mirror of
https://github.com/cozystack/cozystack.git
synced 2026-11-03 18:47:04 +09:00
Aleksei Sviridkin
e9411d6b8c
The qdrant and harbor post-delete hooks guarded every delete with `|| echo "WARNING: ..." >&2`, set no `-e`, and ended on an unconditional completion message, so the container exited 0 on every path. Helm read that as a successful hook and the hook-succeeded delete policy removed the Job together with the pod that carried the warning, leaving an uninstall that reclaimed nothing indistinguishable from one that had nothing to reclaim. Count the failures instead and set the exit code at the end, so a failed delete does not skip the deletes that follow it. An object that is already gone stays a success: every delete keeps --ignore-not-found, which exits 0 in that case. This is the shape packages/apps/mariadb already uses for the same problem. Both hooks also consumed the output of `kubectl get` directly -- harbor by iterating it, qdrant by piping it into grep, whose status the pipeline then reports. A listing that failed therefore arrived as an empty list and the sweep was skipped rather than reported. Each listing is now captured before it is used, so a listing that failed and one that returned nothing are different events. A hook that exits non-zero keeps its Job and pods, which is the point: they hold the log. Give the Job one retry rather than the Kubernetes default of six or none at all. Every delete is idempotent, so a second attempt re-issues an API call rather than re-running any logic, and one short backoff is what separates a transient apiserver error from a real one -- these failures become visible for the first time here, and a signal that fires on noise stops being read, including on the day it is right. Six is the far end of the same mistake: ten minutes of backoff across seven pods outlasts the hook timeout, and Helm reports that timeout instead of the hook's own error. The qdrant Chainsaw suite explained its post-delete pod collector by quoting the guard string removed here and concluding the pod is always collected away. That is now backwards: a failed cleanup is exactly when the pod survives and the collector is the evidence. Rewrite the note, and the sentence in the harbor suite pointing at it. hack/app-cleanup-hooks_test.bats renders both scripts and runs them against a fake kubectl. There are eight failure paths across the two hooks -- six in harbor, two in qdrant -- and each has a case that goes red when that one path alone is reverted to a swallowed warning. Message assertions are anchored on the hook's own `ERROR: ` prefix, because the fake kubectl names the object in its own diagnostic too and an unanchored match is satisfied by the fixture. The helm-unittest suites pin the retry limit and the hook delete policy: adding hook-failed to that annotation hands the Job back to Helm to delete on failure and destroys the evidence this change exists to keep, and until these asserts that reversal left both suites green. Assisted-By: Claude <noreply@anthropic.com> Signed-off-by: Aleksei Sviridkin <f@lex.la>
Managed Harbor Container Registry
Harbor is an open-source trusted cloud-native registry project that stores, signs, and scans content.
Prerequisites
The Cozystack Harbor app stores its registry data exclusively in S3-compatible object storage: the chart pins the registry backend to S3 and exposes no filesystem option. That bucket is provisioned through COSI (objectstorage.k8s.io) from a SeaweedFS deployment, so before deploying Harbor the tenant must have SeaweedFS available — enabled on the same tenant or inherited from a parent tenant (the resolved class is propagated down the tenant tree, surfaced as the namespace.cozystack.io/seaweedfs namespace label).
Enable it by setting seaweedfs: true on the tenant (or a parent tenant):
seaweedfs: true
Without object storage in the tenant chain, Harbor cannot provision its registry bucket: the <release>-registry BucketClaim/BucketAccess never produces the <release>-registry-bucket credentials secret, so the Harbor HelmRelease stays unreconciled, waiting on BucketInfo.
storageClassis annotated as immutable in the chart schema — seedocs/storage-immutability.mdfor the contract and which consumers enforce it.
Parameters
Common parameters
| Name | Description | Type | Value |
|---|---|---|---|
host |
Hostname for external access to Harbor (defaults to 'harbor' subdomain for the tenant host). | string |
"" |
storageClass |
StorageClass used to store the data. | string |
"" |
Component configuration
| Name | Description | Type | Value |
|---|---|---|---|
core |
Core API server configuration. | object |
{} |
core.resources |
Explicit CPU and memory configuration. When omitted, the preset defined in resourcesPreset is applied. |
object |
{} |
core.resources.cpu |
Number of CPU cores allocated. | quantity |
"" |
core.resources.memory |
Amount of memory allocated. | quantity |
"" |
core.resourcesPreset |
Default sizing preset used when resources is omitted. |
string |
t1.small |
registry |
Container image registry configuration. | object |
{} |
registry.resources |
Explicit CPU and memory configuration. When omitted, the preset defined in resourcesPreset is applied. |
object |
{} |
registry.resources.cpu |
Number of CPU cores allocated. | quantity |
"" |
registry.resources.memory |
Amount of memory allocated. | quantity |
"" |
registry.resourcesPreset |
Default sizing preset used when resources is omitted. |
string |
t1.small |
jobservice |
Background job service configuration. | object |
{} |
jobservice.resources |
Explicit CPU and memory configuration. When omitted, the preset defined in resourcesPreset is applied. |
object |
{} |
jobservice.resources.cpu |
Number of CPU cores allocated. | quantity |
"" |
jobservice.resources.memory |
Amount of memory allocated. | quantity |
"" |
jobservice.resourcesPreset |
Default sizing preset used when resources is omitted. |
string |
t1.nano |
trivy |
Trivy vulnerability scanner configuration. | object |
{} |
trivy.enabled |
Enable or disable the vulnerability scanner. | bool |
true |
trivy.size |
Persistent Volume size for vulnerability database cache. | quantity |
5Gi |
trivy.resources |
Explicit CPU and memory configuration. When omitted, the preset defined in resourcesPreset is applied. |
object |
{} |
trivy.resources.cpu |
Number of CPU cores allocated. | quantity |
"" |
trivy.resources.memory |
Amount of memory allocated. | quantity |
"" |
trivy.resourcesPreset |
Default sizing preset used when resources is omitted. |
string |
t1.nano |
database |
PostgreSQL database configuration. | object |
{} |
database.size |
Persistent Volume size for database storage. | quantity |
5Gi |
database.replicas |
Number of database instances. | int |
2 |
redis |
Redis cache configuration. | object |
{} |
redis.size |
Persistent Volume size for cache storage. | quantity |
1Gi |
redis.replicas |
Number of Redis replicas. | int |
2 |