Ben Vincent
878df4f97c
## Why
ArgoCD fails to sync the puppet app with:
Deployment.apps "puppetserver-master" is invalid:
spec.strategy.rollingUpdate: Forbidden: may not be specified when strategy type is 'Recreate'
The manifest is already correct: #341 changed the master to
`spec.strategy.type: Recreate` with no rollingUpdate block. The failure is a
live-object artifact. When the master ran RollingUpdate, the API server
defaulted `spec.strategy.rollingUpdate` (maxSurge/maxUnavailable) onto the
object. That defaulted field is owned by no applier, so neither a client-side
merge nor server-side apply drops it when the desired manifest omits it. The
live object therefore keeps `rollingUpdate` while gaining `type: Recreate`,
which the API server rejects — blocking every sync.
## Changes
- Annotate the `puppetserver-master` Deployment with
`argocd.argoproj.io/sync-options: Replace=true`. Replace performs a full PUT
that overwrites the whole object, dropping the stale `rollingUpdate` field
and letting the Recreate strategy apply cleanly. The annotation is scoped to
this one resource, so puppetdb/puppetboard/compiler keep the app-wide
ServerSideApply behaviour.
174 lines
5.9 KiB
YAML
174 lines
5.9 KiB
YAML
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
annotations:
|
|
configmap.reloader.stakater.com/auto: "true"
|
|
secret.reloader.stakater.com/reload: "vault-ca-cert"
|
|
# Replace clears the stale, API-server-defaulted spec.strategy.rollingUpdate that SSA cannot drop, which otherwise makes Recreate invalid.
|
|
argocd.argoproj.io/sync-options: Replace=true
|
|
labels:
|
|
app.kubernetes.io/component: puppetserver
|
|
app.kubernetes.io/instance: puppetserver
|
|
app.kubernetes.io/name: puppetserver
|
|
app.kubernetes.io/version: 8.8.0
|
|
name: puppetserver-master
|
|
namespace: puppet
|
|
spec:
|
|
replicas: 1
|
|
selector:
|
|
matchLabels:
|
|
app.kubernetes.io/component: puppetserver
|
|
app.kubernetes.io/name: puppetserver
|
|
strategy:
|
|
type: Recreate
|
|
template:
|
|
metadata:
|
|
annotations:
|
|
configmap.reloader.stakater.com/auto: "true"
|
|
labels:
|
|
app.kubernetes.io/component: puppetserver
|
|
app.kubernetes.io/instance: puppetserver
|
|
app.kubernetes.io/name: puppetserver
|
|
app.kubernetes.io/version: 8.8.0
|
|
spec:
|
|
hostname: puppet
|
|
imagePullSecrets: null
|
|
containers:
|
|
- name: puppetserver
|
|
image: ghcr.io/openvoxproject/openvoxserver:8.8.0-main
|
|
imagePullPolicy: IfNotPresent
|
|
resources:
|
|
limits:
|
|
cpu: 2
|
|
memory: 3500Mi
|
|
requests:
|
|
cpu: 100m
|
|
memory: 1024Mi
|
|
ports:
|
|
- containerPort: 8140
|
|
name: puppetserver
|
|
envFrom:
|
|
- configMapRef:
|
|
name: puppetserver-master-config
|
|
livenessProbe:
|
|
failureThreshold: 3
|
|
periodSeconds: 30
|
|
successThreshold: 1
|
|
tcpSocket:
|
|
port: 8140
|
|
timeoutSeconds: 10
|
|
readinessProbe:
|
|
failureThreshold: 3
|
|
httpGet:
