Init errors with "Forbidden: may not be set for init containers without restartPolicy=Always"

[iancharles]

On Cloudnative-pg 1.26, I'm getting an error spinning up a cluster with the message:

{"level":"error","ts":"2025-06-27T15:20:28.98993801Z","msg":"Reconciler error","controller":"cluster","controllerGroup":"postgresql.cnpg.io","controllerKind":"Cluster","Cluster":{"name":"intdb-cluster","namespace":"int-db"},"namespace":"int-db","name":"intdb-cluster","reconcileID":"527b355d-07f5-4a65-ac5b-d975fe8b7a33","error":"unable to create Pod: Pod "intdb-cluster-1" is invalid: spec.initContainers[1].startupProbe: Forbidden: may not be set for init containers without restartPolicy=Always","stacktrace":"sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\tpkg/mod/sigs.k8s.io/controller-runtime@v0.20.4/pkg/internal/controller/controller.go:347\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\tpkg/mod/sigs.k8s.io/controller-runtime@v0.20.4/pkg/internal/controller/controller.go:294\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.2\n\tpkg/mod/sigs.k8s.io/controller-runtime@v0.20.4/pkg/internal/controller/controller.go:255"}

This message does not appear when applying an identical manifest against a cluster using Cloudnative-pg 1.25.1. Am I wrong, or does this appear to be an error in a field defined by the CNPG controller?

[iancharles]

This issue was brought up in #7288, but this is on an EKS cluster using k8s 1.32, while the closed issue was only marked as happening on k8s versions before 1.29.

[dosubot[bot]]

Hi @iancharles! I'm Dosu and I’m helping the cloudnative-pg team.

This is a known issue in CloudNativePG 1.26 on Kubernetes 1.32 and is not limited to Kubernetes versions before 1.29. The error happens when a startupProbe is set on an init container, which Kubernetes forbids unless restartPolicy is Always—a setting not supported for init containers in most cases.

In CloudNativePG 1.26, the new support for user-provided pod patches via the cnpg.io/podPatch annotation allows arbitrary JSON patches to the pod spec, including for initContainers, without operator-side validation. If a patch (or a copied manifest) adds a startupProbe to an init container, Kubernetes 1.32 will reject the pod spec with this error. This behavior is new in 1.26 due to the formal support for podPatch, which explains why you don't see it in 1.25.1 with otherwise identical manifests. There is no version-aware logic in the operator to prevent this, and no official workaround or fix as of now.

For more details, see issue #7288 and the 1.26 release notes.

To reply, just mention @dosu.

---

Docs are dead. Just use Dosu.

[iancharles]

Thanks for clarifying, @dosubot -- I'm a little confused, as I have not added any podPatch injections to add a startupProbe (or any podPatch annotations at all). I have applied the manifests as-is from Cloudnative PG and Barman Cloud as per the documentation (https://raw.githubusercontent.com/cloudnative-pg/cloudnative-pg/release-1.26/releases/cnpg-1.26.0.yaml and https://github.com/cloudnative-pg/plugin-barman-cloud/releases/download/v0.5.0/manifest.yaml). Does this mean that the current version of Cloudnative PG is currently unusable with Barman Cloud?

[dosubot[bot]]

Based on everything I could find, this is a real bug in CloudNativePG 1.26 when using the Barman Cloud plugin on Kubernetes 1.32—even with the official manifests and no custom pod patches. The operator is generating an invalid pod spec with a startupProbe on an init container, which Kubernetes forbids. This is confirmed in issue #7288, and there is currently no official workaround or fix in the 1.26 release or documentation. The manifests themselves do not introduce the problem; it comes from the operator logic.

At this time, this bug blocks using CloudNativePG 1.26 with Barman Cloud on Kubernetes 1.32. No recent pull requests or documentation updates address or resolve this issue, and it is not mentioned in the release notes or compatibility docs, even though 1.32 is listed as supported. If you need a working setup, you may need to use CloudNativePG 1.25.1 or monitor for a fix in a future release.

To reply, just mention @dosu.

---

Docs are dead. Just use Dosu.

[wht1998]

Thanks for clarifying, @dosubot -- I'm a little confused, as I have not added any podPatch injections to add a startupProbe (or any podPatch annotations at all). I have applied the manifests as-is from Cloudnative PG and Barman Cloud as per the documentation (https://raw.githubusercontent.com/cloudnative-pg/cloudnative-pg/release-1.26/releases/cnpg-1.26.0.yaml and https://github.com/cloudnative-pg/plugin-barman-cloud/releases/download/v0.5.0/manifest.yaml). Does this mean that the current version of Cloudnative PG is currently unusable with Barman Cloud?

you resolve?my k8s version is v1.26.4,cnpg version is 1.28.0