From 41e16a7b39a7065ed208d3c658ed0438ef166486 Mon Sep 17 00:00:00 2001
From: Ben Vincent <ben@unkin.net>
Date: Tue, 24 Mar 2026 18:51:21 +1100
Subject: [PATCH] fix: remove shared-config PVC from g10k cronjob, clone r10k
 config directly
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The RWO puppetserver-shared-config PVC caused multi-attach errors when
the cronjob pod was scheduled on a different node than the previous run,
stalling the init container indefinitely. Since the config only needs to
exist for the duration of the job, remove the init container and PVC
entirely and clone the r10k config directly into /share within the main
container before running g10k.

💘 Generated with Crush

Assisted-by: Claude Sonnet 4.6 via Crush <crush@charm.land>
---
 apps/base/puppet/cronjob_g10k-code.yaml      | 50 ++++----------------
 apps/base/puppet/persistentvolumeclaims.yaml | 18 -------
 2 files changed, 9 insertions(+), 59 deletions(-)

diff --git a/apps/base/puppet/cronjob_g10k-code.yaml b/apps/base/puppet/cronjob_g10k-code.yaml
index 8c02521..d4f30e0 100644
--- a/apps/base/puppet/cronjob_g10k-code.yaml
+++ b/apps/base/puppet/cronjob_g10k-code.yaml
@@ -26,38 +26,6 @@ spec:
         spec:
           hostname: g10k-code
           imagePullSecrets: null
-          initContainers:
-            - name: fetch-config
-              image: alpine/git:latest
-              imagePullPolicy: IfNotPresent
-              resources:
-                requests:
-                  cpu: 50m
-                  memory: 64Mi
-                limits:
-                  cpu: 100m
-                  memory: 128Mi
-              args:
-                - |
-                  set -e
-                  echo "Cloning r10k config repository..."
-                  git clone https://git.unkin.net/unkin/puppet-r10k.git /tmp/config
-                  cp /tmp/config/r10k.yaml /shared/r10k.yaml
-                  echo "r10k.yaml fetched successfully"
-              command:
-                - /bin/sh
-                - -c
-              securityContext:
-                allowPrivilegeEscalation: false
-                capabilities:
-                  drop:
-                    - all
-                runAsGroup: 999
-                runAsNonRoot: true
-                runAsUser: 999
-              volumeMounts:
-                - mountPath: /shared
-                  name: shared-config
           containers:
             - name: g10k-code
               image: git.unkin.net/unkin/almalinux9-g10k:20260308
@@ -69,11 +37,16 @@ spec:
                 limits:
                   cpu: 200m
                   memory: 256Mi
-              args:
-                - -config
-                - /shared/r10k.yaml
               command:
-                - /usr/bin/g10k
+                - /bin/sh
+                - -c
+              args:
+                - |
+                  set -e
+                  echo "Cloning r10k config repository..."
+                  git clone https://git.unkin.net/unkin/puppet-r10k.git /share
+                  echo "Running g10k..."
+                  /usr/bin/g10k -config /share/r10k.yaml
               envFrom: null
               env: []
               securityContext:
@@ -87,8 +60,6 @@ spec:
               volumeMounts:
                 - mountPath: /etc/puppetlabs/code/
                   name: puppet-code-volume
-                - mountPath: /shared
-                  name: shared-config
           restartPolicy: OnFailure
           securityContext:
             fsGroup: 999
@@ -96,6 +67,3 @@ spec:
             - name: puppet-code-volume
               persistentVolumeClaim:
                 claimName: puppetserver-code-shared
-            - name: shared-config
-              persistentVolumeClaim:
-                claimName: puppetserver-shared-config
diff --git a/apps/base/puppet/persistentvolumeclaims.yaml b/apps/base/puppet/persistentvolumeclaims.yaml
index f6bd3c5..0efa284 100644
--- a/apps/base/puppet/persistentvolumeclaims.yaml
+++ b/apps/base/puppet/persistentvolumeclaims.yaml
@@ -73,24 +73,6 @@ spec:
 ---
 apiVersion: v1
 kind: PersistentVolumeClaim
-metadata:
-  labels:
-    app.kubernetes.io/component: r10k-shared-config
-    app.kubernetes.io/instance: puppetserver
-    app.kubernetes.io/name: puppetserver
-    app.kubernetes.io/version: 8.8.0
-  name: puppetserver-shared-config
-  namespace: puppet
-spec:
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: 1Gi
-  storageClassName: cephrbd-fast-delete
----
-apiVersion: v1
-kind: PersistentVolumeClaim
 metadata:
   labels:
     app.kubernetes.io/component: puppetboard