feat(etcd-operator): bump to v0.5.3 (S3 checksum fix for non-AWS backends) by androndo · Pull Request #3403 · cozystack/cozystack

Andrey Kolkov (androndo) · 2026-07-21T17:12:33Z

What this PR does

Bumps the etcd-operator to v0.5.3, which carries the S3 request-checksum fix (cozystack/etcd-operator#342). git compare v0.5.2...v0.5.3 is exactly #340, #341, #342.

Why: scheduled etcd snapshots to non-AWS S3-compatible backends (Ceph RGW confirmed) fail at upload. Since early 2025 aws-sdk-go-v2 defaults RequestChecksumCalculation to WhenSupported, which stamps a CRC32 on every upload; over HTTPS a multipart part rides it as x-amz-content-sha256: STREAMING-UNSIGNED-PAYLOAD-TRAILER, and RGW rejects it with 400 InvalidArgument. v0.5.3 sets WhenRequired on both the S3 client and the transfer manager, so multipart uploads (>5 MiB — every real etcd snapshot) carry no checksum trailer.

Changes:

system/etcd-operator — appVersion v0.5.2 → v0.5.3 (image tag follows AppVersion; values.yaml keeps tag: ""), bump ETCD_OPERATOR_REF, update deployment unittest expectations.
system/etcd-operator-crds — re-vendor CRDs from v0.5.3. etcdmembers gains the additive fix Kamaji OOM #340 status.version field + Running printer column and picks up the peerAutoTLS spec field the vendored copy was already missing (all additive, backward-compatible; etcdclusters/etcdsnapshots unchanged). Fixes the stale make update (upstream has no config/crd kustomization — CRDs live in charts/etcd-operator/crd-bases) and makes it fail loudly on a fetch error (temp file under set -e, not a pipe).

Verification: helm unittest 18/18 and helm template green on both packages; regenerated CRDs are byte-identical to upstream crd-bases at v0.5.3. End-to-end on a live Ceph RGW backend (freedom-portal-stage): the v0.5.2 (client-only) agent fails a multipart snapshot upload with the 400; v0.5.3 uploads an 11 MiB multipart snapshot successfully, and the operator-driven CronJob→EtcdSnapshot path reaches Complete.

Downstream repositories

Walked the trigger map in docs/agents/contributing.md file-by-file against the diff (packages/system/etcd-operator{,-crds}/** only — a component version bump + additive CRD re-vendor). Nothing matches: not an apps//extra/ package add/rename/remove, no core/platform values, no variant/bundle, no platform component add/remove, no hack/ layout or shared-tooling change, and the provider does not type the etcd-operator.cozystack.io CRDs (and the change is additive/opaque regardless).

Release note

fix(etcd-operator): bump to v0.5.3 — etcd snapshot uploads to non-AWS S3-compatible backends (Ceph RGW, some MinIO/R2) no longer fail with `400 InvalidArgument: x-amz-content-sha256 ...`; the snapshot agent now requests a checksum only when required, on both the S3 client and the multipart transfer manager. Also brings observed EtcdMember versions (#340) and `--watch-namespace` (#341).

Summary by CodeRabbit

New Features
- Added runtime etcd version visibility to EtcdMember (including a “Running” status column).
- Added peerAutoTLS support to EtcdMember for operator-managed peer TLS behavior.
Updates
- Updated the etcd-operator to version 0.5.3.
- Refreshed bundled CRDs and ensured CRDs are preserved during Helm lifecycle operations.
Tests
- Updated deployment test expectations to use the 0.5.3 operator image.

…ends) v0.5.3 carries the S3 request-checksum fix (cozystack/etcd-operator#342): the snapshot agent sets RequestChecksumCalculation=WhenRequired on BOTH the S3 client and the transfer manager, so multipart snapshot uploads (>5 MiB — every real etcd snapshot) no longer carry the CRC32 STREAMING-UNSIGNED-PAYLOAD-TRAILER that Ceph RGW rejects with 400 InvalidArgument. Also pulls in #340 (observed EtcdMember versions) and #341 (--watch-namespace). - system/etcd-operator: appVersion v0.5.2 -> v0.5.3 (image tag follows AppVersion), bump ETCD_OPERATOR_REF, update deployment unittest expectations. - system/etcd-operator-crds: re-vendor CRDs from v0.5.3. etcdmembers gains the additive #340 status.version field + "Running" printer column and picks up the peerAutoTLS spec field the vendored copy was already missing (all additive, backward-compatible; etcdclusters/etcdsnapshots unchanged). Fix the stale `make update`: upstream has no config/crd kustomization — CRDs live in charts/etcd-operator/crd-bases — so vendor those directly and stamp helm.sh/resource-policy: keep. Verified end-to-end on a Ceph RGW backend: the v0.5.2 (client-only) agent fails a multipart snapshot upload with the 400 above; v0.5.3 uploads an 11 MiB multipart snapshot successfully. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Signed-off-by: Andrey Kolkov <andrey.kolkov@aenix.io>

coderabbitai · 2026-07-21T17:12:42Z

📝 Walkthrough

Walkthrough

The etcd-operator references are updated from v0.5.2 to v0.5.3. CRDs are vendored from upstream chart sources, the EtcdMember schema gains TLS and runtime version fields, and chart deployment tests expect the new image tag.

