cloudnative-pg / cloudnative-pg/plugin-barman-cloud
retentionPolicy delete fails against S3-compatible storage with limited Multi-Object Delete support (NetApp ONTAP)
- Dominant language
- Go
- Stars
- 191
- Forks
- 72
- Avg merge
- 2d 21h
- Merged PRs (30d)
- 21
Description
Our retention policy enforcement fails on every cycle against a NetApp ONTAP S3 backend:
"Could not delete backup 20260623T104935: An error occurred (AccessDenied) when calling the DeleteObjects operation: Access Denied"
We isolated the cause: barman-cloud-backup-delete uses the S3 Multi-Object Delete (bulk) API. A single `aws s3api delete-object` on the same key with the same credentials succeeds, but `aws s3api delete-objects` (bulk) on the identical key fails with AccessDenied, even with a correctly scoped bucket policy. This appears to be a known limitation of some non-AWS S3 implementations (similar reports: [cloudnative-pg/barman-cloud#149](https://github.com/cloudnative-pg/barman-cloud/issues/149) against MinIO).
barman-cloud-backup-delete already supports --batch-size, which set to 1 avoids the bulk delete path entirely and fixes it. However, the ObjectStore CRD has no way to pass extra args to the delete/retention command - additionalCommandArgs only exists for backup, restore, and WAL archive/restore.
Request: expose a field (e.g. deleteAdditionalCommandArgs) that gets passed to barman-cloud-backup-delete, so --batch-size (and similar flags) can be configured for retention enforcement, same as the other operations already support.
Contributor guide
Assessment
This issue has not been assessed yet.