|
1 | 1 | backupStrategyController: |
2 | 2 | image: "ghcr.io/cozystack/cozystack/backupstrategy-controller:v1.7.0@sha256:990c8ab93b9f14ee7f70473d199558c859fa5e9532d6b1f47a74698f34c07c1b" |
3 | | - # chBackupClientImage is the image rendered into the Altinity strategy |
4 | | - # Pod: it drives clickhouse-backup's HTTP API via curl + jq. |
5 | | - # |
6 | | - # WORKAROUND — platform-migrations is the wrong image for this job and |
7 | | - # should be replaced by a dedicated one (see the TODO below). It is |
8 | | - # reused here only because it happens to bundle curl + jq, and this |
9 | | - # release could not absorb a new image. What that reuse actually costs: |
10 | | - # - the strategy script needs exactly curl, jq, sleep and date, yet |
11 | | - # this image is 349 MB carrying kubectl, helm, git, cozyhr and the |
12 | | - # etcd-migrate binary into a tenant-adjacent backup Pod; |
13 | | - # - its ENTRYPOINT is run-migrations.sh, so only the `command:` |
14 | | - # override in strategy-altinity-default.yaml stands between this Pod |
15 | | - # and running platform migrations with kubectl and helm on the PATH; |
16 | | - # - it couples the backup client to migrations: bumping |
17 | | - # ETCD_OPERATOR_VERSION or editing any migration script re-digests |
18 | | - # this image, forcing this pin to move for reasons that have nothing |
19 | | - # to do with backups. That coupling is what broke — see below. |
20 | | - # |
21 | | - # TODO: replace with a dedicated ch-backup-client image built by THIS |
22 | | - # package's own Makefile (alpine + curl + jq + ca-certificates measures |
23 | | - # 23 MB, 15x smaller). That also removes the cross-package stamp |
24 | | - # entirely, because the pin would then be produced by the package that |
25 | | - # owns it. The often-cited objection — "a second tag release CI must |
26 | | - # re-digest each cut" — is not the real cost: every other first-party |
27 | | - # image already pays it, automatically. The real defect was a pin with |
28 | | - # NO producer, which a package-owned image cannot reproduce. |
29 | | - # |
30 | | - # DO NOT hand-edit: packages/core/platform/Makefile stamps this key with |
31 | | - # the same ref it writes to .migrations.image there, so the two stay in |
32 | | - # lockstep by construction. They previously did not — this key had no |
33 | | - # producer at all and froze at v1.4.0-rc.2 while the other advanced to |
34 | | - # v1.5.0. Two digests under one repository means a promotion tries to |
35 | | - # retag both to the same stable tag, and the write-once guard in |
36 | | - # hack/promote-retag.sh fails the release. hack/image-pin-consistency.bats |
37 | | - # asserts no repository is pinned at more than one digest. |
38 | | - chBackupClientImage: "ghcr.io/cozystack/cozystack/platform-migrations:v1.7.0@sha256:9018fba0873094431cf130cc949d4651a8d971d02e5925b70e6f22648818a4c5" |
39 | | - # rabbitmqBackupClientImage is the image rendered into the RabbitMQ Job |
40 | | - # strategy (strategy-rabbitmq-default.yaml): its script needs only curl + |
41 | | - # ca-certificates to call the RabbitMQ management API and push the |
42 | | - # definitions export to S3 (curl --aws-sigv4). It is a distinct key from |
43 | | - # chBackupClientImage so the RabbitMQ strategy carries its own upgrade |
44 | | - # cadence, but it reuses the same platform-migrations image for now — hence |
45 | | - # it is stamped in lockstep with the two keys above (packages/core/platform/ |
46 | | - # Makefile), so the repository stays pinned at a single digest |
47 | | - # (hack/image-pin-consistency.bats). Same TODO applies: replace with a |
48 | | - # dedicated alpine + curl + ca-certificates image built by this package's |
49 | | - # Makefile, which also lets this pin move on its own. |
50 | | - # DO NOT hand-edit: stamped by packages/core/platform/Makefile. |
51 | | - rabbitmqBackupClientImage: "ghcr.io/cozystack/cozystack/platform-migrations:v1.7.0@sha256:9018fba0873094431cf130cc949d4651a8d971d02e5925b70e6f22648818a4c5" |
| 3 | + # chBackupClientImage is rendered into the Altinity strategy Pod, which drives |
| 4 | + # clickhouse-backup's HTTP API with curl + jq. rabbitmqBackupClientImage is |
| 5 | + # rendered into the RabbitMQ strategy Pod, which calls the management API and |
| 6 | + # moves the definitions export to S3 with curl --aws-sigv4. Both run the |
| 7 | + # images/backup-http-client/ image (alpine + curl + jq + ca-certificates) and |
| 8 | + # must hold the same ref: one repository pinned at two digests fails the |
| 9 | + # release promotion (hack/image-pin-consistency.bats). They are separate keys |
| 10 | + # so either strategy can move to its own image later. |
| 11 | + # DO NOT hand-edit: `make image` stamps both. |
| 12 | + chBackupClientImage: "ghcr.io/cozystack/cozystack/backup-http-client:v1.6.0" |
| 13 | + rabbitmqBackupClientImage: "ghcr.io/cozystack/cozystack/backup-http-client:v1.6.0" |
52 | 14 | # redisBackupClientImage is rendered into the Redis strategy Pod. The |
53 | 15 | # spotahome operator ships no backup CRD, so the strategy runs a one-shot Job |
54 | 16 | # that dumps an RDB snapshot to S3 and, on restore, loads it into a throwaway |
@@ -76,9 +38,9 @@ backupStrategyController: |
76 | 38 | memory: 1Gi |
77 | 39 | ephemeral-storage: 4Gi |
78 | 40 | # The Kafka metadata strategy carries no client image here: unlike the Altinity |
79 | | - # and RabbitMQ drivers (curl-only, so a shared platform-migrations image works), |
80 | | - # its driver runs the Kafka Admin-API CLI (kafka-topics / kafka-configs), which |
81 | | - # only the Strimzi broker image ships. So the controller resolves the image from |
| 41 | + # and RabbitMQ drivers, which need only curl (plus jq for Altinity), its driver |
| 42 | + # runs the Kafka Admin-API CLI (kafka-topics / kafka-configs), which only the |
| 43 | + # Strimzi broker image ships. So the controller resolves the image from |
82 | 44 | # the target Kafka broker at reconcile time (strategy-kafka-default.yaml renders |
83 | 45 | # the container image as the "{{ .ClientImage }}" placeholder), and records it on |
84 | 46 | # the Backup so cleanup can reuse it once the broker is gone. No pin to drift. |
|
0 commit comments