Andrey Kolkov 1b1a6b2f1d fix(clickhouse): address review — trim template docs, harden backup demo CA secret ...

Review feedback on #3385:

- Move the endpointCA rationale out of the Helm template (lllamnyp): the
  SSL_CERT_DIR and CA-volume blocks were multi-paragraph essays. Trim each to
  a few lines stating only the non-obvious decision (SSL_CERT_DIR vs
  AWS_CA_BUNDLE; the deliberate non-optional mount) and point at the
  values.yaml endpointCA field for the full description.

- wait_deleted (00-helpers.sh): poll with 'get --ignore-not-found' and treat
  only an empty result as deletion, so an RBAC/API-server/transport failure is
  no longer read as success and cleanup can't settle on a false positive.

- Backup demo CA Secret: scope the default name to CLICKHOUSE_NAME, stamp an
  ownership label on the copy, refuse to overwrite a Secret the demo doesn't
  own, and delete on cleanup only when that label is present — so a foreign
  Secret sharing the name is never clobbered or removed.

- README: document CH_BACKUP_CA_SECRET and the release-scoped, demo-owned CA
  Secret; spell out the admin-copy path (export CH_BACKUP_CA_SECRET before
  steps 04 and 07).

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Andrey Kolkov <androndo@gmail.com>

2026-08-06 11:59:54 +04:00

..

backups

fix(clickhouse): address review — trim template docs, harden backup demo CA secret

2026-08-06 11:59:54 +04:00