From 8eae7cd85e19ace4cdb2d25813d69ecb1c80e7b7 Mon Sep 17 00:00:00 2001 From: Konstantin Renner Date: Mon, 20 Apr 2026 23:03:31 +0200 Subject: [PATCH] fix(cnpg): Wire explicit region to barman-cloud ObjectStore Garage rejects HeadBucket calls with 400 Bad Request when boto3 sends them without a signed region, which makes CNPG's bootstrap.recovery fail at the barman-cloud-check-wal-archive step. Add REGION=garage to the barman-cloud-creds Secret and reference it from the ObjectStore's s3Credentials.region so barman-cloud-* invocations sign with the correct region. Co-Authored-By: Claude Opus 4.7 (1M context) --- kubernetes/apps/authentik-db/barman-creds.sops.yaml | 5 +++-- kubernetes/apps/authentik-db/objectstore.yaml | 6 ++++++ kubernetes/apps/paperless-db/barman-creds.sops.yaml | 5 +++-- kubernetes/apps/paperless-db/objectstore.yaml | 3 +++ 4 files changed, 15 insertions(+), 4 deletions(-) diff --git a/kubernetes/apps/authentik-db/barman-creds.sops.yaml b/kubernetes/apps/authentik-db/barman-creds.sops.yaml index 09b27d1c..1aada95f 100644 --- a/kubernetes/apps/authentik-db/barman-creds.sops.yaml +++ b/kubernetes/apps/authentik-db/barman-creds.sops.yaml @@ -7,6 +7,7 @@ type: Opaque stringData: ACCESS_KEY_ID: ENC[AES256_GCM,data:SjcYDpvy5SVXK/4/EGzIb5UjEqZTZ5sYB0E=,iv:mFfBZmdEi+Yj4HqMhZZ7NSS1dHwniYZKocJYElw00uw=,tag:4scsORHe7NAgbbg2fA2kNA==,type:str] ACCESS_SECRET_KEY: ENC[AES256_GCM,data:095NGZvte1IA7E1dOmOxq9zzRbIXr3gR7c5ousfoo4+LH7kmu+Ea8HM89FaJ/HuPnM5R79D7kHi8d8HY1KPeuA==,iv:vN+Y2Ei6RflaXz04knl9kF4HYv0sN7DyUafgbO7lFd0=,tag:+VvivaaVxEubcyczED1yrw==,type:str] + REGION: ENC[AES256_GCM,data:RZXJfMo4,iv:ZQ68sunCV3103rjoYN2YhPBUNb2knJSFy10y73hv8po=,tag:SBK4KFoZEYSkGkbkIHwapA==,type:str] sops: age: - recipient: age1yqjvqkwwwxdj7mr546zfs5ckzuwndp69ya2n2drd4vypwns8w4ys04qfy3 @@ -18,7 +19,7 @@ sops: TW1aNW9kbWlCd1E0Mk5TL2VUdXhNc3MK7dx8WmafY6o6AArqkadsW8FpTTmjIMkd ztPsFiFl0bHbgrpK6F2o0vDKd0RHhMkDGf8iFlpAAcmMJJBAjhw35A== -----END AGE ENCRYPTED FILE----- - lastmodified: "2026-04-20T13:25:00Z" - mac: ENC[AES256_GCM,data:i6qGXbSlaWRZ9zYFZeKORvdGmfxXBMJuQ3+6/Lp5REEn0XXMfIqZLyvJryipOtgkyOrnId9HjeR9Fh0QeVxO95tbQPcKAMbYWsj49uhQ23VaLyt6CUIc9HOKLqF2EFp+OHVNNJTx5tm4Us4nIPcKlP3lV5rO1tlnFOypNNvbuKE=,iv:iG3WaCvqqWSdTkPghGgcfl6ZcJtJoY7u2pYUbFR+iA8=,tag:JYaOBE+6+MZCoHNdE0kLEg==,type:str] + lastmodified: "2026-04-20T21:02:22Z" + mac: ENC[AES256_GCM,data:28S0BF/0Ixap+H6rV0FIWGVBfgqqJWNbmsDXi6a9g1CiNLK4tOdW/ACeohLqJrkWQKGZzPEwCtbl3FCk6z+t8s9ZwBjeGmh5E8eQnjfss+AEZTeLE1Xij9lI8kL0S+RXV3uMLiFU/ks3BmFziZBErj/MUyXnDNhw0n1VpRODcC4=,iv:1shlhwzkkF4E1JVQpLBzw8kAUk4RfGpbnvGufh5TDD4=,tag:uT8J+MXCXhU6MFhgqTDJKQ==,type:str] encrypted_regex: ^(data|stringData)$ version: 3.10.2 diff --git a/kubernetes/apps/authentik-db/objectstore.yaml