mirror of
https://github.com/cozystack/cozystack.git
synced 2026-11-09 05:25:14 +09:00
Myasnikov DaniilandClaude Opus 4.8
ca4f99411f
Addresses review on #3265: - pre-upgrade-selector-fix hook: add runAsUser: 65532. clastix/kubectl's image user is the non-numeric name `nonroot`, which the kubelet cannot verify against runAsNonRoot: true — so the Pod fails admission and the hook never runs, silently blocking the very 1.5->1.6 upgrade it exists to unblock. Matches postgres-operator's webhook-ready hook (same image). - Digest-pin the kubectl image (the comment already claimed digest-pinning but shipped a floating v1.32 tag). Reuse the digest postgres-operator already vendors, add the renovate annotation, and template repo:tag@digest. - Tests (both charts have CI helm-unittest suites, none previously covered these): - etcd-operator/tests/selector-fix-hook_test.yaml: hook wiring, namespaced least-privilege RBAC, numeric-non-root securityContext (guards the runAsUser regression above), digest-pinned image. - etcd-operator/tests/deployment_test.yaml: assert the 256Mi cold-start memory floor so it can't silently drop back to an OOMKilling value. - extra/etcd/tests/etcd-cluster_test.yaml: assert the transitional etcd-headless Service (headless, publishNotReadyAddresses, member selector, client/peer ports). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
62 lines
2.6 KiB
YAML
62 lines
2.6 KiB
YAML
## etcd-operator controller-manager image. Published from
|
|
## github.com/cozystack/etcd-operator. The same image doubles as the
|
|
## snapshot/restore agent (wired through the OPERATOR_IMAGE env), so the tag
|
|
## here must be a real, pullable ref.
|
|
image:
|
|
repository: ghcr.io/cozystack/etcd-operator
|
|
tag: "" # defaults to .Chart.AppVersion when empty
|
|
pullPolicy: IfNotPresent
|
|
|
|
## DNS suffix of the Kubernetes cluster, threaded into --cluster-domain so the
|
|
## operator builds the correct cert SAN FQDNs. Defaults to the cozystack
|
|
## cluster domain provided via _cluster, falling back to cozy.local.
|
|
clusterDomain: ""
|
|
|
|
replicaCount: 1
|
|
|
|
resources:
|
|
requests:
|
|
cpu: 100m
|
|
memory: 64Mi
|
|
limits:
|
|
cpu: 500m
|
|
# Cold-start floor. This is the limit a freshly-created Pod runs under until
|
|
# the VPA admission webhook has had a chance to rewrite it (see vpa below).
|
|
# The manager's steady-state working set is ~250Mi (the VPA's own
|
|
# recommendation), so a 128Mi floor OOMKills the operator on any start where
|
|
# the webhook does not mutate the Pod in time — e.g. a Deployment recreated
|
|
# out of band, or the webhook briefly unavailable during an upgrade. Keep
|
|
# this at or above the observed working set so the operator never depends on
|
|
# VPA timing merely to avoid a crash loop; the VPA still scales it further
|
|
# under real load up to maxAllowed.
|
|
memory: 256Mi
|
|
|
|
vpa:
|
|
enabled: true
|
|
updateMode: Auto
|
|
minAllowed:
|
|
cpu: 100m
|
|
# Matches the cold-start limit floor above so the VPA never recommends BELOW
|
|
# the manager's ~250Mi working set.
|
|
memory: 256Mi
|
|
# maxAllowed is the VPA's scaling CEILING, deliberately well above the static
|
|
# resources.limits above (256Mi): with updateMode: Auto the VPA rewrites the
|
|
# Pod's request/limit up to this bound under real load. Do NOT "align" it down
|
|
# to the 256Mi limit — that would cap the autoscaler's headroom.
|
|
maxAllowed:
|
|
cpu: 1000m
|
|
memory: 1Gi
|
|
|
|
# Image for the pre-upgrade selector-migration hook Job (see
|
|
# templates/pre-upgrade-selector-fix.yaml). Only needs a kubectl binary. The tag
|
|
# is digest-pinned so an upstream retag does not change what runs across the
|
|
# fleet; refresh by resolving the current manifest-list digest
|
|
# (`docker manifest inspect docker.io/clastix/kubectl:v1.32`) and updating
|
|
# `digest` below. Same image the postgres-operator webhook-ready hook pins.
|
|
# renovate: datasource=docker depName=docker.io/clastix/kubectl
|
|
kubectlImage:
|
|
repository: docker.io/clastix/kubectl
|
|
tag: v1.32
|
|
digest: sha256:b9ef7d8dbe65bcc81a46c09b8dc7543103055021c4f43287bf59e92a8f4fe05c
|
|
pullPolicy: IfNotPresent
|