Changes

etcd-operator v0.5.3 update

Layer / File(s)	Summary
CRD vendoring and schema update `packages/system/etcd-operator-crds/Makefile`, `packages/system/etcd-operator-crds/templates/etcdmembers.yaml`	CRDs are fetched from upstream v0.5.3 chart sources, retain the Helm resource policy, and add `peerAutoTLS`, `status.version`, and the `Running` printer column to `EtcdMember`.
Release metadata and deployment expectations `packages/system/etcd-operator/Makefile`, `packages/system/etcd-operator/Chart.yaml`, `packages/system/etcd-operator/tests/deployment_test.yaml`	The operator reference, chart app version, manager image, and `OPERATOR_IMAGE` expectation are updated to v0.5.3.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested reviewers: kvaps, lllamnyp, sircthulhu, lexfrei, myasnikovdaniil

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main change: bumping etcd-operator to v0.5.3 for the S3 checksum fix.

✨ Finishing Touches

📝 Generate docstrings

Create stacked PR
Commit on current branch

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch fix/etcd-operator-v0.5.3

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

gemini-code-assist · 2026-07-21T17:52:47Z

Caution

The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased.

coderabbitai

🧹 Nitpick comments (1)

packages/system/etcd-operator-crds/Makefile (1)
17-21: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Fail the build if the CRD download fails.

In the shell for loop, if curl fails (e.g., due to a 404 or network error), the pipeline might continue and write an empty or incomplete file. Append || exit 1 to ensure the make update target fails immediately on error.
🛠️ Proposed fix to ensure fast failure
 	`@for` c in $(CRDS); do \
 	  curl -fsSL "https://raw.githubusercontent.com/cozystack/etcd-operator/$(ETCD_OPERATOR_REF)/charts/etcd-operator/crd-bases/etcd-operator.cozystack.io_$$c.yaml" \
 	    | awk '/^    controller-gen.kubebuilder.io\/version:/{print; print "    helm.sh/resource-policy: keep"; next} {print}' \
-	    > templates/$$c.yaml; \
+	    > templates/$$c.yaml || exit 1; \
 	done
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@packages/system/etcd-operator-crds/Makefile` around lines 17 - 21, Update the
CRD download loop in the Makefile’s update target so a failed curl command
immediately exits with a nonzero status, preventing awk from writing an empty or
incomplete template and ensuring make reports the failure.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@packages/system/etcd-operator-crds/Makefile`:
- Around line 17-21: Update the CRD download loop in the Makefile’s update
target so a failed curl command immediately exits with a nonzero status,
preventing awk from writing an empty or incomplete template and ensuring make
reports the failure.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 4de409eb-a339-4911-a6e8-41237ecd8528

📥 Commits

Reviewing files that changed from the base of the PR and between aef9e20 and c13a102.

📒 Files selected for processing (5)

packages/system/etcd-operator-crds/Makefile
packages/system/etcd-operator-crds/templates/etcdmembers.yaml
packages/system/etcd-operator/Chart.yaml
packages/system/etcd-operator/Makefile
packages/system/etcd-operator/tests/deployment_test.yaml

IvanHunters

LGTM with non-blocking notes

The bump is mechanically correct and confirmed end-to-end. git compare v0.5.2...v0.5.3 contains exactly #340, #341, #342 and nothing else; the S3
checksum fix from #342 (S3 RequestChecksumCalculation=WhenRequired plus the
TestUploadS3StreamMultipartNoChecksumTrailer regression test) is really in the
release. No tag/digest desync: the etcd-operator image resolves from
Chart.yaml appVersion: v0.5.3 (values.yaml keeps tag: ""), and the only
sha256: pin in values.yaml belongs to the unrelated hook image. The vendored
CRD changes are byte-identical to upstream crd-bases at v0.5.3, and the PR
incidentally fixes a pre-existing vendoring drift (peerAutoTLS). No
CRITICAL/MAJOR.

