mirror of
https://github.com/cozystack/cozystack.git
synced 2026-11-04 02:57:27 +09:00
Myasnikov Daniil
a302bd0ddc
Running the platform migrations image as the ClickHouse backup client is not a design decision worth defending, and the in-tree comments read as though it were. Reframe them. The strategy script uses exactly curl, jq, sleep and date. For that it pulls a 349 MB image carrying kubectl, helm, git, cozyhr, the etcd-migrate binary and every migration script into a tenant-adjacent Pod, and that image's ENTRYPOINT is run-migrations.sh -- so the `command:` override in the strategy template is load-bearing rather than incidental. A dedicated alpine + curl + jq + ca-certificates image measures 23 MB. The standing objection to a dedicated image -- "a second tag release CI would have to re-digest each cut" -- does not survive contact with the actual defect. Every other first-party image already pays that cost automatically. What broke was a pin with NO producer, which an image owned by its own package cannot reproduce; that fix would also delete the cross-package stamp introduced here. Comment-only. No rendered output changes. Assisted-By: Claude <noreply@anthropic.com> Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
64 lines
2.9 KiB
Makefile
64 lines
2.9 KiB
Makefile
NAME=cozystack-platform
|
|
NAMESPACE=cozy-system
|
|
|
|
include ../../../hack/common-envs.mk
|
|
|
|
test:
|
|
helm unittest .
|
|
|
|
show:
|
|
cozyhr show --namespace $(NAMESPACE) $(NAME)
|
|
|
|
apply:
|
|
cozyhr apply --namespace $(NAMESPACE) $(NAME)
|
|
|
|
reconcile: apply
|
|
|
|
diff:
|
|
cozyhr diff --namespace $(NAMESPACE) $(NAME)
|
|
|
|
# Strip the platform.cozystack.io/no-delete label from every guarded object so
|
|
# `helm uninstall cozy-platform` (and ad-hoc deletes of protected resources)
|
|
# is no longer denied by the deletion-protection VAP. After this runs, the
|
|
# cluster has no guardrail until the next `helm upgrade` re-stamps the label.
|
|
# Intended for teardown / disaster-recovery, not routine use.
|
|
unprotect:
|
|
hack/unprotect.sh
|
|
|
|
image: image-migrations
|
|
|
|
image-migrations:
|
|
# Vendor the v1alpha2 CRDs into the build context so migration 50 can ensure
|
|
# they exist before adoption (the etcd-operator-crds HelmRelease only installs
|
|
# AFTER this pre-upgrade hook). Copied from the committed source of truth —
|
|
# no build-time network fetch, stays in lockstep with the chart. Removed again
|
|
# after the build; the leading rm reclaims a stale copy from a failed build.
|
|
rm -rf images/migrations/etcd-operator-crds
|
|
mkdir -p images/migrations/etcd-operator-crds
|
|
cp ../../system/etcd-operator-crds/templates/*.yaml images/migrations/etcd-operator-crds/
|
|
docker buildx build images/migrations \
|
|
$(call image-tags,platform-migrations,v$(COZYSTACK_VERSION)) \
|
|
$(call cache-args,platform-migrations) \
|
|
--metadata-file images/migrations.json \
|
|
$(BUILDX_ARGS)
|
|
rm -rf images/migrations/etcd-operator-crds
|
|
# Stamp BOTH consumers of this image. backupstrategy-controller renders it
|
|
# into the Altinity strategy Pod as a curl+jq runner — a WORKAROUND, not a
|
|
# design: that Pod needs only curl/jq/sleep/date but gets 349 MB including
|
|
# kubectl, helm and etcd-migrate, and this image's ENTRYPOINT is the
|
|
# migration runner itself. It should get a dedicated ~23 MB image owned by
|
|
# its own package, which would delete this cross-package stamp; see the TODO
|
|
# in ../../system/backupstrategy-controller/values.yaml.
|
|
#
|
|
# Until then the two pins MUST move together. The second copy had no
|
|
# producer, so it silently froze at v1.4.0-rc.2 while this one advanced, and
|
|
# a promotion then tried to retag two different digests to the same stable
|
|
# tag — which the write-once guard in hack/promote-retag.sh turns into a
|
|
# failed release. hack/image-pin-consistency.bats keeps them in lockstep.
|
|
IMAGE="$(REGISTRY)/platform-migrations:$(IMAGE_TAG)@$$(yq -e -o json -r '.["containerimage.digest"]' images/migrations.json)" \
|
|
yq --inplace '.migrations.image = strenv(IMAGE)' values.yaml
|
|
IMAGE="$(REGISTRY)/platform-migrations:$(IMAGE_TAG)@$$(yq -e -o json -r '.["containerimage.digest"]' images/migrations.json)" \
|
|
yq --inplace '.backupStrategyController.chBackupClientImage = strenv(IMAGE)' \
|
|
../../system/backupstrategy-controller/values.yaml
|
|
rm -f images/migrations.json
|