Protect operator CRDs from accidental deletion via metadata finalizer - #3169
Open
yajo wants to merge 1 commit into
Open
Protect operator CRDs from accidental deletion via metadata finalizer#3169yajo wants to merge 1 commit into
yajo wants to merge 1 commit into
Conversation
A 'kubectl delete crd' is destructive: the API server cascades the delete to every custom resource of that kind in the cluster, so a single mistyped command can wipe out all postgresql, operator configuration, postgresteam and fabriceventstream objects at once. This is especially dangerous for an operator whose whole value proposition is the data behind those CRs. The fix is a 'acid.zalan.do/crd-protection' finalizer on each operator CRD. The apiserver blocks the deletion while the finalizer is set, so the destructive action is gated behind a manual step (patch the finalizer away) that anyone running the delete has to take deliberately. Removal procedure is documented in docs/administrator.md under 'Protecting CRDs from accidental deletion'. Assisted-by: OpenCode + MiniMax M3
yajo
requested review from
FxKu,
Jan-M,
idanovinda,
jopadi and
mikkeloscar
as code owners
August 13, 2026 12:24
Contributor
Author
|
Looks like the CI failure is unrelated to this change. I can see the same failure in other PRs. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem description
A
kubectl delete crdagainst the operator'spostgresqls,operatorconfigurations,postgresteamsorfabriceventstreamsCRD is destructive: the Kubernetes apiserver cascades the delete to every custom resource of that kind in the cluster, so a single mistyped command can wipe out everypostgresql/operatorconfiguration/PostgresTeam/FabricEventStreamobject at once. For an operator whose value proposition is the data behind those CRs, this is a one-command data-loss vector.Background on the failure mode:
The fix is a metadata finalizer (
acid.zalan.do/crd-protection) on each operator CRD. While the finalizer is set, the apiserver keeps the CRD inTerminatinginstead of dropping it, so the cascade to existing CRs never happens. Removing the finalizer is the documented manual step required to delete the CRD.Linked issues
Fixes #3168
Checklist
gofmt).PostgresCRD/OperatorConfigurationCRDinpkg/apis/acid.zalan.do/v1/crds.go) so it survivescontroller-genregeneration; the generated YAML manifests also carry the finalizer forkubectl apply/ Helm installs.charts/postgres-operator/crds/*.yamlandmanifests/*.crd.yamlcarry the finalizer.test_zy_crd_protection_finalizerine2e/tests/test_e2e.pyexercises the full lifecycle (finalizer present, deletion blocked, cascade on unblock) against the most critical CRD and re-creates state in afinallyblock.docs/administrator.mddocuments the protection and the manual removal procedure.Assisted-by: OpenCode + MiniMax M3