b/kubernetes/apps/authentik-db/objectstore.yaml index 7d56c937..4e4150c9 100644 --- a/kubernetes/apps/authentik-db/objectstore.yaml +++ b/kubernetes/apps/authentik-db/objectstore.yaml @@ -15,6 +15,12 @@ spec: secretAccessKey: name: barman-cloud-creds key: ACCESS_SECRET_KEY + # Garage requires an explicit region — without it boto3's + # HeadBucket call (used by barman-cloud-check-wal-archive during + # CNPG bootstrap.recovery) returns 400 Bad Request. + region: + name: barman-cloud-creds + key: REGION wal: compression: gzip encryption: AES256 diff --git a/kubernetes/apps/paperless-db/barman-creds.sops.yaml b/kubernetes/apps/paperless-db/barman-creds.sops.yaml index 15efe9e1..caa5feef 100644 --- a/kubernetes/apps/paperless-db/barman-creds.sops.yaml +++ b/kubernetes/apps/paperless-db/barman-creds.sops.yaml @@ -7,6 +7,7 @@ type: Opaque stringData: ACCESS_KEY_ID: ENC[AES256_GCM,data:jPZ9fJV6J2sDNH40BrYZMFE9oUlmX9wwg1c=,iv:Y+jA6JQZCWjQzo5QJVyMcty0em4HGARxMO0rrP5URBw=,tag:2nJa8QKjvjLxgeKWnJtUDw==,type:str] ACCESS_SECRET_KEY: ENC[AES256_GCM,data:Z6+mX2hCcgeOKVqjgYHI4RGKtuERk+AMMBVjmolVCgcR6xG0ealciGmJYnSSR5OGaVPd9lTnbNc80JA+2cHqDw==,iv:+TlWd9v93SyDiMWTqyW51Hf+2kBai/Xw9Ry0WFufmzE=,tag:GEnPofL/n/NFeA7Y8CkJsw==,type:str] + REGION: ENC[AES256_GCM,data:eOE9Xhip,iv:pjp801ZzDxQSP3Md7ksPb7rL9BeMq70Rrv17a0Bc3wM=,tag:PbyYzkqkqP1FI04r3O6wRg==,type:str] sops: age: - recipient: age1yqjvqkwwwxdj7mr546zfs5ckzuwndp69ya2n2drd4vypwns8w4ys04qfy3 @@ -18,7 +19,7 @@ sops: NnZma2FKWkVyb0lBaXJNcmZacC81eDgKs7TeS9QBlziLPf0z5mG8DlasAHwPZpeZ TOugJ8njqn6wD4zAsxonc161PFLPPWCQfOX4DfrV4q6GsABD1crrGw== -----END AGE ENCRYPTED FILE----- - lastmodified: "2026-04-20T13:25:00Z" - mac: ENC[AES256_GCM,data:RUZTBNWyal+APtw8gdBLuGPUDTx104x5DQ5imNKx+vCCxHNIsdhreHxRIMtgPeCyoQD5Swp8NBXP1iw0Bd/K8cPDSR1FO1757Uxtcus/149WUFcliK13MxwvSD6c3KKrsGPH8ucZeKm7J609Vt1GhygEQwgsVkPv8NYjfuelukI=,iv:AlnL3oTJZDeG+d3xNbaI+SHBGBK+z0WVfXYg0+6PCrI=,tag:1qTOnqZvhqHXPjzS6kfooA==,type:str] + lastmodified: "2026-04-20T21:02:22Z" + mac: ENC[AES256_GCM,data:X4pyYg/6wweFUx3HBUjJKk4Hl6OT+h7Q4xt1LL6Le72oXh84vPfS/o6W6Nl5ZYv1OAE3cE9L1P+jdP4BS6lDh3RdOsYoBQTq85j2ejukTSSYcIE7SdBPddkkZp9hHPZYMRTrYOFmyNQStN75rYw5FpEd2kOs9RSCN1NRxXrbzYQ=,iv:YGoopg8hEb5bMo9zMJkA11uR36mOeXnQQraLCcNlgzc=,tag:D7oMNHsokuoPc9kd1C2qwg==,type:str] encrypted_regex: ^(data|stringData)$ version: 3.10.2 diff --git a/kubernetes/apps/paperless-db/objectstore.yaml b/kubernetes/apps/paperless-db/objectstore.yaml index 5a10f591..b41b732e 100644 --- a/kubernetes/apps/paperless-db/objectstore.yaml +++ b/kubernetes/apps/paperless-db/objectstore.yaml @@ -15,6 +15,9 @@ spec: secretAccessKey: name: barman-cloud-creds key: ACCESS_SECRET_KEY + region: + name: barman-cloud-creds + key: REGION wal: compression: gzip encryption: AES256