cnpg-drill v0.1.5

cnpg-drill can now check a primary Cluster originally restored from an external source after it completes its own plugin backup. Preflight verifies the source primary Pod's ownership and confirms PostgreSQL has left recovery using a read-only query.

The drill uses the current writer archive and selected new backup. Active replicas, distributed replica topologies, and pg_basebackup bootstrap sources remain unsupported.

All 46 unit tests pass. Local validation restored a recovered primary's new backup, checked its vector data, and verified cleanup. The source configuration stayed unchanged. Tests used Kubernetes 1.35.8, CNPG 1.30.1, Barman Cloud plugin 0.15.0, and RustFS. Cloud IAM and Cilium remain untested.

Chart 0.1.7 pins the matching application image. The kubectl plugin archive includes the MIT license and a checksum file.

cnpg-drill v0.1.4

cnpg-drill can now use a specific recovery Cluster name, an explicitly configured recovery cloud identity, and PostgreSQL extension images from the source Cluster.

Cleanup checks the run's ownership token and uses a Kubernetes UID precondition. An occupied recovery name stops the drill before creation. Cloud identity requires a separate recovery ObjectStore; the source's writer identity is not copied.

Local full and PITR restores loaded pgvector and checked recovered vector data. Failed SQL and denied-WAL tests failed as expected and cleaned up. The new container also passed full and PITR restores through the Helm chart's ServiceAccount.

The test matrix used Kubernetes 1.35.8, CloudNativePG 1.30.1, Barman Cloud plugin 0.15.0, PostgreSQL 18.6, pgvector 0.8.2, and RustFS 1.0.0. AWS/Azure authentication remains untested. Fixed recovery names require one scheduler and completed storage cleanup before reuse.

Chart 0.1.6 pins the matching container image and adds the namespace-scoped Cluster read permissions needed to wait for deletion. The archive below contains the kubectl plugin and MIT license; the checksum file verifies it.

cnpg-drill v0.1.3

cnpg-drill now accepts CloudNativePG clusters that set storage capacity through storage.pvcTemplate.resources.requests.storage. The recovery Cluster keeps the source capacity and storage class, but drops any existing volume binding, selector, or snapshot data source from its PVC template. The same safeguard applies to a separate WAL volume.

The local K3s test restored a Barman Cloud Plugin backup with this PVC template, passed a point-in-time restore, detected a wrong SQL result and denied WAL access, and removed temporary Clusters and PVCs in every case. The test record covers the version matrix and its limits.

The archive below contains the standalone kubectl cnpg-drill plugin and its MIT license. The checksum file verifies the archive.

cnpg-drill v0.1.2

The recovery Cluster now carries literal AWS_REQUEST_CHECKSUM_CALCULATION, AWS_RESPONSE_CHECKSUM_VALIDATION, and AWS_NO_CHUNKED_ENCODING settings from the source Cluster. It still leaves source plugins and other environment variables, including writer credentials, behind.

The release was tested on a disposable K3s cluster with CloudNativePG 1.30.1 and Barman Cloud plugin 0.15.0. Full restore and PITR passed against a read-only recovery ObjectStore. A failed SQL assertion and denied WAL access returned failures and cleaned up their drill Clusters and PVCs. Test record.

The archive contains the kubectl-cnpg_drill executable and MIT license. It requires Python 3.10+ and kubectl on PATH.

cnpg-drill v0.1.1

Adds an optional database field to each SQL check. Checks still use postgres when the field is omitted. This lets a drill verify recovered application data in databases such as app.

The database name is validated as a simple identifier before the drill starts. The JSON report records the database used for each check.

Validation: 26 unit tests passed on Python 3.10 and 3.13 in CI. The release archive installed through Krew in an isolated root and reported version 0.1.1. The full backup/restore integration matrix remains the v0.1.0 run documented in integration/local/.

cnpg-drill v0.1.0

First alpha release of cnpg-drill, a free kubectl plugin that restores a CloudNativePG Barman backup into a disposable cluster, runs read-only SQL assertions, emits JSON evidence, and cleans up.

Validated on K3s v1.35.8+k3s1, CloudNativePG 1.30.1, Barman Cloud plugin 0.15.0, PostgreSQL 18.6-system-trixie, and RustFS 1.0.0. The local matrix covers full restore, PITR, failed assertions, stale-backup preflight, read-only recovery credentials, a denied-WAL failure with a sanitized reason, Helm execution, and cleanup. The exact archive passed a local Krew v0.5.0 install and live kubectl cnpg-drill run. Evidence: https://github.com/danielgaskins/cnpg-drill/tree/v0.1.0/integration/local

Requires Python 3.10+, kubectl, CloudNativePG, and the Barman Cloud plugin. This is early alpha; validate it against your own storage and operator versions before using it as recovery assurance.

cnpg-drill Helm chart v0.1.1

Chart-only metadata update. Adds a maintainer profile and named author link to https://danielgaskins.com/ for Artifact Hub. The workload templates and pinned application image are unchanged from chart v0.1.0.

Install:

helm install cnpg-drill oci://ghcr.io/danielgaskins/charts/cnpg-drill \
  --version 0.1.1 --namespace YOUR_NAMESPACE --values drill-values.yaml

The chart starts suspended. See docs/PILOT.md for the first recovery drill.

cnpg-drill Helm chart v0.1.0

Helm chart v0.1.0 for scheduled CloudNativePG Barman Cloud recovery drills.

Install from the public OCI registry:

helm install cnpg-drill oci://ghcr.io/danielgaskins/charts/cnpg-drill \
  --version 0.1.0 --namespace YOUR_NAMESPACE --values drill-values.yaml

The chart starts suspended. Configure the source Cluster, a separately credentialed read-only recovery ObjectStore, and meaningful SQL checks before creating a manual Job or enabling the schedule. The container image is pinned to a public amd64/arm64 digest.

A one-off Job installed from the public OCI chart restored a completed backup in local K3s, passed two read-only assertions, and removed the disposable Cluster and PVCs. See integration/local/results/helm-oci.json for the redacted report and docs/PILOT.md for the pilot guide. The chart does not yet provide durable report storage or missed-run alerts.