|
|
path: /status/v1/simple
|
|
port: 8140
|
|
scheme: HTTPS
|
|
periodSeconds: 60
|
|
successThreshold: 1
|
|
timeoutSeconds: 20
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
# Root entrypoint chowns baked-in dirs (CHOWN) then drops the JVM to
|
|
# the puppet user via `runuser` (needs SETUID/SETGID). Cannot run
|
|
# non-root: the image entrypoint requires a root start.
|
|
capabilities:
|
|
add:
|
|
- CHOWN
|
|
- DAC_OVERRIDE
|
|
- FOWNER
|
|
- SETGID
|
|
- SETUID
|
|
drop:
|
|
- all
|
|
startupProbe:
|
|
failureThreshold: 30
|
|
periodSeconds: 60
|
|
tcpSocket:
|
|
port: 8140
|
|
volumeMounts:
|
|
- mountPath: /etc/puppetlabs/puppet/
|
|
name: puppet-puppet-storage
|
|
- mountPath: /etc/puppetlabs/puppetserver/ca/
|
|
name: puppet-ca-storage
|
|
- mountPath: /var/lib/puppet/keys/
|
|
name: eyaml-keys
|
|
readOnly: true
|
|
- mountPath: /opt/bin/
|
|
name: puppet-shared-bins
|
|
- mountPath: /opt/vault-ca-cert.crt
|
|
name: vault-ca-cert
|
|
subPath: ca.crt
|
|
initContainers:
|
|
- name: perms-and-dirs
|
|
image: ghcr.io/openvoxproject/openvoxserver:8.8.0-main
|
|
imagePullPolicy: IfNotPresent
|
|
command:
|
|
- sh
|
|
- -c
|
|
args:
|
|
- |
|
|
mkdir -p /etc/puppetlabs/puppet/eyaml/keys
|
|
cp /tmp/puppet/configmap/check_for_masters.sh /etc/puppetlabs/puppet/check_for_masters.sh
|
|
chown puppet:puppet /etc/puppetlabs/puppet/check_for_masters.sh
|
|
chmod +x /etc/puppetlabs/puppet/check_for_masters.sh
|
|
bash /etc/puppetlabs/puppet/check_for_masters.sh
|
|
mkdir -p /etc/puppetlabs/code/environments
|
|
mkdir -p /etc/puppetlabs/puppet/manifests
|
|
chown -R puppet:puppet /etc/puppetlabs
|
|
mkdir -p /opt/puppetlabs/server/data/puppetserver/dropsonde/bin/
|
|
touch /opt/puppetlabs/server/data/puppetserver/dropsonde/bin/dropsonde
|
|
chown puppet:puppet -R /opt/puppetlabs/server/data/puppetserver/
|
|
envFrom:
|
|
- configMapRef:
|
|
name: puppetserver-init-config
|
|
resources:
|
|
limits:
|
|
cpu: 300m
|
|
memory: 256Mi
|
|
requests:
|
|
cpu: 200m
|
|
memory: 128Mi
|
|
securityContext:
|
|
runAsUser: 0
|
|
runAsNonRoot: false
|
|
allowPrivilegeEscalation: false
|
|
# Runs as root to chown the mounted PVC dirs to puppet:puppet before
|
|
# the main container starts (CHOWN); does not drop privileges itself.
|
|
capabilities:
|
|
add:
|
|
- CHOWN
|
|
- DAC_OVERRIDE
|
|
- FOWNER
|
|
drop:
|
|
- all
|
|
volumeMounts:
|
|
- mountPath: /etc/puppetlabs/puppet/
|
|
name: puppet-puppet-storage
|
|
- mountPath: /tmp/puppet/configmap/check_for_masters.sh
|
|
name: init-masters-volume
|
|
subPath: check_for_masters.sh
|
|
securityContext:
|
|
fsGroup: 999
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
volumes:
|
|
- name: puppet-ca-storage
|
|
persistentVolumeClaim:
|
|
claimName: puppetserver-ca-claim
|
|
- name: puppet-puppet-storage
|
|
persistentVolumeClaim:
|
|
claimName: puppetserver-puppet-claim
|
|
- configMap:
|
|
name: puppetserver-init-masters-config
|
|
name: init-masters-volume
|
|
- name: eyaml-keys
|
|
secret:
|
|
secretName: eyaml-keys
|
|
defaultMode: 0600
|
|
- name: puppet-shared-bins
|
|
persistentVolumeClaim:
|
|
claimName: puppet-shared-bins
|
|
- name: vault-ca-cert
|
|
secret:
|
|
secretName: vault-ca-cert
|