From 5155cee5e7a549d5661384d9185b9a3e3f85f785 Mon Sep 17 00:00:00 2001 From: unkin-agent Date: Sat, 22 Aug 2026 16:15:45 +1000 Subject: [PATCH] arrstack: use waitfordb initContainer instead of inline psql loop (#386) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ## Why The sonarr/radarr/prowlarr deployments gated app startup on their Postgres database being reachable using a hand-written `psql`-in-a-shell loop running the `postgres:17-alpine` image. Now that `unkin/waitfordb` is released (v0.1.0), replace that inline probe with the purpose-built tool so the wait logic lives in one tested place instead of being copy-pasted per workload. `waitfordb` reads the same `PG*` env as a libpq fallback and exits `0` once `SELECT 1` succeeds under those credentials/database, so the retrofit is a drop-in — the password still never lands in argv. ## Changes - Swap the `wait-for-db` initContainer image from `dockerhub/library/postgres:17-alpine` to `docker-internal/waitfordb:v0.1.0` (pinned, not `latest`) in all three arrstack deployments. - Drop the `sh -c` psql loop `command` — `waitfordb` is the image entrypoint. - Keep the existing `PGHOST/PGPORT/PGDATABASE/PGUSER/PGPASSWORD` env, the `wait-for-db` name, and the resource requests/limits unchanged. - Add `WAITFORDB_TIMEOUT=5m` so a stuck database fails the pod fast, and `WAITFORDB_SSLMODE=disable` to match the in-cluster Postgres. Validated with `kubectl kustomize apps/overlays/au-syd1/arrstack` (builds clean; 3 waitfordb refs, no remaining postgres init image). Reviewed-on: https://git.unkin.net/unkin/argocd-apps/pulls/386 Co-authored-by: unkin-agent Co-committed-by: unkin-agent --- apps/base/arrstack/prowlarr/deployment.yaml | 16 ++++++---------- apps/base/arrstack/radarr/deployment.yaml | 16 ++++++---------- apps/base/arrstack/sonarr/deployment.yaml | 16 ++++++---------- 3 files changed, 18 insertions(+), 30 deletions(-) diff --git a/apps/base/arrstack/prowlarr/deployment.yaml b/apps/base/arrstack/prowlarr/deployment.yaml index 6ee4d6a..fc976cb 100644 --- a/apps/base/arrstack/prowlarr/deployment.yaml +++ b/apps/base/arrstack/prowlarr/deployment.yaml @@ -31,18 +31,14 @@ spec: initContainers: # Gate the app on its own Postgres database+role being reachable, instead # of relying on ArgoCD sync-waves (which deadlock if apps aren't Healthy). - # libpq reads PG* from env, so the password never lands in argv. + # waitfordb reads the PG* env as a libpq fallback, so the password never lands in argv. - name: wait-for-db - image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/postgres:17-alpine - command: - - sh - - -c - - | - until psql -tAc 'select 1' >/dev/null 2>&1; do - echo "waiting for $PGDATABASE on $PGHOST..."; sleep 3 - done - echo "database ready" + image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/waitfordb:v0.1.0 env: + - name: WAITFORDB_TIMEOUT + value: 5m + - name: WAITFORDB_SSLMODE + value: disable - name: PGHOST value: arrstack-postgres-rw.arrstack.svc.cluster.local - name: PGPORT diff --git a/apps/base/arrstack/radarr/deployment.yaml b/apps/base/arrstack/radarr/deployment.yaml index f52555f..a19e944 100644 --- a/apps/base/arrstack/radarr/deployment.yaml +++ b/apps/base/arrstack/radarr/deployment.yaml @@ -31,18 +31,14 @@ spec: initContainers: # Gate the app on its own Postgres database+role being reachable, instead # of relying on ArgoCD sync-waves (which deadlock if apps aren't Healthy). - # libpq reads PG* from env, so the password never lands in argv. + # waitfordb reads the PG* env as a libpq fallback, so the password never lands in argv. - name: wait-for-db - image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/postgres:17-alpine - command: - - sh - - -c - - | - until psql -tAc 'select 1' >/dev/null 2>&1; do - echo "waiting for $PGDATABASE on $PGHOST..."; sleep 3 - done - echo "database ready" + image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/waitfordb:v0.1.0 env: + - name: WAITFORDB_TIMEOUT + value: 5m + - name: WAITFORDB_SSLMODE + value: disable - name: PGHOST value: arrstack-postgres-rw.arrstack.svc.cluster.local - name: PGPORT diff --git a/apps/base/arrstack/sonarr/deployment.yaml b/apps/base/arrstack/sonarr/deployment.yaml index 9330c47..526b533 100644 --- a/apps/base/arrstack/sonarr/deployment.yaml +++ b/apps/base/arrstack/sonarr/deployment.yaml @@ -31,18 +31,14 @@ spec: initContainers: # Gate the app on its own Postgres database+role being reachable, instead # of relying on ArgoCD sync-waves (which deadlock if apps aren't Healthy). - # libpq reads PG* from env, so the password never lands in argv. + # waitfordb reads the PG* env as a libpq fallback, so the password never lands in argv. - name: wait-for-db - image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/postgres:17-alpine - command: - - sh - - -c - - | - until psql -tAc 'select 1' >/dev/null 2>&1; do - echo "waiting for $PGDATABASE on $PGHOST..."; sleep 3 - done - echo "database ready" + image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/waitfordb:v0.1.0 env: + - name: WAITFORDB_TIMEOUT + value: 5m + - name: WAITFORDB_SSLMODE + value: disable - name: PGHOST value: arrstack-postgres-rw.arrstack.svc.cluster.local - name: PGPORT