[surrealwolf]

Why

null_resource.deploy_cloudnativepg_{nprd,prd,poc}_apps have triggers = { cnpg_version = var.cloudnativepg_operator_version }. Bumping the version replaces the resource, which runs its destroy provisioner:

kubectl delete -f .../release-1.28/releases/cnpg-1.28.0.yaml --ignore-not-found
kubectl delete namespace cnpg-system

Deleting that manifest deletes the CNPG CRDs, and with them every Cluster, Backup, ScheduledBackup, Pooler and the instance PVCs owned by the Clusters (authentik, coder, high-command on prd; harbor on nprd). A routine operator upgrade through Terraform would have wiped the databases.

What

• Remove the three destroy provisioners. Terraform runs destroy provisioners from the current configuration, so after this change a version bump only re-runs the create provisioner (kubectl apply --server-side of the new manifest), which is the documented CNPG upgrade path. Uninstalling CNPG becomes a deliberate manual operation.
• kubectl rollout status for the operator no longer ends in || true, so a failed upgrade fails the apply.
• Default and example cloudnativepg_operator_version → 1.30.1.

Part of the UPGRADE_PLAN item CNPG 1.28.0 → 1.30.1. Live rollout: poc (operator only) → nprd (harbor) → prd, with on-demand Backups + pg_dumpall beforehand and primaryUpdateMethod: switchover set via the gitops PRs.

Testing

• terraform validate passes.
• kubectl apply --server-side --dry-run=server -f cnpg-1.30.1.yaml on poc-apps, nprd-apps, prd-apps: all 26 objects apply, no field-manager conflicts.

Made with Cursor

[cursor]

Approved. Cursor Bugbot completed successfully and reported no findings that require human review. No approval policy on the changed Terraform paths requires additional human review.

  

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}