camunda · eamonnmoloney · Jun 5, 2026
@@ -129,5 +129,15 @@ func Deploy(ctx context.Context, o types.Options) error {
 		}
 	}
 
+	// Run post-infra hooks after the companion charts (external infrastructure)
+	// are deployed and ready, but before the main Camunda chart. This is the
+	// point to act on freshly-provisioned infrastructure — e.g. migrating data
+	// from a prior release's bundled backends onto the companion services.
+	for i, hook := range o.PostInfraHooks {
+		if err := hook(ctx); err != nil {
+			return fmt.Errorf("post-infra hook [%d] failed: %w", i, err)
+		}
+	}
+
 	return upgradeInstall(ctx, o)
 }
@@ -80,6 +80,13 @@ type Options struct {
 	// deployed with helm upgrade --install --wait to ensure it is ready
 	// before the main chart deployment begins.
 	CompanionCharts []CompanionChart
+
+	// PostInfraHooks are functions called after all CompanionCharts are
+	// deployed and ready, but before the main Camunda chart is
+	// installed/upgraded. Used to act on freshly-provisioned infrastructure —
+	// e.g. migrating data from a prior release's bundled backends onto the
+	// companion services before the chart switches over to them.
+	PostInfraHooks []func(ctx context.Context) error
 }
 
 // CompanionChart represents a Helm chart that should be deployed as a

@@ -193,6 +193,14 @@ type RuntimeFlags struct {
 	// may not yet exist or may be recreated by DeleteNamespaceFirst.
 	PreInstallHooks []func(ctx context.Context) error
 
+	// PostInfraHooks are functions called by the deployer after companion
+	// charts (the external infrastructure: PostgreSQL, Elasticsearch, Keycloak,
+	// …) are deployed and ready, but before the main Camunda chart is
+	// installed/upgraded. Used to act on freshly-provisioned infrastructure —
+	// e.g. migrating data from a prior release's bundled backends onto the
+	// companion services before the chart switches over to them.
+	PostInfraHooks []func(ctx context.Context) error
+
 	// PostDeployHooks are functions called by the deployer after helm
 	// upgrade/install completes successfully but before the deployment result
 	// is returned. Used to apply scenario-specific resources whose CRDs are

@@ -313,6 +313,7 @@ func executeDeployment(ctx context.Context, prepared *PreparedScenario, flags *c
 		SetPairs:              flags.Deployment.ExtraHelmSets,
 		PreInstallHooks:       flags.PreInstallHooks,
 		CompanionCharts:       toDeployerCompanionCharts(prepared.CompanionCharts),
+		PostInfraHooks:        flags.PostInfraHooks,
 	}
 
 	// Log deployment options (redact sensitive fields)

@@ -215,6 +215,13 @@ type CIScenario struct {
 	// (pre-install-<scenario>.sh) with an explicit, reviewable reference.
 	PreInstall *LifecycleHook `yaml:"pre-install,omitempty"`
 
+	// PostInfra declares a fixture or script to run after the scenario's
+	// companion charts (external infrastructure) are deployed and ready, but
+	// before the main Camunda chart is installed/upgraded. Used to act on
+	// freshly-provisioned infrastructure — e.g. migrating data from a prior
+	// release's bundled backends onto the companion services.
+	PostInfra *LifecycleHook `yaml:"post-infra,omitempty"`
+
 	// PostDeploy declares a fixture or script to run after helm install
 	// completes successfully. Used for resources whose CRDs are only
 	// installed by the chart itself (e.g., the Gateway API

@@ -103,6 +103,7 @@ type hookKind string
 
 const (
 	hookPreInstall hookKind = "pre-install"
+	hookPostInfra  hookKind = "post-infra"
 	hookPostDeploy hookKind = "post-deploy"
 	hookPreUpgrade hookKind = "pre-upgrade"
 )
@@ -187,6 +188,16 @@ func registerDeclarativePreInstallHook(flags *config.RuntimeFlags, hook *Lifecyc
 	return registerDeclarativeHook(flags, hook, hookPreInstall, &flags.PreInstallHooks, repoRoot, appVersion, scenario)
 }
 