MINOR

packages/system/etcd-operator-crds/Makefile:17-21 — curl … | awk … > file does not detect a curl failure. The pipe's exit code comes from the
last stage (awk), not curl, and neither the Makefile nor hack/package.mk
sets pipefail. On a future bump, a 404 / network error / upstream path
rename would silently write an empty or truncated CRD template while
make update still returns success. Reproduced directly: pointing the recipe
at a non-existent path returned a 404 on stderr, a 0-byte file, and exit 0. No
impact on this PR (the regenerated output is byte-identical to what is
committed). Fix: add set -e -o pipefail; before the loop, or || exit 1 at
the end.
PR body is missing the release-note block and the downstream-repositories
checklist required by .github/pull_request_template.md:49-57. Release-note
tooling cannot extract anything, and there is no record that downstream impact
(e.g. versions in cozystack/website) was checked.

Review of #3403 noted the `curl … | awk > file` recipe swallowed curl failures: the pipe's exit status is awk's, and neither the Makefile nor hack/package.mk sets pipefail, so a 404 / network error / upstream path rename on a future bump would write an empty/truncated CRD template and still exit 0. Fetch to a temp file under `set -e` (curl -f already exits non-zero on HTTP error), then awk from it — shell-agnostic (no pipefail, which dash lacks). Verified: the regenerated templates are byte-identical to the committed ones, and a bad ref now exits non-zero leaving no template files instead of silently writing empties. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Signed-off-by: Andrey Kolkov <andrey.kolkov@aenix.io>

IvanHunters

Reviewed as a vendored first-party bump. LGTM.

CRD changes are strictly additive and backward-compatible: etcdmembers stays on a single served+storage version (v1alpha2), only optional fields (spec...peerAutoTLS, status.version) and a printer column were added, so existing stored objects remain valid and no conversion/migration is needed.
No RBAC drift: diffing the upstream chart templates/rbac.yaml between v0.5.2 and v0.5.3 shows them byte-for-byte identical.
Vendored CRDs match upstream v0.5.3 byte-for-byte (modulo the injected helm.sh/resource-policy: keep, which also protects them from GC on uninstall).
Changelog v0.5.2..v0.5.3 is exactly observed-versions, optional --watch-namespace (not set by the chart), and the S3 checksum fix. No hidden breaking changes.
helm unittest passes (18/18); the rewritten make update target is a real improvement (fail-loud via set -e + temp file instead of a silent pipe).

Non-blocking: the S3 fix behaviour on non-AWS backends can't be validated by static review (covered by the author's e2e run + upstream tests). The unittest asserts a literal image tag, which would break if the release process ever rewrites first-party tags to vX.Y.Z@sha256:... (pre-existing, not introduced here).

github-actions Bot added area/uncategorized PR auto-labeler could not map title scope to a known area/*; please review kind/feature Categorizes issue or PR as related to a new feature size/M This PR changes 30-99 lines, ignoring generated files labels Jul 21, 2026

Andrey Kolkov (androndo) marked this pull request as ready for review July 21, 2026 17:52

Andrey Kolkov (androndo) requested review from IvanHunters, Andrei Kvapil (kvaps), Aleksei Sviridkin (lexfrei), Timofei Larkin (lllamnyp), myasnikovdaniil and Kirill Ilin (sircthulhu) as code owners July 21, 2026 17:52

coderabbitai Bot reviewed Jul 21, 2026

View reviewed changes

dosubot Bot added the area/database Issues or PRs related to managed databases (postgres, mariadb, redis, etcd, kafka, clickhouse) label Jul 21, 2026

IvanHunters reviewed Jul 21, 2026

View reviewed changes

IvanHunters approved these changes Jul 22, 2026

View reviewed changes

Andrey Kolkov (androndo) merged commit efa4e41 into main Jul 22, 2026
16 checks passed

Andrey Kolkov (androndo) deleted the fix/etcd-operator-v0.5.3 branch July 22, 2026 08:54

Navigation Menu

Uh oh!

feat(etcd-operator): bump to v0.5.3 (S3 checksum fix for non-AWS backends) - #3403

feat(etcd-operator): bump to v0.5.3 (S3 checksum fix for non-AWS backends)#3403
Andrey Kolkov (androndo) merged 2 commits into
mainfrom
fix/etcd-operator-v0.5.3

Andrey Kolkov (androndo) commented Jul 21, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Jul 21, 2026 •

edited

Loading

Walkthrough

Changes

Uh oh!

gemini-code-assist Bot commented Jul 21, 2026

Uh oh!

coderabbitai Bot left a comment

Uh oh!

IvanHunters left a comment

Uh oh!

IvanHunters left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

Andrey Kolkov (androndo) commented Jul 21, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What this PR does

Downstream repositories

Release note

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Jul 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Uh oh!

gemini-code-assist Bot commented Jul 21, 2026

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

IvanHunters left a comment

Choose a reason for hiding this comment

LGTM with non-blocking notes

MINOR

Uh oh!

IvanHunters left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Andrey Kolkov (androndo) commented Jul 21, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Jul 21, 2026 •

edited

Loading