From 3aabb0cb7c2ce9b1fc93f21d58fcc8f42e85929f Mon Sep 17 00:00:00 2001 From: Aleksei Sviridkin Date: Mon, 22 Jun 2026 17:14:26 +0300 Subject: [PATCH] fix(platform): stamp the no-delete label on bootstrap cozystack-version The bootstrap path that creates cozystack-version when the ConfigMap is absent applied it without the platform.cozystack.io/no-delete label, leaving it unguarded by the cozystack-no-delete-guardrail ValidatingAdmissionPolicy. Route it through the shared helper so the bootstrap ConfigMap carries the label like every migration-driven stamp. Assisted-By: Claude Signed-off-by: Aleksei Sviridkin --- .../core/platform/images/migrations/run-migrations.sh | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/packages/core/platform/images/migrations/run-migrations.sh b/packages/core/platform/images/migrations/run-migrations.sh index 90a72d907..e2143f9b8 100755 --- a/packages/core/platform/images/migrations/run-migrations.sh +++ b/packages/core/platform/images/migrations/run-migrations.sh @@ -1,6 +1,9 @@ #!/bin/sh set -euo pipefail +# shellcheck source=migrations/lib/cozystack-version.sh +. /migrations/lib/cozystack-version.sh + NAMESPACE="${NAMESPACE:-cozy-system}" CURRENT_VERSION="${CURRENT_VERSION:-0}" TARGET_VERSION="${TARGET_VERSION:-0}" @@ -10,9 +13,9 @@ echo "Starting migrations from version $CURRENT_VERSION to $TARGET_VERSION" # Check if ConfigMap exists if ! kubectl get configmap --namespace "$NAMESPACE" cozystack-version >/dev/null 2>&1; then echo "ConfigMap cozystack-version does not exist, creating it with version $TARGET_VERSION" - kubectl create configmap --namespace "$NAMESPACE" cozystack-version \ - --from-literal=version="$TARGET_VERSION" \ - --dry-run=client --output yaml | kubectl apply --filename - + # Stamp via the shared helper so the bootstrap ConfigMap carries the + # platform.cozystack.io/no-delete label like every migration-driven stamp. + stamp_cozystack_version "$TARGET_VERSION" echo "ConfigMap created with version $TARGET_VERSION" exit 0 fi