fix(sentry): let clickhouse 25.3 start under the chart's read-only users dir - #164
Merged
Merged
Conversation
…ers dir The image pin from #158 was necessary but not sufficient: the upgrade still failed and Flux rolled back to 23.8 five times, reporting StatefulSet/sentry/clickhouse status: 'Failed' The image itself is fine -- it pulls and runs. What breaks is the entrypoint. ClickHouse images from 24.x on run a user-setup step: with neither CLICKHOUSE_USER nor CLICKHOUSE_PASSWORD set, it writes users.d/default-user.xml to disable network access for `default`. This chart mounts users.d from a ConfigMap, so that path is read-only and the container dies before the server starts: /entrypoint.sh: line 156: /etc/clickhouse-server/users.d/default-user.xml: Read-only file system Verified by running the image with the chart's three ConfigMaps mounted: it fails exactly there, and starts cleanly once CLICKHOUSE_SKIP_USER_SETUP=1 is set. The chart's users ConfigMap already defines `default`, so skipping the step is correct rather than a workaround. The chart has no env: block -- it only exports SHARD in the container command -- so this cannot come from values and is patched in via the postRenderer that already sets the priority class. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017Qx7mKDeDhysBWsqtqM1yr
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The image pin from #158 was necessary but not sufficient. Flux rolled back to 23.8 five times:
Not the image. A throwaway pod running
altinity/clickhouse-server:25.3.6.10034.altinitystablepulls and exits 0.The entrypoint. ClickHouse images from 24.x on run a user-setup step. With neither
CLICKHOUSE_USERnorCLICKHOUSE_PASSWORDset it writesusers.d/default-user.xml, but this chart mountsusers.dfrom a ConfigMap, so the path is read-only and the container dies before the server starts:Verified by running the image with the chart's three ConfigMaps mounted (fails exactly there), then again with
CLICKHOUSE_SKIP_USER_SETUP=1(starts cleanly, merges config). 23.8 had no such step, which is why it only surfaced after the bump.Why a postRenderer. The chart has no
env:block at all — it only exportsSHARDin the container command — so this cannot come from values. Skipping is correct rather than a workaround: the chart's users ConfigMap already definesdefault.Also resets the HelmRelease out of its
Stalledstate, since the spec changes.🤖 Generated with Claude Code