From 41f2c64241a46ee40f8abf5a4bf488dbcb392e13 Mon Sep 17 00:00:00 2001 From: IvanHunters Date: Mon, 2 Mar 2026 16:22:20 +0300 Subject: [PATCH] fix(migration): protect cozy-keycloak namespace during v1.0 migration The migration script only annotated cozy-system namespace with helm.sh/resource-policy=keep, leaving cozy-keycloak unprotected. This could cause Helm to delete the namespace and all its secrets (including keycloak credentials and realm data) during the migration to Package-based configuration. Signed-off-by: IvanHunters --- hack/migrate-to-version-1.0.sh | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/hack/migrate-to-version-1.0.sh b/hack/migrate-to-version-1.0.sh index bf648926d..ff7272766 100755 --- a/hack/migrate-to-version-1.0.sh +++ b/hack/migrate-to-version-1.0.sh @@ -39,6 +39,7 @@ echo "The following resources will be annotated with helm.sh/resource-policy=kee echo "to prevent Helm from deleting them when the installer release is removed:" echo " - Namespace: $NAMESPACE" echo " - ConfigMap: $NAMESPACE/cozystack-version" +echo " - Namespace: cozy-keycloak" echo "" read -p "Do you want to annotate these resources? (y/N) " -n 1 -r echo "" @@ -48,6 +49,10 @@ if [[ $REPLY =~ ^[Yy]$ ]]; then kubectl annotate namespace "$NAMESPACE" helm.sh/resource-policy=keep --overwrite echo "Annotating ConfigMap cozystack-version..." kubectl annotate configmap -n "$NAMESPACE" cozystack-version helm.sh/resource-policy=keep --overwrite 2>/dev/null || echo " ConfigMap cozystack-version not found, skipping." + + echo "Annotating namespace cozy-keycloak..." + kubectl annotate namespace cozy-keycloak helm.sh/resource-policy=keep --overwrite 2>/dev/null || echo " Namespace cozy-keycloak not found, skipping." + echo "" echo "Resources annotated successfully." else