feat(plane-ce): opt-in Stakater Reloader annotation (1.8.0) - #309
feat(plane-ce): opt-in Stakater Reloader annotation (1.8.0)#309pratapalakshmi wants to merge 1 commit into
Conversation
1.7.0 gave this chart the externalized-secret contract but nothing to restart the workloads when one of those Secrets changes, so a rotated credential would land in the Kubernetes Secret while the pods kept the value they started with. The credentials would be out of git and still effectively unrotatable. Same flag as plane-cloud 4.9.0, plane-enterprise 3.6.0 and plane-mcp-server 1.5.0: reloader.enabled annotates every workload with reloader.stakater.com/auto, on the workload rather than the pod template, which is where Reloader looks for it. This is what the two dev community environments need before their migration is worth anything -- 1.7.0 alone would move their credentials and leave rotation broken in a way that looks finished. Additive: with the flag off the default render is 0 lines different from published 1.7.0. With it on, 12 of 12 workloads are annotated in both of those environments' real values files. helm lint clean. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
|
Warning Review limit reachedNext included review available in 29 minutes. View limit detailsLimit details: You’ve used the included review currently available. You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Review configuration: ⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (14)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
Closing: we are not adding Reloader annotations to the public charts. The chart does not need to offer this. plane-ce already exposes per-workload So this would have added a second way to do something the chart could already do, on a public chart, for a deployment-specific decision — which workloads should restart when a credential rotates depends on the install, and the datastores generally should not. The annotations go in
|
1 participant
1.7.0 has no reloader flag — checked the published chart and master: no
reloaderblock invalues.yaml, and noreloaderstring anywhere intemplates/.That leaves #285 half-finished in practice. It gave the chart the externalized-secret contract, but nothing restarts the workloads when one of those Secrets changes — so a rotated credential lands in the Kubernetes Secret while the pods keep the value they started with. The credentials would be out of git and still effectively unrotatable, which is worse than obviously-unmigrated because it looks done.
Same flag as plane-cloud 4.9.0 (#707), plane-enterprise 3.6.0 (#278) and plane-mcp-server 1.5.0 (#708):
reloader.enabledannotates every workload withreloader.stakater.com/auto, on the workload rather than the pod template, which is where Reloader looks.Why now
internal-scripts#172migratescommunity-canaryandcommunity-latest, and their secrets are already in AWS (terraform-scripts#117). Without this, that migration ships rotation-broken. Their app PR should pin 1.8.0 and set the flag in the same change rather than bumping twice.Verification
values.yamlrather than chart defaults.helm lintclean.Version
1.7.0 → 1.8.0, matching the minor bumps the other three charts took for this same change. Note #285's description earmarked 1.8.0 for the discrete-parts / DSN work; that work is still blocked on upstream
makeplane/planesupport, so it takes the next number instead. Worth a glance in case you would rather this be 1.7.1 — it is additive and defaults off, so either is defensible.