unkin-agent
283f9e8ac4
The stalwart-apply PostSync Job fails with "Read-only file system": stalwart-cli caches the server schema under $HOME/.cache, which sits on the read-only root. The plan never applies, so Stalwart runs without its certificate, listeners or stdout tracer. - mount a /tmp emptyDir in both Job containers - set HOME=/tmp for the cli and kubectl (discovery cache) Reviewed-on: #549 Co-authored-by: unkin-agent <unkin-agent@unkin.net> Co-committed-by: unkin-agent <unkin-agent@unkin.net>
109 lines
3.0 KiB
YAML
109 lines
3.0 KiB
YAML
---
|
|
# Converges Stalwart's database-held settings to plan.ndjson after every sync,
|
|
# then rolls the StatefulSet: listener, store and coordinator changes only bind
|
|
# on startup. It rolls on every sync because neither image has a shell to diff the
|
|
# apply output.
|
|
apiVersion: batch/v1
|
|
kind: Job
|
|
metadata:
|
|
name: stalwart-apply
|
|
namespace: mail
|
|
annotations:
|
|
argocd.argoproj.io/hook: PostSync
|
|
argocd.argoproj.io/hook-delete-policy: BeforeHookCreation
|
|
spec:
|
|
activeDeadlineSeconds: 300
|
|
backoffLimit: 2
|
|
ttlSecondsAfterFinished: 600
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app.kubernetes.io/name: stalwart-apply
|
|
spec:
|
|
restartPolicy: Never
|
|
serviceAccountName: stalwart-apply
|
|
securityContext:
|
|
runAsNonRoot: true
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
initContainers:
|
|
- name: apply
|
|
image: docker.io/stalwartlabs/cli:1.0.13
|
|
args:
|
|
- apply
|
|
- --file
|
|
- /plan/plan.ndjson
|
|
env:
|
|
# the cli caches the server schema under $HOME/.cache
|
|
- name: HOME
|
|
value: /tmp
|
|
- name: STALWART_URL
|
|
value: http://stalwart.mail.svc:8080
|
|
- name: STALWART_USER
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: stalwart-admin
|
|
key: username
|
|
- name: STALWART_PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: stalwart-admin
|
|
key: password
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
readOnlyRootFilesystem: true
|
|
capabilities:
|
|
drop:
|
|
- ALL
|
|
resources:
|
|
limits:
|
|
cpu: 200m
|
|
memory: 128Mi
|
|
requests:
|
|
cpu: 50m
|
|
memory: 32Mi
|
|
volumeMounts:
|
|
- name: plan
|
|
mountPath: /plan
|
|
readOnly: true
|
|
- name: tmp
|
|
mountPath: /tmp
|
|
containers:
|
|
- name: restart
|
|
image: registry.k8s.io/kubectl:v1.33.13
|
|
args:
|
|
- rollout
|
|
- restart
|
|
- statefulset/stalwart
|
|
- --namespace=mail
|
|
env:
|
|
- name: HOME
|
|
value: /tmp
|
|
securityContext:
|
|
runAsUser: 65532
|
|
runAsGroup: 65532
|
|
allowPrivilegeEscalation: false
|
|
readOnlyRootFilesystem: true
|
|
capabilities:
|
|
drop:
|
|
- ALL
|
|
resources:
|
|
limits:
|
|
cpu: 200m
|
|
memory: 128Mi
|
|
requests:
|
|
cpu: 50m
|
|
memory: 32Mi
|
|
volumeMounts:
|
|
- name: tmp
|
|
mountPath: /tmp
|
|
volumes:
|
|
- name: plan
|
|
configMap:
|
|
name: stalwart-config
|
|
items:
|
|
- key: plan.ndjson
|
|
path: plan.ndjson
|
|
- name: tmp
|
|
emptyDir: {}
|