3: { recommendations: [sigs.k8s.io/yaml] }
           - gopkg.in/yaml.v2: { recommendations: [sigs.k8s.io/yaml] }
           - gopkg.in/yaml.v3: { recommendations: [sigs.k8s.io/yaml] }
           - gotest.tools: { recommendations: [gotest.tools/v3] }

Makefile

@@ -15,6 +15,7 @@ CONTROLLER ?= $(GO) tool sigs.k8s.io/controller-tools/cmd/controller-gen
 # Run tests using the latest tools.
 CHAINSAW ?= $(GO) run github.com/kyverno/chainsaw@latest
 CHAINSAW_TEST ?= $(CHAINSAW) test
+CRD_CHECKER ?= $(GO) run github.com/openshift/crd-schema-checker/cmd/crd-schema-checker@latest
 ENVTEST ?= $(GO) run sigs.k8s.io/controller-runtime/tools/setup-envtest@latest
 KUTTL ?= $(GO) run github.com/kudobuilder/kuttl/cmd/kubectl-kuttl@latest
 KUTTL_TEST ?= $(KUTTL) test
@@ -108,16 +109,15 @@ undeploy: ## Undeploy the PostgreSQL Operator
 
 .PHONY: deploy-dev
 deploy-dev: ## Deploy the PostgreSQL Operator locally
-deploy-dev: PGO_FEATURE_GATES ?= "AllAlpha=true"
 deploy-dev: get-pgmonitor
 deploy-dev: createnamespaces
 	kubectl apply --server-side -k ./config/dev
 	hack/create-kubeconfig.sh postgres-operator pgo
 	env \
-		QUERIES_CONFIG_DIR="${QUERIES_CONFIG_DIR}" \
-		CRUNCHY_DEBUG=true \
-		PGO_FEATURE_GATES="${PGO_FEATURE_GATES}" \
-		CHECK_FOR_UPGRADES='$(if $(CHECK_FOR_UPGRADES),$(CHECK_FOR_UPGRADES),false)' \
+		QUERIES_CONFIG_DIR='$(QUERIES_CONFIG_DIR)' \
+		CRUNCHY_DEBUG="$${CRUNCHY_DEBUG:-true}" \
+		PGO_FEATURE_GATES="$${PGO_FEATURE_GATES:-AllAlpha=true}" \
+		CHECK_FOR_UPGRADES="$${CHECK_FOR_UPGRADES:-false}" \
 		KUBECONFIG=hack/.kube/postgres-operator/pgo \
 		PGO_NAMESPACE='postgres-operator' \
 		PGO_INSTALLER='deploy-dev' \
@@ -134,6 +134,7 @@ deploy-dev: createnamespaces
 
 .PHONY: build
 build: ## Build a postgres-operator image
+build: get-pgmonitor
 	$(BUILDAH) build --tag '$(IMAGE)' \
 		--label org.opencontainers.image.authors='Crunchy Data' \
 		--label org.opencontainers.image.description='Crunchy PostgreSQL Operator' \
@@ -160,6 +161,12 @@ check: ## Run basic go tests with coverage output
 check: get-pgmonitor
 	QUERIES_CONFIG_DIR="$(CURDIR)/${QUERIES_CONFIG_DIR}" $(GO_TEST) -cover ./...
 