+// registerDeclarativePostInfraHook is a thin shim that pins the slot and kind
+// for post-infra registrations. The hook runs after companion charts (the
+// external infrastructure: PostgreSQL, Elasticsearch, Keycloak, …) are deployed
+// and ready, but before the main Camunda chart is installed/upgraded. Use it to
+// act on freshly-provisioned infrastructure — e.g. migrating data from a prior
+// release's bundled backends onto the companion services.
+func registerDeclarativePostInfraHook(flags *config.RuntimeFlags, hook *LifecycleHook, repoRoot, appVersion, scenario string) error {
+	return registerDeclarativeHook(flags, hook, hookPostInfra, &flags.PostInfraHooks, repoRoot, appVersion, scenario)
+}
+
 // registerDeclarativePostDeployHook is a thin shim that pins the slot and kind
 // for post-deploy registrations.
 func registerDeclarativePostDeployHook(flags *config.RuntimeFlags, hook *LifecycleHook, repoRoot, appVersion, scenario string) error {

@@ -48,6 +48,11 @@ type Entry struct {
 	// without re-loading ci-test-config.yaml.
 	PreInstall *LifecycleHook `json:"preInstall,omitempty"`
 
+	// PostInfra declares a fixture or script to run after companion charts
+	// (external infrastructure) are deployed but before the main Camunda chart.
+	// Carried from CIScenario.PostInfra.
+	PostInfra *LifecycleHook `json:"postInfra,omitempty"`
+
 	// PostDeploy declares a fixture or script to run after helm install
 	// completes successfully. Carried from CIScenario.PostDeploy.
 	PostDeploy *LifecycleHook `json:"postDeploy,omitempty"`
@@ -215,6 +220,7 @@ func Generate(repoRoot string, opts GenerateOptions) ([]Entry, error) {
 						SkipIT:       scenario.SkipIT,
 						Dependencies: append([]ChartDependency(nil), scenario.Dependencies...),
 						PreInstall:   scenario.PreInstall,
+						PostInfra:    scenario.PostInfra,
 						PostDeploy:   scenario.PostDeploy,
 						PreUpgrade:   preUpgrade,
 						HelmVersion:  scenario.HelmVersion,

@@ -542,6 +542,9 @@ func executeEntry(ctx context.Context, entry Entry, opts RunOptions) RunResult {
 		if err := registerDeclarativePreInstallHook(flags, entry.PreInstall, opts.RepoRoot, entry.Version, entry.Scenario); err != nil {
 			return RunResult{Entry: entry, Namespace: namespace, Error: err}
 		}
+		if err := registerDeclarativePostInfraHook(flags, entry.PostInfra, opts.RepoRoot, entry.Version, entry.Scenario); err != nil {
+			return RunResult{Entry: entry, Namespace: namespace, Error: err}
+		}
 	}
 	if !isTwoStepUpgrade {
 		if err := registerDeclarativePostDeployHook(flags, entry.PostDeploy, opts.RepoRoot, entry.Version, entry.Scenario); err != nil {

@@ -279,6 +279,13 @@ func executeTwoStepUpgrade(ctx context.Context, entry Entry, flags *config.Runti
 		}
 	}
 
+	// --- Post-infra lifecycle hook (Step 2 of two-step upgrade) ---
+	// Registered against step2Flags so it fires after Step 2's companion charts
+	// are deployed but before the target chart upgrade.
+	if err := registerDeclarativePostInfraHook(&step2Flags, entry.PostInfra, opts.RepoRoot, entry.Version, entry.Scenario); err != nil {
+		return err
+	}
+
 	// --- Post-deploy lifecycle hook (Step 2 of two-step upgrade) ---
 	// Registered against step2Flags so it fires after the upgrade succeeds.
 	if err := registerDeclarativePostDeployHook(&step2Flags, entry.PostDeploy, opts.RepoRoot, entry.Version, entry.Scenario); err != nil {
@@ -379,6 +386,13 @@ func executeUpgradeOnly(ctx context.Context, entry Entry, flags *config.RuntimeF
 	if err := registerDeclarativePreInstallHook(&upgradeFlags, entry.PreInstall, opts.RepoRoot, entry.Version, entry.Scenario); err != nil {
 		return err
 	}
+	// Post-infra hook: runs after the upgrade's companion charts are deployed
+	// but before the target chart upgrade. This is where a Bitnami→companion
+	// data migration runs, so the upgraded chart finds its data on the
+	// companion services.
+	if err := registerDeclarativePostInfraHook(&upgradeFlags, entry.PostInfra, opts.RepoRoot, entry.Version, entry.Scenario); err != nil {
+		return err
+	}
 
 	// Extract Bitnami PostgreSQL passwords from the cluster secret and merge into --set overrides.
 	// Defensive: prevents the PASSWORDS ERROR that Bitnami's secrets.yaml can trigger when the