Myasnikov DaniilandClaude Opus 4.8
ca4f99411f
Addresses review on #3265: - pre-upgrade-selector-fix hook: add runAsUser: 65532. clastix/kubectl's image user is the non-numeric name `nonroot`, which the kubelet cannot verify against runAsNonRoot: true — so the Pod fails admission and the hook never runs, silently blocking the very 1.5->1.6 upgrade it exists to unblock. Matches postgres-operator's webhook-ready hook (same image). - Digest-pin the kubectl image (the comment already claimed digest-pinning but shipped a floating v1.32 tag). Reuse the digest postgres-operator already vendors, add the renovate annotation, and template repo:tag@digest. - Tests (both charts have CI helm-unittest suites, none previously covered these): - etcd-operator/tests/selector-fix-hook_test.yaml: hook wiring, namespaced least-privilege RBAC, numeric-non-root securityContext (guards the runAsUser regression above), digest-pinned image. - etcd-operator/tests/deployment_test.yaml: assert the 256Mi cold-start memory floor so it can't silently drop back to an OOMKilling value. - extra/etcd/tests/etcd-cluster_test.yaml: assert the transitional etcd-headless Service (headless, publishNotReadyAddresses, member selector, client/peer ports). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
Etcd-cluster
This chart renders an EtcdCluster (etcd-operator.cozystack.io/v1alpha2)
managed by the cozystack etcd-operator, plus the cert-manager CA chain and a
Kamaji DataStore. TLS uses secretRef mode: this chart's own cert-manager
Certificate resources issue the server, operator-client and peer certs from
the etcd-issuer / etcd-peer-issuer CA Issuers, and the EtcdCluster only
references the resulting Secrets via serverSecretRef /
operatorClientSecretRef / peer.secretRef (the operator itself mints
nothing). This is deliberate: spec.tls is immutable in v1alpha2 and
etcd-migrate adopts legacy clusters into exactly this secretRef shape, so the
chart must match it or every post-adoption reconcile is rejected. etcd runs
cert-only (--client-cert-auth, no password auth); consumers authenticate by
presenting a commonName=root client cert (etcd-client-tls) signed by the
same CA.
Backups
Backups are driven by the Cozystack BackupClass flow: a BackupJob /
RestoreJob against the Etcd strategy (strategy.backups.cozystack.io/v1alpha1).
See examples/backups/etcd/ for the end-to-end demo and
internal/backupcontroller/etcdstrategy_controller.go for the driver. The
driver materialises one EtcdSnapshot (etcd-operator.cozystack.io/v1alpha2)
per BackupJob; restore is in-place (the driver suspends this chart's
HelmRelease, deletes the live EtcdCluster, and re-creates it with
spec.bootstrap.restore.source.s3 populated from the Backup artefact's
coordinates).
The legacy
backup.*values block and theEtcdBackupScheduleCRD no longer exist under the v1alpha2 operator — scheduled backups are expressed as aBackupClass/Planinstead.
Parameters
Common parameters
| Name | Description | Type | Value |
|---|---|---|---|
version |
etcd version (X.Y.Z) to run, set on the EtcdCluster's spec.version; the operator pulls etcd from its own configured image. | string |
3.6.11 |
size |
Persistent Volume size. | quantity |
4Gi |
storageClass |
StorageClass used to store the data. | string |
"" |
replicas |
Number of etcd replicas. | int |
3 |
resources |
Resource configuration for etcd. | object |
{} |
resources.cpu |
Number of CPU cores allocated. | quantity |
1000m |
resources.memory |
Amount of memory allocated. | quantity |
512Mi |