fix(postgres-operator): align CNPG operator and CRDs to 1.28.2 for PVC resize-deadlock fix - #3510

🩺 Stability & Availability | 🟠 Major | ⚡ Quick win

Keep the fixed webhook Service contract visible.

packages/system/postgres-operator/templates/webhook-ready-hook.yaml:17-26 still uses the fixed webhook Service contract. This table now presents service.name without the previous warning. If a user changes service.name, the readiness hook can target a different Service and the install or upgrade can fail. Restore the non-configurable warning, or stop presenting this value as a supported override.

As per coding guidelines, files under packages/**/charts/** are vendored upstream files and must remain verbatim; apply this documentation fix in the generator, upstream source, or repository-owned wrapper documentation.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@packages/system/postgres-operator/charts/cloudnative-pg/README.md` at line
163, Restore the documentation warning that the webhook Service name is fixed,
or remove service.name from the supported configuration table; update the
generator, upstream source, or repository-owned wrapper documentation rather
than the vendored chart file, and keep the readiness hook’s fixed Service
contract accurately represented.

Source: Coding guidelines

📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win

Refresh the appVersion reference in the parent values comment.

This target now pulls chart 0.28.3, whose appVersion is 1.29.1. However, packages/system/postgres-operator/values.yaml:1-10 still says that the chart appVersion is 1.28.1. Update that comment so it documents the actual image and CRD synchronization contract.

-  # Image tag intentionally left to the chart's appVersion (1.28.1). Do NOT pin
+  # Image tag intentionally left to the chart's appVersion (1.29.1). Do NOT pin

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@packages/system/postgres-operator/Makefile` at line 13, Update the appVersion
reference comment in values.yaml to 1.29.1, matching the CloudNativePG chart
version pulled by the Makefile target and documenting the image and CRD
synchronization contract.

🗄️ Data Integrity & Integration | 🟠 Major | 🏗️ Heavy lift

#!/usr/bin/env bash
set -euo pipefail

chart="packages/system/postgres-operator/charts/cloudnative-pg/Chart.yaml"
values="packages/system/postgres-operator/values.yaml"
chart_dir="packages/system/postgres-operator/charts/cloudnative-pg"

chart_version="$(sed -nE 's/^version:[[:space:]]*"?([^"]+)"?$/\1/p' "$chart" | head -n1)"
app_version="$(sed -nE 's/^appVersion:[[:space:]]*"?([^"]+)"?$/\1/p' "$chart" | head -n1)"

printf 'chart=%s appVersion=%s\n' "$chart_version" "$app_version"
rg -n -A14 '^cloudnative-pg:' "$values"

test "$chart_version" = "0.28.3"
test "$app_version" = "1.29.1"

if rg -n '^[[:space:]]+tag:[[:space:]]*"1\.28\.2"' "$values"; then
  echo "unexpected CloudNativePG 1.28.2 image override" >&2
  exit 1
fi

rg -n 'instanceID|sessionID|FileSystemResizePending' "$chart_dir" || true

#!/usr/bin/env bash
set -u

chart="packages/system/postgres-operator/charts/cloudnative-pg/Chart.yaml"
values="packages/system/postgres-operator/values.yaml"

printf 'Chart metadata:\n'
sed -n '1,40p' "$chart"
printf '\nRelevant values.yaml section:\n'
sed -n '1,40p' "$values"
printf '\nSearch chart override template references:\n'
rg -n "image\.tag|AppVersion|cloudnative-pg" packages/system/postgres-operator -g '*.yaml' -g '*.yml' -g 'templates/**'

Keep the CloudNativePG operator image aligned with the vendored CRDs.

values.yaml sets cloudnative-pg.image.tag to 1.28.2, but the local chart is still 0.27.1 with appVersion: 1.28.1. That deploys the 1.28.2 operator image with the 1.28.1 CRD set and does not satisfy the target chart/image pair.

Bring the vendored chart to 0.28.3 with appVersion: 1.29.1, then remove the image.tag override and its same-minor compatibility comments. If this intermediate stack must stay, add a guard that prevents deployment while cloudnative-pg.image.tag differs from charts/cloudnative-pg/Chart.yaml.appVersion.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@packages/system/postgres-operator/values.yaml` around lines 4 - 16, Update
the vendored CloudNativePG chart metadata to chart version 0.28.3 with
appVersion 1.29.1, then remove the cloudnative-pg.image.tag override and its
associated same-minor compatibility comments from values.yaml. Ensure the
deployment uses the chart’s appVersion without introducing a mismatched image
tag.

Source: MCP tools

📐 Maintainability & Code Quality | 🟠 Major | 🏗️ Heavy lift

Do not rewrite the vendored chart during make update.

Line 15 applies a local patch that changes charts/cloudnative-pg/Chart.yaml and charts/cloudnative-pg/templates/crds/crds.yaml. The vendored tree will no longer remain verbatim after make update.

Use an upstream chart or move locally owned chart generation outside packages/**/charts/**. If no supported alternative exists, obtain an explicit exception before retaining this workflow.

As per coding guidelines, files under packages/**/charts/** must remain verbatim and must not be edited directly.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@packages/system/postgres-operator/Makefile` at line 15, Remove the local
patch application from the Makefile update workflow, specifically the command
applying cloudnative-pg-1.28.2.patch, so vendored chart files remain verbatim.
Use a supported upstream chart instead, or relocate locally generated chart
changes outside packages/**/charts/**; retain the current workflow only after
obtaining an explicit exception.

Source: Coding guidelines

🗄️ Data Integrity & Integration | 🟡 Minor | ⚡ Quick win

Assert the extension schemas that this patch adds.

documentIndex: 0 selects the Backup CRD. This patch changes that document only through its controller-gen annotation. The assertion at Line 37 checks an unchanged status field. It does not inspect any new extensions, bin_path, env, or optional image schema.

Select Cluster, ImageCatalog, and ClusterImageCatalog by name. Assert at least one added schema field in each. Also assert that the extension image field is optional where this patch removes that requirement.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@packages/system/postgres-operator/tests/cnpg-version_test.yaml` around lines
31 - 38, Update the CRD assertions in the test to select Cluster, ImageCatalog,
and ClusterImageCatalog by metadata.name rather than relying on documentIndex.
For each resource, assert a schema field added by the extensions, including
extensions, bin_path, or env, and verify that the extension image field is not
required where the patch removes that requirement; remove the unchanged Backup
status assertion.