From 1a110411b55a59512cc773466b28e46aaa4b9b1d Mon Sep 17 00:00:00 2001 From: aymeric-ld Date: Fri, 14 Aug 2026 17:26:18 +0200 Subject: [PATCH] Suppress autogrow PATCH response bodies Autogrow sidecar scripts patch Pod annotations using curl. Successful Kubernetes PATCH responses include the full Pod JSON, which curl writes to stdout by default. Since these scripts run in containers, that response is collected as sidecar logs and can repeat while volume expansion is pending. Discard successful response bodies while preserving curl error output. Apply the same behavior to Postgres instance and pgBackRest autogrow annotation scripts. Issue: CrunchyData/postgres-operator#4391 --- internal/controller/postgrescluster/instance_test.go | 4 ++-- internal/pgbackrest/config.go | 2 +- internal/pgbackrest/config_test.go | 2 ++ internal/pgbackrest/reconcile_test.go | 6 +++--- internal/postgres/config.go | 2 +- internal/postgres/config_test.go | 2 ++ internal/postgres/reconcile_test.go | 2 +- 7 files changed, 12 insertions(+), 8 deletions(-) diff --git a/internal/controller/postgrescluster/instance_test.go b/internal/controller/postgrescluster/instance_test.go index b14900cf26..ae541321f8 100644 --- a/internal/controller/postgrescluster/instance_test.go +++ b/internal/controller/postgrescluster/instance_test.go @@ -582,7 +582,7 @@ func TestAddPGBackRestToInstancePodSpec(t *testing.T) { fi newSizeMi="${newSize}Mi" d='[{"op": "add", "path": "/metadata/annotations/suggested-'"${volume}"'-pvc-size", "value": "'"${newSizeMi}"'"}]' - curl --cacert "${CACERT}" --header "Authorization: Bearer ${TOKEN}" -XPATCH "${APISERVER}/api/v1/namespaces/${NAMESPACE}/pods/${HOSTNAME}?fieldManager=kubectl-annotate" -H "Content-Type: application/json-patch+json" --data "${d}" + curl --silent --show-error --output /dev/null --cacert "${CACERT}" --header "Authorization: Bearer ${TOKEN}" -XPATCH "${APISERVER}/api/v1/namespaces/${NAMESPACE}/pods/${HOSTNAME}?fieldManager=kubectl-annotate" -H "Content-Type: application/json-patch+json" --data "${d}" fi } @@ -760,7 +760,7 @@ func TestAddPGBackRestToInstancePodSpec(t *testing.T) { fi newSizeMi="${newSize}Mi" d='[{"op": "add", "path": "/metadata/annotations/suggested-'"${volume}"'-pvc-size", "value": "'"${newSizeMi}"'"}]' - curl --cacert "${CACERT}" --header "Authorization: Bearer ${TOKEN}" -XPATCH "${APISERVER}/api/v1/namespaces/${NAMESPACE}/pods/${HOSTNAME}?fieldManager=kubectl-annotate" -H "Content-Type: application/json-patch+json" --data "${d}" + curl --silent --show-error --output /dev/null --cacert "${CACERT}" --header "Authorization: Bearer ${TOKEN}" -XPATCH "${APISERVER}/api/v1/namespaces/${NAMESPACE}/pods/${HOSTNAME}?fieldManager=kubectl-annotate" -H "Content-Type: application/json-patch+json" --data "${d}" fi } diff --git a/internal/pgbackrest/config.go b/internal/pgbackrest/config.go index d34fbaa9e9..e042f692cb 100644 --- a/internal/pgbackrest/config.go +++ b/internal/pgbackrest/config.go @@ -652,7 +652,7 @@ manageAutogrowAnnotation() { fi