From 8cb8b28cd9f9dca23424251a5528400a4f737d5b Mon Sep 17 00:00:00 2001 From: Ruben Hensen Date: Thu, 22 Oct 2026 15:35:18 +0200 Subject: [PATCH] cnpg: prepare for the operator upgrade to 1.30 Pin authentik-postgres to the image CNPG filled in at creation (postgresql:17.4). Later operators default to PostgreSQL 18, and since 1.26 a higher major in the image triggers an offline in-place major upgrade. immich-postgres already pins its pgvecto.rs image. Turn on ENABLE_INSTANCE_MANAGER_INPLACE_UPDATES so the five operator hops (1.25 -> 1.30, one minor at a time as the docs recommend) swap the instance manager inside the running pods instead of restarting both single-instance databases each time. --- apps/templates/cloudnativepg-helm.yaml | 7 ++++++- authentik/postgresql-cluster.yaml | 3 +++ 2 files changed, 9 insertions(+), 1 deletion(-) diff --git a/apps/templates/cloudnativepg-helm.yaml b/apps/templates/cloudnativepg-helm.yaml index a0ad217..8bf1d43 100644 --- a/apps/templates/cloudnativepg-helm.yaml +++ b/apps/templates/cloudnativepg-helm.yaml @@ -13,7 +13,12 @@ spec: targetRevision: 0.23.2 helm: values: | - # Default values are fine + config: + data: + # Swap the instance manager inside running pods on operator + # upgrades instead of restarting them. Both clusters have a + # single instance, so a restart means downtime. + ENABLE_INSTANCE_MANAGER_INPLACE_UPDATES: "true" destination: server: https://kubernetes.default.svc namespace: cnpg-system diff --git a/authentik/postgresql-cluster.yaml b/authentik/postgresql-cluster.yaml index a791cc6..97090a0 100644 --- a/authentik/postgresql-cluster.yaml +++ b/authentik/postgresql-cluster.yaml @@ -4,6 +4,9 @@ metadata: name: authentik-postgres spec: instances: 1 + # Pinned so a new operator default (PostgreSQL 18 since CNPG 1.26.3) can't + # start an in-place major upgrade. CNPG filled this in at creation. + imageName: ghcr.io/cloudnative-pg/postgresql:17.4 primaryUpdateStrategy: unsupervised bootstrap: initdb: