fix: deploy bounded postgres ownership reconciliation #66

Merged

morten-olsen merged 1 commit from fix/3f88f077-postgres-rollout into main

2026-10-24 21:13:51 +02:00

morten-olsen commented

2026-10-24 19:56:31 +02:00

Owner

Summary

Pin postgres-operator 0.0.19 to deploy conditional ownership repair with bounded lock waits. Publish homelab-core chart 0.1.6. This is rollout phase 1; Authentik stays on 0.1.0 until this operator is verified.

Depends on postgres-operator #1 publishing approved 0.0.19 artifacts. Do not merge before the artifacts exist and Morten approves the core chart publication. The following Authentik rollout is a separate phase so it cannot race the database operator replacement.

Evidence

Canonical scripts/ci/validate-charts.sh passes: Helm lint and core/shared/monitor render and rule tests.
Rendered Postgres ArgoCD Application passes kubectl apply --dry-run=server at targetRevision 0.0.19.
Operator unit, lint and Kind E2E CI are green at d6ecb61; ownership contention regression passes on isolated PostgreSQL.
Woodpecker PR pipeline 130 passes; the corresponding push pipeline also passes. No live state was changed.

Merge danger

Door: one-way publication. Main automatically packages and republishes the Helm repository, including new homelab-core 0.1.6. Release approval is required. ArgoCD also reconciles the Git change immediately.

Blast radius: household. Every managed PostgresDatabase is reconciled. Read-only preflight found 17 existing type-owner mismatches outside Authentik; they will be repaired under the existing ownership policy. Data and database server images are unchanged.

Rollback and verification

Roll back: restore postgres pin 0.0.18 through GitOps with a fresh core chart version. Completed ownership repairs and published artifacts are not undone by restoring the image.
Verify: CI, mirror/main revision, ArgoCD postgres at 0.0.19, actual operator digest/readiness, all PostgresDatabase conditions and no ownership lock queues. Then proceed with the Authentik phase.
Reviewers: self-review; no RBAC, exposure, secret or image-source expansion.

## Summary Pin postgres-operator 0.0.19 to deploy conditional ownership repair with bounded lock waits. Publish homelab-core chart 0.1.6. This is rollout phase 1; Authentik stays on 0.1.0 until this operator is verified. Depends on [postgres-operator #1](https://code.olsen.cloud/homelab/postgres-operator/pulls/1) publishing approved 0.0.19 artifacts. Do not merge before the artifacts exist and Morten approves the core chart publication. The following Authentik rollout is a separate phase so it cannot race the database operator replacement. ## Evidence - Canonical scripts/ci/validate-charts.sh passes: Helm lint and core/shared/monitor render and rule tests. - Rendered Postgres ArgoCD Application passes kubectl apply --dry-run=server at targetRevision 0.0.19. - Operator unit, lint and Kind E2E CI are green at d6ecb61; ownership contention regression passes on isolated PostgreSQL. - Woodpecker PR pipeline [130](https://woodpecker.olsen.cloud/repos/6/pipeline/130) passes; the corresponding push pipeline also passes. No live state was changed. ## Merge danger **Door:** one-way publication. Main automatically packages and republishes the Helm repository, including new homelab-core 0.1.6. Release approval is required. ArgoCD also reconciles the Git change immediately. **Blast radius:** household. Every managed PostgresDatabase is reconciled. Read-only preflight found 17 existing type-owner mismatches outside Authentik; they will be repaired under the existing ownership policy. Data and database server images are unchanged. ## Rollback and verification - **Roll back:** restore postgres pin 0.0.18 through GitOps with a fresh core chart version. Completed ownership repairs and published artifacts are not undone by restoring the image. - **Verify:** CI, mirror/main revision, ArgoCD postgres at 0.0.19, actual operator digest/readiness, all PostgresDatabase conditions and no ownership lock queues. Then proceed with the Authentik phase. - **Reviewers:** self-review; no RBAC, exposure, secret or image-source expansion.

morten-olsen added 1 commit

2026-10-24 19:56:31 +02:00

fix: deploy bounded postgres ownership reconciliation

ci/woodpecker/pr/charts Pipeline was successful

Details

ci/woodpecker/push/scan Pipeline was successful

Details

ci/woodpecker/push/charts Pipeline was successful

Details

925ddab739

morten-olsen referenced this pull request

2026-10-24 19:57:07 +02:00

fix: deploy Authentik server startup protection #67

morten-olsen changed title from ~~WIP: fix: deploy bounded postgres ownership reconciliation~~ to fix: deploy bounded postgres ownership reconciliation

2026-10-24 21:13:22 +02:00

morten-olsen merged commit 925ddab739 into main

2026-10-24 21:13:51 +02:00