+# Informational only; no criteria to enforce at this time.
+.PHONY: check-crd
+check-crd:
+	$(foreach CRD, $(wildcard config/crd/bases/*.yaml), \
+		$(CRD_CHECKER) check-manifests --new-crd-filename '$(CRD)' 2>&1 | awk -f hack/check-manifests.awk $(newline))
+
 # Available versions: curl -s 'https://storage.googleapis.com/kubebuilder-tools/' | grep -o '<Key>[^<]*</Key>'
 # - KUBEBUILDER_ATTACH_CONTROL_PLANE_OUTPUT=true
 .PHONY: check-envtest
@@ -211,22 +218,15 @@ generate-kuttl: export KUTTL_PG_UPGRADE_FROM_VERSION ?= 16
 generate-kuttl: export KUTTL_PG_UPGRADE_TO_VERSION ?= 17
 generate-kuttl: export KUTTL_PG_VERSION ?= 16
 generate-kuttl: export KUTTL_POSTGIS_VERSION ?= 3.4
-generate-kuttl: export KUTTL_PSQL_IMAGE ?= registry.developers.crunchydata.com/crunchydata/crunchy-postgres:ubi9-17.5-2520
+generate-kuttl: export KUTTL_PSQL_IMAGE ?= registry.developers.crunchydata.com/crunchydata/crunchy-postgres:ubi9-17.6-2534
 generate-kuttl: export KUTTL_TEST_DELETE_NAMESPACE ?= kuttl-test-delete-namespace
 generate-kuttl: ## Generate kuttl tests
 	[ ! -d testing/kuttl/e2e-generated ] || rm -r testing/kuttl/e2e-generated
 	bash -ceu ' \
-	case $(KUTTL_PG_VERSION) in \
-	16 ) export KUTTL_BITNAMI_IMAGE_TAG=16.0.0-debian-11-r3 ;; \
-	15 ) export KUTTL_BITNAMI_IMAGE_TAG=15.0.0-debian-11-r4 ;; \
-	14 ) export KUTTL_BITNAMI_IMAGE_TAG=14.5.0-debian-11-r37 ;; \
-	13 ) export KUTTL_BITNAMI_IMAGE_TAG=13.8.0-debian-11-r39 ;; \
-	12 ) export KUTTL_BITNAMI_IMAGE_TAG=12.12.0-debian-11-r40 ;; \
-	esac; \
 	render() { envsubst '"'"' \
 		$$KUTTL_PG_UPGRADE_FROM_VERSION $$KUTTL_PG_UPGRADE_TO_VERSION \
 		$$KUTTL_PG_VERSION $$KUTTL_POSTGIS_VERSION $$KUTTL_PSQL_IMAGE \
-		$$KUTTL_BITNAMI_IMAGE_TAG $$KUTTL_TEST_DELETE_NAMESPACE'"'"'; }; \
+		$$KUTTL_TEST_DELETE_NAMESPACE'"'"'; }; \
 	while [ $$# -gt 0 ]; do \
 		source="$${1}" target="$${1/e2e/e2e-generated}"; \
 		mkdir -p "$${target%/*}"; render < "$${source}" > "$${target}"; \
@@ -252,24 +252,30 @@ generate: generate-rbac
 
 .PHONY: generate-crd
 generate-crd: ## Generate Custom Resource Definitions (CRDs)
-	$(CONTROLLER) \
-		crd:crdVersions='v1' \
-		paths='./pkg/apis/...' \
-		output:dir='config/crd/bases' # {directory}/{group}_{plural}.yaml
+	$(CONTROLLER) $(\
+		) crd paths='./pkg/apis/...' $(\
+		) output:dir='config/crd/bases' # {directory}/{group}_{plural}.yaml
+	$(GO) generate ./internal/crd
 
 .PHONY: generate-collector
 generate-collector: ## Generate OTel Collector files
 	$(GO) generate ./internal/collector
 
 .PHONY: generate-deepcopy
 generate-deepcopy: ## Generate DeepCopy functions
-	$(CONTROLLER) \
-		object:headerFile='hack/boilerplate.go.txt' \
-		paths='./pkg/apis/postgres-operator.crunchydata.com/...'
+	$(CONTROLLER) $(\
+		) object:headerFile='hack/boilerplate.go.txt' $(\
+		) paths='./pkg/apis/postgres-operator.crunchydata.com/...'
 
 .PHONY: generate-rbac
 generate-rbac: ## Generate RBAC
-	$(CONTROLLER) \
-		rbac:roleName='postgres-operator' \
-		paths='./cmd/...' paths='./internal/...' \
-		output:dir='config/rbac' # {directory}/role.yaml
+	$(CONTROLLER) $(\
+		) rbac:roleName='postgres-operator' $(\
+		) paths='./cmd/...' paths='./internal/...' $(\
+		) output:dir='config/rbac' # {directory}/role.yaml
+
+# https://www.gnu.org/software/make/manual/make.html#Multi_002dLine
+define newline
+
+
+endef