From 03f6799e30be17db6b3a1a711e20c0af714919f4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?F=C3=A9lix=20Saparelli?= Date: Thu, 2 Jul 2026 12:27:23 +1200 Subject: [PATCH] fix(canopy): set PGRO_REGION on the proxy sidecar from creds Secret The canopy-proxy binary reads PGRO_REGION as a required env var to sign outgoing S3 requests for the right region. Both the restore Job builder and the snapshot-list Job builder were plumbing PGRO_BROKER_URL / PGRO_GROUP / PGRO_TYPE / PGRO_STATS_CALLBACK_URL but had lost PGRO_REGION in the refactor. Sidecar exited at startup with 'canopy-proxy: PGRO_REGION not set' and the kopia container's port-file wait timed out. Region already lives on the namespace-local canopy-creds Secret the syncer materialises (`data.region`), so wire it via env_from_secret_name rather than adding a new field to KopiaSource / CanopySource. --- src/controllers/replica/resources.rs | 8 ++++++++ src/controllers/restore/builders.rs | 8 ++++++++ 2 files changed, 16 insertions(+) diff --git a/src/controllers/replica/resources.rs b/src/controllers/replica/resources.rs index 5bd3b55..fea4198 100644 --- a/src/controllers/replica/resources.rs +++ b/src/controllers/replica/resources.rs @@ -213,6 +213,14 @@ fi value: Some(backup_type.clone()), ..Default::default() }, + // Region comes from the canopy-creds Secret the syncer + // materialises alongside this Job; the sidecar signs S3 + // requests for it before forwarding upstream. + crate::controllers::jobs::env_from_secret_name( + "PGRO_REGION", + source.secret_name(), + "region", + ), EnvVar { name: "PGRO_STATS_CALLBACK_URL".to_string(), value: Some(proxy.stats_callback_url.to_string()), diff --git a/src/controllers/restore/builders.rs b/src/controllers/restore/builders.rs index 9b302dc..2d0a944 100644 --- a/src/controllers/restore/builders.rs +++ b/src/controllers/restore/builders.rs @@ -821,6 +821,14 @@ echo -n "$VERSION" > /dev/termination-log value: Some(backup_type.clone()), ..Default::default() }, + // Region comes from the canopy-creds Secret the syncer + // materialises alongside this Job; the sidecar signs S3 + // requests for it before forwarding upstream. + crate::controllers::jobs::env_from_secret_name( + "PGRO_REGION", + source.secret_name(), + "region", + ), EnvVar { name: "PGRO_STATS_CALLBACK_URL".to_string(), value: Some(proxy.stats_callback_url.to_string()),