pal-e-docs

Bug: CNPG webhook drift — kubernetes_manifest provider incompatibility

bug-cnpg-webhook-drift-wal-timeout Doc

bug resolved
Project

Problem

CNPG admission webhook injects 32 default PostgreSQL parameters into the Cluster spec. The Terraform kubernetes_manifest provider does strict drift detection and errors on every tofu apply: "Provider produced inconsistent result after apply — new element has appeared."

Root Cause

Fundamental incompatibility between kubernetes_manifest provider (strict state tracking) and Kubernetes mutating webhooks (modify resources after apply). Known provider limitation, not a CNPG bug.

Fix

Architecture revision: moved Cluster CRD out of Terraform entirely. Platform provides CNPG operator only. App repos define Cluster CRDs, deployed by ArgoCD (tolerates webhook mutations naturally). PRs #14/#15 attempted parameter pinning — rejected as brittle.

Impact

tofu apply failed on every run. ScheduledBackup CRD never applied. Cluster was running but TF state was broken.

Acceptance Criteria

  • Phase 2b removes CRD resources from Terraform
  • Phase 3 deploys Cluster CRD via ArgoCD
  • tofu plan shows 0 changes after cleanup
  • plan-2026-02-26-tf-modularize-postgres — parent plan
  • phase-postgres-2b-cleanup-platform — cleanup phase