mirror of
https://github.com/cozystack/cozystack.git
synced 2026-11-04 02:57:27 +09:00
IvanHunters
4ee0b27c7a
Fix multiple critical issues found in code review: 1. **Namespace handling**: Added explicit namespace from ServiceAccount token to all kubectl commands. Prevents commands from using wrong default context. 2. **Complete Secret validation**: Now validates both tls.crt AND tls.key fields with proper checks: - Certificate: openssl x509 -checkend 0 (validates X.509 and checks expiry) - Private key: openssl rsa -check (validates RSA key format) Prevents DataStore creation with incomplete Secrets. 3. **Upgrade support**: Check if DataStore exists before creation. On upgrade, skip DataStore creation (it already exists). Use kubectl create instead of apply to prevent accidental spec modifications. 4. **Increased timeout**: Changed from 120s to 300s (5 minutes) and made configurable via CERT_WAIT_TIMEOUT env var. Accommodates slow cert-manager processing in production (high load, external CA, resource limits). 5. **Enhanced diagnostics**: Added comprehensive error diagnostics on timeout: - Certificate CR status - CertificateRequest status - Secret contents - cert-manager controller logs Significantly improves troubleshooting in production. 6. **Increased retries**: Changed from 3 to 10 retries with explanation. Provides better tolerance for transient failures (network issues, API unavailability, resource contention) while avoiding infinite loops. Total maximum: 10 retries × 30m timeout = 5 hours. All critical issues from code review are now resolved. Signed-off-by: IvanHunters <xorokhotnikov@gmail.com>
How to test packages local
cd packages/core/installer
make image-cozystack REGISTRY=YOUR_CUSTOM_REGISTRY
make apply
kubectl delete po -l app=source-controller -n cozy-fluxcd