arrstack: use waitfordb initContainer instead of inline psql loop #386

2026-08-22T15:17:25+10:00

unkin-agent commented

2026-08-22 15:17:25 +10:00

Why

The sonarr/radarr/prowlarr deployments gated app startup on their Postgres
database being reachable using a hand-written psql-in-a-shell loop running
the postgres:17-alpine image. Now that unkin/waitfordb is released
(v0.1.0), replace that inline probe with the purpose-built tool so the wait
logic lives in one tested place instead of being copy-pasted per workload.

waitfordb reads the same PG* env as a libpq fallback and exits 0 once
SELECT 1 succeeds under those credentials/database, so the retrofit is a
drop-in — the password still never lands in argv.

Changes

Swap the wait-for-db initContainer image from dockerhub/library/postgres:17-alpine
to docker-internal/waitfordb:v0.1.0 (pinned, not latest) in all three
arrstack deployments.
Drop the sh -c psql loop command — waitfordb is the image entrypoint.
Keep the existing PGHOST/PGPORT/PGDATABASE/PGUSER/PGPASSWORD env, the
wait-for-db name, and the resource requests/limits unchanged.
Add WAITFORDB_TIMEOUT=5m so a stuck database fails the pod fast, and
WAITFORDB_SSLMODE=disable to match the in-cluster Postgres.

Validated with kubectl kustomize apps/overlays/au-syd1/arrstack (builds clean;
3 waitfordb refs, no remaining postgres init image).

## Why The sonarr/radarr/prowlarr deployments gated app startup on their Postgres database being reachable using a hand-written `psql`-in-a-shell loop running the `postgres:17-alpine` image. Now that `unkin/waitfordb` is released (v0.1.0), replace that inline probe with the purpose-built tool so the wait logic lives in one tested place instead of being copy-pasted per workload. `waitfordb` reads the same `PG*` env as a libpq fallback and exits `0` once `SELECT 1` succeeds under those credentials/database, so the retrofit is a drop-in — the password still never lands in argv. ## Changes - Swap the `wait-for-db` initContainer image from `dockerhub/library/postgres:17-alpine` to `docker-internal/waitfordb:v0.1.0` (pinned, not `latest`) in all three arrstack deployments. - Drop the `sh -c` psql loop `command` — `waitfordb` is the image entrypoint. - Keep the existing `PGHOST/PGPORT/PGDATABASE/PGUSER/PGPASSWORD` env, the `wait-for-db` name, and the resource requests/limits unchanged. - Add `WAITFORDB_TIMEOUT=5m` so a stuck database fails the pod fast, and `WAITFORDB_SSLMODE=disable` to match the in-cluster Postgres. Validated with `kubectl kustomize apps/overlays/au-syd1/arrstack` (builds clean; 3 waitfordb refs, no remaining postgres init image).

unkin-agent added 1 commit 2026-08-22 15:17:25 +10:00

arrstack: use waitfordb initContainer instead of inline psql loop

ci/woodpecker/pr/vector-test Pipeline was successful

Details

ci/woodpecker/pr/pre-commit Pipeline was successful

Details

ci/woodpecker/pr/kubeconform Pipeline was successful

Details

6018ee8221

The sonarr/radarr/prowlarr deployments gated startup on Postgres with a
hand-written psql-in-a-shell loop running the postgres:17-alpine image.
Replace it with the purpose-built waitfordb image (v0.1.0), which reads the
same PG* env as a libpq fallback and exits 0 once SELECT 1 succeeds.

- swap image to docker-internal/waitfordb:v0.1.0 (pinned), drop the sh/psql
  command (waitfordb is the entrypoint)
- keep the existing PGHOST/PGPORT/PGDATABASE/PGUSER/PGPASSWORD env, name,
  and resources unchanged
- add WAITFORDB_TIMEOUT=5m so a stuck DB fails the pod fast, and
  WAITFORDB_SSLMODE=disable to match the in-cluster Postgres

benvin merged commit 5155cee5e7 into main

2026-08-22 16:15:46 +10:00

benvin deleted branch benvin/arrstack-use-waitfordb

2026-08-22 16:15:46 +10:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: unkin/argocd-apps#386