unkin/argocd-apps
3
0
Fork 0
Code Issues 7 Pull Requests 2 Actions Packages Projects Releases Wiki Activity

arrstack: fix sync-wave deadlock + config multi-attach (#385)

Browse Source 
## Why
The active-active arrstack deploy (#383) is stuck in-cluster: the app Deployments (sync-wave 0) can never become Healthy without their Postgres DB, so ArgoCD never advances to create the shared `arrstack-postgres` cluster (wave 1). Separately, `/config` is an immutable RWO cephrbd PVC, so 3 replicas fail with Multi-Attach.

## How
- Order DB infra before the apps: `<app>-db` VaultStaticSecrets + backup ObjectStoreUser/Bucket at sync-wave -3, CNPG `Cluster` -2, `Database` CRDs -1; app Deployments stay at default 0.
- Switch each app's `/config` to an emptyDir per-pod volume (library DB is in Postgres, config is env-driven; MediaCover regenerates). Old RWO config PVCs orphan.

Validated with kustomize build (62 resources). arrproxy/nzbget untouched.

Reviewed-on: #385
Co-authored-by: unkin-agent <unkin-agent@unkin.net>
Co-committed-by: unkin-agent <unkin-agent@unkin.net>
This commit was merged in pull request #385.
This commit is contained in:
Unkin Agent
2026-08-22 12:47:38 +10:00
committed by BenVincent
parent e0d47295f2
commit 8446c31414
11 changed files with 117 additions and 26 deletions
Download Patch File Download Diff File Expand all files Collapse all files
apps/base/arrstack/postgres/cnpg_cluster.yaml
-5
View File
@@ -11,11 +11,6 @@ kind: Cluster
metadata:
name: arrstack-postgres
namespace: arrstack
annotations:
# Wave 1: the per-app <app>-db Secrets (wave 0) must exist first — CNPG reads
# them as the managed roles' passwordSecret. ArgoCD gates dependents on the
# Cluster's health status.
argocd.argoproj.io/sync-wave: "1"
spec:
inheritedMetadata:
annotations:
apps/base/arrstack/postgres/database-prowlarr.yaml
-2
View File
@@ -7,8 +7,6 @@ kind: Database
metadata:
name: prowlarr-main
namespace: arrstack
annotations:
argocd.argoproj.io/sync-wave: "2"
spec:
cluster:
name: arrstack-postgres
apps/base/arrstack/postgres/database-radarr.yaml
-2
View File
@@ -7,8 +7,6 @@ kind: Database
metadata:
name: radarr-main
namespace: arrstack
annotations:
argocd.argoproj.io/sync-wave: "2"
spec:
cluster:
name: arrstack-postgres
apps/base/arrstack/postgres/database-sonarr.yaml
-2
View File
@@ -7,8 +7,6 @@ kind: Database
metadata:
name: sonarr-main
namespace: arrstack
annotations:
argocd.argoproj.io/sync-wave: "2"
spec:
cluster:
name: arrstack-postgres
apps/base/arrstack/postgres/vaultstaticsecret.yaml
-6
View File
@@ -13,8 +13,6 @@ kind: VaultStaticSecret
metadata:
name: sonarr-db
namespace: arrstack
annotations:
argocd.argoproj.io/sync-wave: "0"
spec:
destination:
create: true
@@ -32,8 +30,6 @@ kind: VaultStaticSecret
metadata:
name: radarr-db
namespace: arrstack
annotations:
argocd.argoproj.io/sync-wave: "0"
spec:
destination:
create: true
@@ -51,8 +47,6 @@ kind: VaultStaticSecret
metadata:
name: prowlarr-db
namespace: arrstack
annotations:
argocd.argoproj.io/sync-wave: "0"
spec:
destination:
create: true
apps/base/arrstack/prowlarr/deployment.yaml
+39 -2
View File
@@ -28,6 +28,44 @@ spec:
runAsGroup: 1000
fsGroup: 1000
fsGroupChangePolicy: OnRootMismatch
initContainers:
# Gate the app on its own Postgres database+role being reachable, instead
# of relying on ArgoCD sync-waves (which deadlock if apps aren't Healthy).
# libpq reads PG* from env, so the password never lands in argv.
- name: wait-for-db
image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/postgres:17-alpine
command:
- sh
- -c
- |
until psql -tAc 'select 1' >/dev/null 2>&1; do
echo "waiting for $PGDATABASE on $PGHOST..."; sleep 3
done
echo "database ready"
env:
- name: PGHOST
value: arrstack-postgres-rw.arrstack.svc.cluster.local