newSizeMi="${newSize}Mi" d='[{"op": "add", "path": "/metadata/annotations/suggested-'"${volume}"'-pvc-size", "value": "'"${newSizeMi}"'"}]' - curl --cacert "${CACERT}" --header "Authorization: Bearer ${TOKEN}" -XPATCH "${APISERVER}/api/v1/namespaces/${NAMESPACE}/pods/${HOSTNAME}?fieldManager=kubectl-annotate" -H "Content-Type: application/json-patch+json" --data "${d}" + curl --silent --show-error --output /dev/null --cacert "${CACERT}" --header "Authorization: Bearer ${TOKEN}" -XPATCH "${APISERVER}/api/v1/namespaces/${NAMESPACE}/pods/${HOSTNAME}?fieldManager=kubectl-annotate" -H "Content-Type: application/json-patch+json" --data "${d}" fi } diff --git a/internal/pgbackrest/config_test.go b/internal/pgbackrest/config_test.go index b4e5ac2a3a..aa28184573 100644 --- a/internal/pgbackrest/config_test.go +++ b/internal/pgbackrest/config_test.go @@ -729,6 +729,8 @@ func TestReloadCommand(t *testing.T) { assert.Assert(t, cmp.Contains(command[3], "manageAutogrowAnnotation \"repo2\" \"20\" \"2048\"")) assert.Assert(t, cmp.Contains(command[3], "manageAutogrowAnnotation \"repo3\" \"30\" \"3072\"")) assert.Assert(t, cmp.Contains(command[3], "manageAutogrowAnnotation \"repo4\" \"40\" \"4096\"")) + assert.Assert(t, cmp.Contains(command[3], "curl --silent --show-error --output /dev/null"), + "expected successful autogrow annotation responses to be omitted from logs") } diff --git a/internal/pgbackrest/reconcile_test.go b/internal/pgbackrest/reconcile_test.go index 9c3133f304..63f2985dc4 100644 --- a/internal/pgbackrest/reconcile_test.go +++ b/internal/pgbackrest/reconcile_test.go @@ -770,7 +770,7 @@ func TestAddServerToInstancePod(t *testing.T) { fi newSizeMi="${newSize}Mi" d='[{"op": "add", "path": "/metadata/annotations/suggested-'"${volume}"'-pvc-size", "value": "'"${newSizeMi}"'"}]' - curl --cacert "${CACERT}" --header "Authorization: Bearer ${TOKEN}" -XPATCH "${APISERVER}/api/v1/namespaces/${NAMESPACE}/pods/${HOSTNAME}?fieldManager=kubectl-annotate" -H "Content-Type: application/json-patch+json" --data "${d}" + curl --silent --show-error --output /dev/null --cacert "${CACERT}" --header "Authorization: Bearer ${TOKEN}" -XPATCH "${APISERVER}/api/v1/namespaces/${NAMESPACE}/pods/${HOSTNAME}?fieldManager=kubectl-annotate" -H "Content-Type: application/json-patch+json" --data "${d}" fi } @@ -960,7 +960,7 @@ func TestAddServerToInstancePod(t *testing.T) { fi newSizeMi="${newSize}Mi" d='[{"op": "add", "path": "/metadata/annotations/suggested-'"${volume}"'-pvc-size", "value": "'"${newSizeMi}"'"}]' - curl --cacert "${CACERT}" --header "Authorization: Bearer ${TOKEN}" -XPATCH "${APISERVER}/api/v1/namespaces/${NAMESPACE}/pods/${HOSTNAME}?fieldManager=kubectl-annotate" -H "Content-Type: application/json-patch+json" --data "${d}" + curl --silent --show-error --output /dev/null --cacert "${CACERT}" --header "Authorization: Bearer ${TOKEN}" -XPATCH "${APISERVER}/api/v1/namespaces/${NAMESPACE}/pods/${HOSTNAME}?fieldManager=kubectl-annotate" -H "Content-Type: application/json-patch+json" --data "${d}" fi } @@ -1139,7 +1139,7 @@ func TestAddServerToRepoPod(t *testing.T) { fi newSizeMi="${newSize}Mi" d='[{"op": "add", "path": "/metadata/annotations/suggested-'"${volume}"'-pvc-size", "value": "'"${newSizeMi}"'"}]' - curl --cacert "${CACERT}" --header "Authorization: Bearer ${TOKEN}" -XPATCH "${APISERVER}/api/v1/namespaces/${NAMESPACE}/pods/${HOSTNAME}?fieldManager=kubectl-annotate" -H "Content-Type: application/json-patch+json" --data "${d}" + curl --silent --show-error --output /dev/null --cacert "${CACERT}" --header "Authorization: Bearer ${TOKEN}" -XPATCH "${APISERVER}/api/v1/namespaces/${NAMESPACE}/pods/${HOSTNAME}?fieldManager=kubectl-annotate" -H "Content-Type: application/json-patch+json" --data "${d}" fi } diff --git a/internal/postgres/config.go b/internal/postgres/config.go index 55a20b2bce..352c840865 100644 --- a/internal/postgres/config.go +++ b/internal/postgres/config.go @@ -356,7 +356,7 @@ manageAutogrowAnnotation() { fi newSizeMi="${newSize}Mi" d='[{"op": "add", "path": "/metadata/annotations/suggested-'"${volume}"'-pvc-size", "value": "'"${newSizeMi}"'"}]' - curl --cacert "${CACERT}" --header "Authorization: Bearer ${TOKEN}" -XPATCH "${APISERVER}/api/v1/namespaces/${NAMESPACE}/pods/${HOSTNAME}?fieldManager=kubectl-annotate" -H "Content-Type: application/json-patch+json" --data "${d}" + curl --silent --show-error --output /dev/null --cacert "${CACERT}" --header "Authorization: Bearer ${TOKEN}" -XPATCH "${APISERVER}/api/v1/namespaces/${NAMESPACE}/pods/${HOSTNAME}?fieldManager=kubectl-annotate" -H "Content-Type: application/json-patch+json" --data "${d}" fi } diff --git a/internal/postgres/config_test.go b/internal/postgres/config_test.go index 15a9c5a51c..6b1ab90711 100644 --- a/internal/postgres/config_test.go +++ b/internal/postgres/config_test.go @@ -652,5 +652,7 @@ func TestReloadCommand(t *testing.T) { assert.Assert(t, cmp.Contains(command[3], "manageAutogrowAnnotation \"pgdata\" \"10\" \"1024\"")) assert.Assert(t, cmp.Contains(command[3], "manageAutogrowAnnotation \"pgwal\" \"20\" \"2048\"")) + assert.Assert(t, cmp.Contains(command[3], "curl --silent --show-error --output /dev/null"), + "expected successful autogrow annotation responses to be omitted from logs") } diff --git a/internal/postgres/reconcile_test.go b/internal/postgres/reconcile_test.go index 5b678fe94e..bb6de5e2b7 100644 --- a/internal/postgres/reconcile_test.go +++ b/internal/postgres/reconcile_test.go @@ -206,7 +206,7 @@ containers: fi newSizeMi="${newSize}Mi" d='[{"op": "add", "path": "/metadata/annotations/suggested-'"${volume}"'-pvc-size", "value": "'"${newSizeMi}"'"}]' - curl --cacert "${CACERT}" --header "Authorization: Bearer ${TOKEN}" -XPATCH "${APISERVER}/api/v1/namespaces/${NAMESPACE}/pods/${HOSTNAME}?fieldManager=kubectl-annotate" -H "Content-Type: application/json-patch+json" --data "${d}" + curl --silent --show-error --output /dev/null --cacert "${CACERT}" --header "Authorization: Bearer ${TOKEN}" -XPATCH "${APISERVER}/api/v1/namespaces/${NAMESPACE}/pods/${HOSTNAME}?fieldManager=kubectl-annotate" -H "Content-Type: application/json-patch+json" --data "${d}" fi }