0 Fork 0

mirror of https://github.com/cozystack/cozystack.git synced 2026-11-09 14:02:56 +09:00

Files

T

Aleksei Sviridkin 5af5962edf feat(apps): mark stateful-app storageClass fields as immutable

Annotate storageClass as immutable across every stateful app whose
chart exposes one — clickhouse, foundationdb, harbor, http-cache,
kafka (Kafka + ZooKeeper), kubernetes (top-level only), mariadb,
mongodb, nats, openbao, opensearch, postgres, qdrant, rabbitmq,
redis, vm-disk. Without coverage across the catalogue the UI would
render storageClass read-only on some apps and editable on others —
a worse mental model than uniform behaviour.

The annotation lands at the schema layer (CEL XValidation rule
'self == oldSelf' on values.schema.json / types.go / embedded
openAPISchema in cozyrds/<app>.yaml). The cozystack aggregated
apiserver does not yet evaluate CEL on application-backed resources;
that is tracked at cozystack/cozystack#2657. The UI
(cozystack/cozystack-ui#6) consumes the marker today.

The PVC-pinning argument is identical for every chart: Kubernetes
fixes a PVC's storageClassName at creation time, so editing this
field on an existing resource never migrated data. The schema
annotation makes that contract explicit.

kubernetes.nodeGroups[name].storageClass is intentionally NOT
annotated: the field is optional and undefaulted, so a strict
'self == oldSelf' rule would block any future attempt to set it on
an existing node group. A richer ratcheting form is needed there —
see docs/storage-immutability.md.

A refactor in pkg/registry/apps/application/rest.go extracts the
inline schema-build path into buildSpecSchema so it can be
unit-tested. Three regression tests in rest_spec_schema_test.go pin
the contract that x-kubernetes-validations survives the
v1->internal->structural conversion (loaded from the actual MariaDB
ApplicationDefinition fixture on disk, not a hand-edited mock).

Each per-app README gains a one-line blockquote pointing to a new
docs/storage-immutability.md that explains the contract and which
consumers enforce it today.

Requires cozystack/cozyvalues-gen with @immutable support — bump the
pre-commit pin in .github/workflows/pre-commit.yml once the release
exists.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>

2026-05-26 23:51:11 +03:00

2.9 KiB

Raw Blame History

Managed OpenBAO Service

OpenBAO is an open-source secrets management solution forked from HashiCorp Vault. It provides identity-based secrets and encryption management for cloud infrastructure.

storageClass is annotated as immutable in the chart schema — see docs/storage-immutability.md for the contract and which consumers enforce it.

Parameters

Common parameters

Name	Description	Type	Value
`replicas`	Number of OpenBAO replicas. HA with Raft is automatically enabled when replicas > 1. Switching between standalone (file storage) and HA (Raft storage) modes requires data migration.	`int`	`1`
`resources`	Explicit CPU and memory configuration for each OpenBAO replica. When omitted, the preset defined in `resourcesPreset` is applied.	`object`	`{}`
`resources.cpu`	CPU available to each replica.	`quantity`	`""`
`resources.memory`	Memory (RAM) available to each replica.	`quantity`	`""`
`resourcesPreset`	Default sizing preset used when `resources` is omitted.	`string`	`t1.small`
`size`	Persistent Volume Claim size for data storage.	`quantity`	`10Gi`
`storageClass`	StorageClass used to store the data.	`string`	`""`
`external`	Enable external access from outside the cluster.	`bool`	`false`

Application-specific parameters

Name	Description	Type	Value
`ui`	Enable the OpenBAO web UI.	`bool`	`true`

2.9 KiB Raw Blame History

Managed OpenBAO Service

Parameters

Common parameters

Application-specific parameters

2.9 KiB

Raw Blame History