[SHOT-216] feat: Add generic extra volumes to self-host hook/job and mssql pods - #570
[SHOT-216] feat: Add generic extra volumes to self-host hook/job and mssql pods#570keithhubner wants to merge 2 commits into
Conversation
keithhubner
added
ai-review
🤖 Bitwarden Claude Code ReviewOverall Assessment: APPROVE Reviewed the addition of No security, correctness, or breaking-change concerns found. |
…mssql pods Render configurable extraVolumeMounts/extraVolumes on the pre/post-install hook and job pods (jobs.*) and the MSSQL StatefulSet (database.*), mirroring the existing per-component pattern. This lets rootless deployments (readOnlyRootFilesystem: true) supply writable scratch (e.g. /tmp) via values instead of maintaining a chart patch. Regenerates values.schema.json, documents the new keys in the chart README, and adds helm-unittest coverage in tests/hook_extras_test.yaml.
bc6bbb6 to
441afb3
Compare
1 participant
🎟️ Tracking
Jira: SHOT-216
Users running the self-host chart with a hardened rootless profile (
readOnlyRootFilesystem: true) hit a problem: with a read-only root filesystem, the hook/job and database containers have nowhere to write scratch space (mainly/tmp), so several pods fail. Previously the only workaround was maintaining a local chart patch and re-applying it on every release. This PR upstreams a generic fix.📔 Objective
Add configurable
extraVolumeMounts/extraVolumesto the hook/job and database pods, which previously had no extra-volume support:jobs.extraVolumeMounts/jobs.extraVolumes— shared across the five pre/post-install hook & job pods:pre-install-job,pre-install-secret-sql,pre-install-db-migrator-job,post-install-db-migrator-job,post-delete-hook(including thegenerate-identity-certandwait-for-dbinit containers).database.extraVolumeMounts/database.extraVolumes— the MSSQL StatefulSet.This mirrors the existing per-component pattern (e.g.
component.api.extraVolumeMounts), so rootless deployments can supply their writable scratch (e.g. a/tmpemptyDir) through values instead of maintaining a chart patch. All keys default to[], so the change is a no-op for existing users (verified: default render is identical tomain).The app-service templates already supported extra volumes upstream and were left unchanged. Example usage is documented in the chart README under Optional Values → Extra Volumes.
Note on writable MSSQL secrets
A common companion need for the rootless MSSQL pod is a writable
mssql-secretsvolume at/var/opt/mssql/secrets. Under this generic approach that is not hardcoded — it is supplied viadatabase.extraVolumes/database.extraVolumeMounts(see the README example).✅ Verification
helm unittest charts/self-host— 149/149 pass (newtests/hook_extras_test.yamlsuite covers render + empty-is-no-op for all six templates, including both init containers).values.schema.jsonregenerated with helm-schema 0.23.4 (matches CI schema check).ct lint --charts charts/self-hostpasses.mainis empty (aside from randomly-generated secrets).jobs/databaseextra values confirms the volume + mount appear in all five Jobs and the MSSQL StatefulSet, producing valid YAML.