mirror of
https://github.com/cozystack/cozystack.git
synced 2026-11-09 05:25:14 +09:00
Alexey Artamonov
457282caf8
Follow-up to the KRaft migration addressing the branch review. - kafka-rd cozyrds: restore the two public CA certs in secrets.include (clients-ca-cert + cluster-ca-cert). The rebase had collapsed them to the bare clients-ca, which is Strimzi's clients-CA *private key* secret — a private-key exposure to the tenant and a TLS regression (clients need cluster-ca-cert to trust the broker listener). Covered by the existing hack/check-kafka-rd-secrets.bats. - migration-hook: guard the KRaft finalize step. The wait loop only exited via break on success and fell through to unconditionally apply strimzi.io/kraft=enabled on timeout — unsafe and irreversible if the cluster is still in ZooKeeper/KRaftMigration. Add a migration_ready flag and exit 1 when the safe state (KRaftPostMigration+) is not reached, leaving the deployed-version ConfigMap unstamped so Helm retries. New matchRegex assertions in migration-hook_test.yaml cover the guard. - migration-hook: raise activeDeadlineSeconds 1800 -> 3600 so a legitimately-progressing migration is not SIGKILLed before the in-script waits and error paths can run. - Extract the duplicated controller-quorum logic into a shared kafka.controllerReplicas helper (used by kafkanodepools, workloadmonitor and migration-hook) so the three stay in lockstep. - Reflow the README migration section to one line per paragraph per the repo prose rule. Signed-off-by: Alexey Artamonov <aleksei.artamonov@aenix.io>