fix(sentry): let clickhouse 25.3 start under the chart's read-only users dir - #162
Merged
Merged
Conversation
…ers dir The image pin from #158 was necessary but not sufficient: the upgrade still failed and Flux rolled back to 23.8 five times, reporting StatefulSet/sentry/clickhouse status: 'Failed' The image itself is fine -- it pulls and runs. What breaks is the entrypoint. ClickHouse images from 24.x on run a user-setup step: with neither CLICKHOUSE_USER nor CLICKHOUSE_PASSWORD set, it writes users.d/default-user.xml to disable network access for `default`. This chart mounts users.d from a ConfigMap, so that path is read-only and the container dies before the server starts: /entrypoint.sh: line 156: /etc/clickhouse-server/users.d/default-user.xml: Read-only file system Verified by running the image with the chart's three ConfigMaps mounted: it fails exactly there, and starts cleanly once CLICKHOUSE_SKIP_USER_SETUP=1 is set. The chart's users ConfigMap already defines `default`, so skipping the step is correct rather than a workaround. The chart has no env: block -- it only exports SHARD in the container command -- so this cannot come from values and is patched in via the postRenderer that already sets the priority class. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017Qx7mKDeDhysBWsqtqM1yr
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The image pin from #158 was necessary but not sufficient. The upgrade still failed and Flux rolled back to 23.8 five times (
Stalled=True: Failed to upgrade after 5 attempt(s),StatefulSet/sentry/clickhouse status: 'Failed').Not the image. Ran the tag as a throwaway pod: pulls and runs, exit 0.
The entrypoint. ClickHouse images from 24.x on run a user-setup step; with neither CLICKHOUSE_USER nor CLICKHOUSE_PASSWORD set it writes
users.d/default-user.xml. This chart mountsusers.dfrom a ConfigMap, so the path is read-only and the container dies before the server starts:Confirmed by running the image with the chart's three ConfigMaps mounted (fails exactly there), then again with
CLICKHOUSE_SKIP_USER_SETUP=1(starts cleanly, merges the config files). 23.8 had no such step, which is why it only surfaced after the version bump.Skipping is correct rather than a workaround: the chart's users ConfigMap already defines
default.Why a postRenderer: the chart has no
env:block at all — it only exports SHARD in the container command — so this cannot come from values.Side effect: changing the spec also clears the HelmRelease
Stalledstate, so Flux retries on its own.🤖 Generated with Claude Code