unkinben
d9eb13c3e6
The nats-bootstrap PostSync Job failed at deploy time with "could not load schema ... stat .: permission denied". The nats CLI stats its working directory when loading response-validation schemas, and under the Job's readOnlyRootFilesystem + runAsUser 1000 the image's default WORKDIR is not accessible. Set workingDir: /tmp (the writable emptyDir already mounted for HOME) so the CLI can stat/operate. Verified against the live cluster: a nats-box pod with the exact restrictive securityContext + workingDir: /tmp runs `nats stream info` cleanly. Without this the PostSync hook never completes, so the logging-logging app stays OutOfSync (the LOGS stream/consumers persist in JetStream once created, so log flow is unaffected, but GitOps convergence is blocked). Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv
argocd-apps docs
Operational notes for the manifests in this repo.
| Doc | What it covers |
|---|---|
| cnpg-backups.md | How CNPG Postgres backups (WAL archiving + nightly base backups) to Ceph RGW are configured. |
| cnpg-restore.md | Restoring a CNPG cluster: full recovery, point-in-time recovery, cutover, and gotchas. |