- name: PGPORT
value: "5432"
- name: PGDATABASE
value: prowlarr-main
- name: PGUSER
valueFrom:
secretKeyRef:
name: prowlarr-db
key: username
- name: PGPASSWORD
valueFrom:
secretKeyRef:
name: prowlarr-db
key: password
resources:
requests:
cpu: 10m
memory: 32Mi
limits:
cpu: 100m
memory: 64Mi
containers:
- name: prowlarr
image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/prowlarr:v2.6.2-unkin2
@@ -92,5 +130,4 @@ spec:
mountPath: /config
volumes:
- name: config
persistentVolumeClaim:
claimName: prowlarr-config
emptyDir: {}
apps/base/arrstack/prowlarr/kustomization.yaml
-1
View File
@@ -3,7 +3,6 @@ apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- pvc-config.yaml
- vaultstaticsecret.yaml
- configmap.yaml
- deployment.yaml
apps/base/arrstack/radarr/deployment.yaml
+39 -2
View File
@@ -28,6 +28,44 @@ spec:
runAsGroup: 1000
fsGroup: 1000
fsGroupChangePolicy: OnRootMismatch
initContainers:
# Gate the app on its own Postgres database+role being reachable, instead
# of relying on ArgoCD sync-waves (which deadlock if apps aren't Healthy).
# libpq reads PG* from env, so the password never lands in argv.
- name: wait-for-db
image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/postgres:17-alpine
command:
- sh
- -c
- |
until psql -tAc 'select 1' >/dev/null 2>&1; do
echo "waiting for $PGDATABASE on $PGHOST..."; sleep 3
done
echo "database ready"
env:
- name: PGHOST
value: arrstack-postgres-rw.arrstack.svc.cluster.local
- name: PGPORT
value: "5432"
- name: PGDATABASE
value: radarr-main
- name: PGUSER
valueFrom:
secretKeyRef:
name: radarr-db
key: username
- name: PGPASSWORD
valueFrom:
secretKeyRef:
name: radarr-db
key: password
resources:
requests:
cpu: 10m
memory: 32Mi
limits:
cpu: 100m
memory: 64Mi
containers:
- name: radarr
image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/radarr:v6.4.2-unkin2
@@ -94,8 +132,7 @@ spec:
mountPath: /media/movies
volumes:
- name: config
persistentVolumeClaim:
claimName: radarr-config
emptyDir: {}
- name: media-movies
persistentVolumeClaim:
claimName: media-movies
apps/base/arrstack/radarr/kustomization.yaml
-1
View File
@@ -3,7 +3,6 @@ apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- pvc-config.yaml
- vaultstaticsecret.yaml
- configmap.yaml
- deployment.yaml
apps/base/arrstack/sonarr/deployment.yaml
+39 -2
View File
@@ -28,6 +28,44 @@ spec:
runAsGroup: 1000
fsGroup: 1000
fsGroupChangePolicy: OnRootMismatch
initContainers:
# Gate the app on its own Postgres database+role being reachable, instead
# of relying on ArgoCD sync-waves (which deadlock if apps aren't Healthy).
# libpq reads PG* from env, so the password never lands in argv.
- name: wait-for-db
image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/postgres:17-alpine
command:
- sh
- -c
- |
until psql -tAc 'select 1' >/dev/null 2>&1; do
echo "waiting for $PGDATABASE on $PGHOST..."; sleep 3
done
echo "database ready"
env:
- name: PGHOST
value: arrstack-postgres-rw.arrstack.svc.cluster.local
- name: PGPORT
value: "5432"
- name: PGDATABASE
value: sonarr-main
- name: PGUSER
valueFrom:
secretKeyRef:
name: sonarr-db
key: username
- name: PGPASSWORD
valueFrom:
secretKeyRef:
name: sonarr-db
key: password
resources:
requests:
cpu: 10m
memory: 32Mi
limits:
cpu: 100m
memory: 64Mi
containers:
- name: sonarr
image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/sonarr:v5.0.0-unkin2
@@ -94,8 +132,7 @@ spec:
mountPath: /media/tv
volumes:
- name: config
persistentVolumeClaim:
claimName: sonarr-config
emptyDir: {}
- name: media-tv
persistentVolumeClaim:
claimName: media-tv
apps/base/arrstack/sonarr/kustomization.yaml
-1
View File
@@ -3,7 +3,6 @@ apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- pvc-config.yaml
- vaultstaticsecret.yaml
- configmap.yaml
- deployment.yaml