Cluster chart doesn't support promotion of replica to primary

[mpsOxygen]

While there are values in the values files for promotion of a replica to primary:

  # --  Defines the name of this cluster. It is used to determine if this is a primary or a replica cluster, comparing it with primary. Leave empty by default.
  self: ""
  # -- Primary defines which Cluster is defined to be the primary in the distributed PostgreSQL cluster, based on the topology specified in externalClusters
  primary: ""
  # -- A demotion token generated by an external cluster used to check if the promotion requirements are met.
  promotionToken: ""

When trying to set self = primary and add a promotionToken it errors because of a validating webhook and not being able to define self as an externalCluster:
Failed last sync attempt to [0.4.0 a2506789ed0aa93f9a01db538333b8ab38934f7f]: one or more objects failed to apply, reason: error when patching "/dev/shm/1893910228": admission webhook "vcluster.cnpg.io" denied the request: Cluster.cluster.cnpg.io "postgres-harbor-cluster" is invalid: [spec.replicaCluster.enabled: Invalid value: {"self":"postgres-harbor-cluster","primary":"postgres-harbor-cluster","source":"originCluster","enabled":true,"promotionToken":"eyJsYXRlc3RDaGVja3BvaW50VGltZWxpbmVJRCI6IjQiLCJyZWRvV2FsRmlsZSI6IjAwMDAwMDA0MDAwMDAxRkEwMDAwMDA0OSIsImRhdGFiYXNlU3lzdGVtSWRlbnRpZmllciI6Ijc2MTMwNTMzMDQwNDM0MjE3MTYiLCJsYXRlc3RDaGVja3BvaW50UkVET0xvY2F0aW9uIjoiMUZBLzQ5MDAwMDI4IiwidGltZU9mTGF0ZXN0Q2hlY2twb2ludCI6IkZyaSBNYXkgMjkgMTE6MTA6MTAgMjAyNiIsIm9wZXJhdG9yVmVyc2lvbiI6IjEuMjcuMyJ9"}: replica mode enabled is not compatible with the primary field, spec.replicaCluster.self: Invalid value: "postgres-harbor-cluster": External cluster postgres-harbor-cluster not found, spec.replicaCluster.primary: Invalid value: "postgres-harbor-cluster": External cluster postgres-harbor-cluster not found, spec.replicaCluster.token: Invalid value: "eyJsYXRlc3RDaGVja3BvaW50VGltZWxpbmVJRCI6IjQiLCJyZWRvV2FsRmlsZSI6IjAwMDAwMDA0MDAwMDAxRkEwMDAwMDA0OSIsImRhdGFiYXNlU3lzdGVtSWRlbnRpZmllciI6Ijc2MTMwNTMzMDQwNDM0MjE3MTYiLCJsYXRlc3RDaGVja3BvaW50UkVET0xvY2F0aW9uIjoiMUZBLzQ5MDAwMDI4IiwidGltZU9mTGF0ZXN0Q2hlY2twb2ludCI6IkZyaSBNYXkgMjkgMTE6MTA6MTAgMjAyNiIsIm9wZXJhdG9yVmVyc2lvbiI6IjEuMjcuMyJ9": promotionToken is only allowed for primary clusters] (retried 2 times).

[dosubot]

Hi @mpsOxygen! I'm Dosu and I’m helping the charts team.

This is a confirmed gap in the chart — the cluster chart's _bootstrap.tpl template hardcodes enabled: true whenever mode: "replica" is set, with no conditional logic to handle the promotion case where self == primary [1].

Specifically, the template does:

replica:
  enabled: true  # always hardcoded
  source: originCluster
  self: {{ .Values.replica.self }}
  primary: {{ .Values.replica.primary }}
  promotionToken: {{ .Values.replica.promotionToken }}

This causes all the webhook errors you're seeing because the CNPG operator expects enabled to not be true (or to be absent) when self == primary during promotion, and it expects self/primary to reference defined external clusters.

Workaround: The current way to promote via Helm is to switch mode from "replica" to "standalone" in your values, which skips the entire replica block generation. This effectively tells the chart to stop rendering the replica: section entirely.

To properly fix this, the chart template would need logic like:

{{- if ne .Values.replica.self .Values.replica.primary }}
enabled: true
{{- end }}

There are also related open PRs that fix other replica-mode bugs: PR #806 fixes credential templates reading from wrong paths [2], and PR #828 fixes passwordSecret configuration [3].

To reply, just mention @dosu.

---

Share context across your team and agents. Try Dosu.

[mpsOxygen]

The suggested workaround would not work as you need to use the promotionToken when promoting a replica to primary and there is no value under standalone to set a promotionToken.

[dosubot]

You're right — switching to mode: "standalone" won't work because the entire replica: section is skipped, and there's no way to pass the promotionToken to the operator.

Looking at the chart template, the issue is twofold [1]:

1. The replica: block is only rendered when mode: "replica"
2. When rendered, enabled is hardcoded to true

For a distributed topology promotion, the operator expects something like [2]:

replica:
  primary: cluster-being-promoted
  promotionToken: <TOKEN>
  source: former-primary

…with enabled either absent or not set to true. The chart currently has no mode or value combination that produces this output.

Until the chart is updated to support this (e.g., by making enabled a configurable value, or adding a dedicated promotion mode), the only workaround is to bypass Helm for the promotion step — for example, using kubectl patch to update the replica section directly on the Cluster CR after the initial Helm-managed deployment.

To reply, just mention @dosu.

---

Share context across your team and agents. Try Dosu.