Validation: Add computed_fields to CNPG kubernetes_manifest
Verdict: PASS
Ticket
Forgejo issue: forgejo_admin/pal-e-services#69 (PR #70, merged 2026-04-26 as commit 311fe31).
Shipped:
Shipped:
computed_fields = ["spec.postgresql.parameters"] on kubernetes_manifest.cnpg_cluster in terraform/cnpg.tf to silence "Provider produced inconsistent result after apply" errors caused by the CNPG operator's mutating webhook injecting ~20 postgres parameter defaults on every reconciliation.Environment
Local clone:
Cluster: k3s production, namespace
Plan run:
~/pal-e-services on main at 311fe31 (fast-forwarded from forgejo/main).Cluster: k3s production, namespace
postgres.Plan run:
~/pal-e-services/terraform, tofu plan -lock=false -var-file=k3s.tfvars.Checks
| # | Criterion | How Verified | Result | Evidence |
|---|---|---|---|---|
| 1 | Local main fast-forwarded after merge (per <code>feedback_pull_local_after_merge</code>) | <code>git pull forgejo main --ff-only</code> | PASS | Updating 9043a23..311fe31, Fast-forward, terraform/cnpg.tf | 8 ++++++++ |
| 2 | <code>cnpg.tf</code> contains <code>computed_fields = ["spec.postgresql.parameters"]</code> on <code>cnpg_cluster</code> | <code>git show 311fe31 -- terraform/cnpg.tf</code> + grep cnpg.tf | PASS | Diff shows the line added at top of resource block with explanatory comment. |
| 3a | <code>cnpg_cluster</code> plan no longer shows operator-injection drift on the 20 postgres parameter keys (archive_mode, wal_level, log_destination, etc.) | <code>tofu plan -lock=false -var-file=k3s.tfvars</code> & grep for archive_mode/wal_level/log_*/max_*/shared_*/ssl_*/hot_standby | PASS | Zero matches in plan output. Only diff on <code>cnpg_cluster</code>: <code>+ computed_fields = ["spec.postgresql.parameters"]</code> attribute add. Zero "Provider produced inconsistent result" errors. |
| 3b | <code>cnpg_scheduled_backup</code> drift unrelated to operator-injection (dev claim: no computed_fields paths needed for it) | Inspect plan for cnpg_scheduled_backup | PARTIAL — see Discovered Issues | Plan shows full <code>+ manifest = {...}</code> reconciliation. NOT operator-injection drift. Caused by schedule format change in source (<code>"0 0 2 * * *"</code> 6-field) vs state (<code>"0 2 * * *"</code> 5-field). Out of scope for PR #69/#70 but should be tracked. |
| 4 | Cluster healthy, primary pod uptime preserved (no restart from this change) | <code>kubectl get cluster.postgresql.cnpg.io -n postgres pal-e-postgres</code> + pod inspect | PASS | Status: <code>Cluster in healthy state</code> / <code>Cluster is Ready</code>. Pod <code>pal-e-postgres-1</code> AGE 41d, RESTARTS 2 (last 11d ago, predates this PR). |
| 5 | Daily backup still scheduled and running | <code>kubectl get scheduledbackup -n postgres pal-e-postgres-daily</code> + cronjob pod check | PASS | creationTimestamp 2026-03-06, lastScheduleTime 2026-04-26T02:00:00Z (today). <code>cnpg-backup-verify-29619900-7x4vf</code> Completed 2026-04-26T09:00:00Z. |
Regression Check
Tofu plan ran cleanly with exit 0 and zero error messages. Plan summary:
0 to add, 14 to change, 0 to destroy. Of the 14, only cnpg_cluster (computed_fields attr add — this PR) and cnpg_scheduled_backup (pre-existing schedule format drift) touch CNPG. The other 12 are unrelated harbor_creds label removals and one ingress label change — all pre-existing, not introduced by PR #70. Primary postgres pod uptime intact (41 days, 2 restarts last 11d ago). Database accepting connections (cluster Ready). Daily backup ran 2026-04-26 02:00 UTC.Discovered Issues
cnpg_scheduled_backup schedule format mismatch — source
terraform/cnpg.tf line 177 uses 6-field cron "0 0 2 * * *" with comment that CNPG requires the seconds field, but tf state has 5-field "0 2 * * *". This is unrelated to PR #69/#70 (which targets postgresql.parameters drift). The actual ScheduledBackup resource on cluster is running fine (last backup 02:00 UTC today). Likely a state vs source desync from a prior import. Recommend a follow-up Forgejo issue under arch:cnpg / arch:terraform to either (a) reconcile state by applying, or (b) align source to 5-field if that's what CNPG actually accepted at apply time. Does NOT block PR #70 PASS verdict — operator-injection drift is fully silenced as designed.