Restart Stalwart after applying the plan; move mail DNS record out

apps/base/bind-internal/authoritative/unkin-net/a/kustomization.yaml

@@ -16,6 +16,5 @@ resources:
   - identity.yaml
   - lb1.yaml
   - logviewer.yaml
-  - mail.yaml
   - vlogs.yaml
   - watchstate.yaml

apps/base/bind-internal/authoritative/unkin-net/a/mail.yaml

@@ -1,14 +0,0 @@
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: DNSRecord
-metadata:
-  name: mail-dns-internal
-  namespace: bind-internal
-spec:
-  zoneRef: unkin-net
-  name: mail
-  type: A
-  ttl: 600
-  values:
-    # stalwart-lb PureLB VIP (IMAPS, submission, HTTPS).
-    - 198.18.200.11

apps/base/mail/kustomization.yaml

@@ -9,6 +9,7 @@ resources:
   - httproute.yaml
   - namespace.yaml
   - stalwart-apply-job.yaml
+  - stalwart-apply-rbac.yaml
   - stalwart-blobs-bucket.yaml
   - stalwart-configmap.yaml
   - stalwart-deployment.yaml

apps/base/mail/stalwart-apply-job.yaml

@@ -1,6 +1,7 @@
 ---
 # Converges Stalwart's database-held settings to plan.ndjson after every sync,
-# then reloads them. Store and listener changes only bind on a pod restart.
+# then restarts the pod: listener and store changes only bind on startup.
+# ponytail: restarts on every sync since neither image has a shell to diff apply output.
 apiVersion: batch/v1
 kind: Job
 metadata:
@@ -18,6 +19,7 @@ spec:
         app.kubernetes.io/name: stalwart-apply
     spec:
       restartPolicy: Never
+      serviceAccountName: stalwart-apply
       securityContext:
         runAsNonRoot: true
         seccompProfile:
@@ -60,25 +62,16 @@ spec:
               mountPath: /plan
               readOnly: true
       containers:
-        - name: reload
-          image: docker.io/stalwartlabs/cli:1.0.13
+        - name: restart
+          image: registry.k8s.io/kubectl:v1.33.13
           args:
-            - create
-            - action/ReloadSettings
-          env:
-            - name: STALWART_URL
-              value: http://stalwart.mail.svc:8080
-            - name: STALWART_USER
-              valueFrom:
-                secretKeyRef:
-                  name: stalwart-admin
-                  key: username
-            - name: STALWART_PASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: stalwart-admin
-                  key: password
+            - rollout
+            - restart
+            - deployment/stalwart
+            - --namespace=mail
           securityContext:
+            runAsUser: 65532
+            runAsGroup: 65532
             allowPrivilegeEscalation: false
             readOnlyRootFilesystem: true
             capabilities:

apps/base/mail/stalwart-apply-rbac.yaml

@@ -0,0 +1,37 @@
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: stalwart-apply
+  namespace: mail
+---
+# Lets the stalwart-apply Job roll the Stalwart pod after applying the plan.
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: stalwart-apply
+  namespace: mail
+rules:
+  - apiGroups:
+      - apps
+    resources:
+      - deployments
+    resourceNames:
+      - stalwart
+    verbs:
+      - get
+      - patch
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: stalwart-apply
+  namespace: mail
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: stalwart-apply
+subjects:
+  - kind: ServiceAccount
+    name: stalwart-apply
+    namespace: mail