K8SPG-911 restore fix

[egegunes]

CHANGE DESCRIPTION

Problem:
pg_tde.wal_encrypt might flap after restore and make primary restart during pg_rewind.

Solution:
If all pods are not running, operator should prevent enabling WAL encryption but shouldn't disable if it's already enabled.

CHECKLIST

Jira

• Is the Jira ticket created and referenced properly?
• Does the Jira ticket have the proper statuses for documentation (Needs Doc) and QA (Needs QA)?
• Does the Jira ticket link to the proper milestone (Fix Version field)?

Tests

• Is an E2E test/test case added for the new feature/change?
• Are unit tests added where appropriate?

Config/Logging/Testability

• Are all needed new/changed options added to default YAML files?
• Are all needed new/changed options added to the Helm Chart?
• Did we add proper logging messages for operator actions?
• Did we ensure compatibility with the previous version or cluster upgrade process?
• Does the change support oldest and newest supported PG version?
• Does the change support oldest and newest supported Kubernetes version?

[Copilot]

🟢 Approval recommended

The change is narrowly scoped, aligns with the stated restore flapping issue, and is covered by a targeted new unit test plus E2E hardening.

Pull request overview

This PR addresses K8SPG-911 by preventing pg_tde.wal_encrypt from being toggled off during restore-related pod restarts (e.g., while pg_rewind is in progress), which can otherwise trigger an unwanted primary restart. It does this by keeping the Vault provider “ready” status intact when the provider is already configured but not all pods are currently running, plus it strengthens test stability via unit and E2E timing/retry adjustments.

Changes:

• Keep PGTDEVaultProviderReady=True when instances are temporarily not all running, avoiding WAL encryption flapping during restore.
• Add a unit test covering the “configured provider remains ready while waiting for instances” behavior.
• Increase / harden KUTTL E2E steps with longer timeouts and retries for post-upgrade verification.

File summaries

File	Description
internal/controller/postgrescluster/postgres.go	Avoids flipping PGTDEVaultProviderReady to false when already configured and pods are not all running, preventing WAL encryption from being disabled transiently.
internal/controller/postgrescluster/pgtde_test.go	Adds a regression test ensuring the provider-ready condition remains True/Configured and no exec occurs while waiting for instances.
e2e-tests/tests/pg-tde-wal-encrypt/15-assert.yaml	Increases KUTTL assert timeout to reduce flakes in WAL-encryption-related assertions.
e2e-tests/tests/major-upgrade-17-to-18/06-post-upgrade.yaml	Adds command timeout and retry wrappers to make post-upgrade verification resilient to transient restarts/election delays.

Review details

• Files reviewed: 4/4 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.