arrstack: gate apps on DB via initContainer instead of sync-waves

Per review: drop the ArgoCD sync-wave annotations (their health-gating is what deadlocked the first deploy) and instead add a wait-for-db init container to each app that blocks until its own Postgres database+role is reachable (libpq PG* env, password never in argv). ArgoCD applies everything at once; the app container only starts once its DB is ready.
2026-08-22 12:38:02 +10:00
parent df687e310b
commit 60309fc5c2
9 changed files with 114 additions and 22 deletions
@@ -28,6 +28,44 @@ spec:
        runAsGroup: 1000
        fsGroup: 1000
        fsGroupChangePolicy: OnRootMismatch
+      initContainers:
+        # Gate the app on its own Postgres database+role being reachable, instead
+        # of relying on ArgoCD sync-waves (which deadlock if apps aren't Healthy).
+        # libpq reads PG* from env, so the password never lands in argv.
+        - name: wait-for-db
+          image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/postgres:17-alpine
+          command:
+            - sh
+            - -c
+            - |
+              until psql -tAc 'select 1' >/dev/null 2>&1; do
+                echo "waiting for $PGDATABASE on $PGHOST..."; sleep 3
+              done
+              echo "database ready"
+          env:
+            - name: PGHOST
+              value: arrstack-postgres-rw.arrstack.svc.cluster.local
+            - name: PGPORT
+              value: "5432"
+            - name: PGDATABASE
+              value: sonarr-main
+            - name: PGUSER
+              valueFrom:
+                secretKeyRef:
+                  name: sonarr-db
+                  key: username
+            - name: PGPASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: sonarr-db
+                  key: password
+          resources:
+            requests:
+              cpu: 10m
+              memory: 32Mi
+            limits:
+              cpu: 100m
+              memory: 64Mi
      containers:
        - name: sonarr
          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/sonarr:v5.0.0-unkin2