chore(immich): pre-stage prune:disabled on the im-pg CNPG objects (stage 1) #401

2026-07-25T05:34:43Z

claude-bot commented

2026-07-25 05:34:43 +00:00

Stage 1 of folding seed-immich into the existing dedicated immich KS — same clean single-transfer pattern as paperless (#399/#400), no app-object dance / no CI restart.

Adds kustomize.toolkit.fluxcd.io/prune: disabled in place to the 5 CNPG objects under seed/immich/:

Cluster/im-pg (pruning deletes its data PVCs)
ObjectStore/im-pg-store, ScheduledBackup/im-pg-daily
ExternalSecret/barman-cloud-creds, ExternalSecret/hetzner-s3-creds

The immich-library (300Gi) + immich-ml-cache PVCs already carry it. Metadata-only → no CNPG restart.

Verified: kubectl kustomize seed/immich → 7 objects, all 7 prune-protected; im-pg healthy (RESTARTS=0); 30 completed barman backups, last ~2.5h ago.

Stage 2 (follow-up) is the fold — but see the restore-test question I'm raising before that: immich's DB backs a photo library, so I'd like to optionally run the non-destructive CNPG restore drill (restore im-pg into a throwaway cluster) first.

**Stage 1** of folding `seed-immich` into the existing dedicated `immich` KS — same clean single-transfer pattern as paperless (#399/#400), no app-object dance / no CI restart. Adds `kustomize.toolkit.fluxcd.io/prune: disabled` in place to the 5 CNPG objects under `seed/immich/`: - `Cluster/im-pg` (pruning deletes its data PVCs) - `ObjectStore/im-pg-store`, `ScheduledBackup/im-pg-daily` - `ExternalSecret/barman-cloud-creds`, `ExternalSecret/hetzner-s3-creds` The `immich-library` (300Gi) + `immich-ml-cache` PVCs already carry it. **Metadata-only → no CNPG restart.** **Verified:** `kubectl kustomize seed/immich` → 7 objects, all 7 prune-protected; `im-pg` healthy (`RESTARTS=0`); **30 completed barman backups**, last ~2.5h ago. **Stage 2** (follow-up) is the fold — but see the restore-test question I'm raising before that: immich's DB backs a photo library, so I'd like to optionally run the non-destructive CNPG restore drill (restore `im-pg` into a throwaway cluster) first.

claude-bot added 1 commit 2026-07-25 05:34:43 +00:00

chore(immich): pre-stage prune:disabled on the im-pg CNPG objects (stage 1)

ci/woodpecker/pr/pr-review Pipeline was successful

Details

38370f9054

Stage 1 of folding seed-immich into the existing dedicated immich KS (same
pattern as paperless #399/#400). Adds prune: disabled, in place, to the 5 CNPG
DB objects under seed/immich/ so the ownership handoff can never prune them:

- Cluster/im-pg (pruning deletes its data PVCs)
- ObjectStore/im-pg-store, ScheduledBackup/im-pg-daily
- ExternalSecret/barman-cloud-creds, ExternalSecret/hetzner-s3-creds

The immich-library (300Gi) + ml-cache PVCs already carry the annotation.
Metadata-only; no CNPG restart. im-pg has 30 completed barman backups (last
~2.5h) as a backstop.

Co-Authored-By: Claude Bot <claude-bot@renner.uno>
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

review-bot reviewed

2026-07-25 05:36:12 +00:00

review-bot left a comment

🤖 Automated review — model claude-haiku-4-5-20251001 (complexity: trivial), commit 38370f90544f36a6b17897c7618cdc57d84f139b.

Advisory review by the review-bot pipeline. It never approves; a human merges. Push new commits to get a fresh review.

Summary

This PR adds kustomize.toolkit.fluxcd.io/prune: disabled annotations to five CNPG-related objects in kubernetes/seed/immich/ as a critical safety measure before the seed-immich → immich Kustomize overlay migration. The changes are metadata-only (no CNPG restart), well-verified, and properly protect the database cluster from accidental pruning during the ownership handoff.

🔴 Blocking

None — no blocking issues found.

🟡 Suggestions

None — the approach is sound and the implementation is correct.

🟢 Nits

Comment clarity (minor):

hetzner-creds-externalsecret.yaml:5 — The comment says "barman S3 creds" which is correct (Hetzner S3 for barman backups), but could be even more explicit as "Hetzner S3 credentials for barman backups" to eliminate any ambiguity.

Tests

The PR body includes solid manual verification (kubectl kustomize seed/immich → all 7 objects prune-protected, cluster healthy with RESTARTS=0, 30 completed barman backups). This is appropriate for a metadata-only, defensive change. No automated tests are needed; the Flux reconciliation itself acts as the functional test.

Recommendation

Looks reasonable — no blocking issues; nit above is optional.

🤖 **Automated review** — model `claude-haiku-4-5-20251001` (complexity: trivial), commit `38370f90544f36a6b17897c7618cdc57d84f139b`. > Advisory review by the `review-bot` pipeline. It never approves; a human merges. Push new commits to get a fresh review. --- ## Summary This PR adds `kustomize.toolkit.fluxcd.io/prune: disabled` annotations to five CNPG-related objects in `kubernetes/seed/immich/` as a critical safety measure before the seed-immich → immich Kustomize overlay migration. The changes are metadata-only (no CNPG restart), well-verified, and properly protect the database cluster from accidental pruning during the ownership handoff. ## 🔴 Blocking None — no blocking issues found. ## 🟡 Suggestions None — the approach is sound and the implementation is correct. ## 🟢 Nits **Comment clarity (minor):** - `hetzner-creds-externalsecret.yaml:5` — The comment says "barman S3 creds" which is correct (Hetzner S3 for barman backups), but could be even more explicit as "Hetzner S3 credentials for barman backups" to eliminate any ambiguity. ## Tests The PR body includes solid manual verification (`kubectl kustomize seed/immich` → all 7 objects prune-protected, cluster healthy with RESTARTS=0, 30 completed barman backups). This is appropriate for a metadata-only, defensive change. No automated tests are needed; the Flux reconciliation itself acts as the functional test. ## Recommendation Looks reasonable — no blocking issues; nit above is optional.

k.renner merged commit 6f29ca56b6 into master

2026-07-25 06:27:39 +00:00

k.renner referenced this issue from a commit

2026-07-25 06:27:39 +00:00

Merge pull request 'chore(immich): pre-stage prune:disabled on the im-pg CNPG objects (stage 1)' (#401) from immich-prune-protect into master

claude-bot referenced this issue from a commit

2026-07-25 08:45:51 +00:00

refactor(immich): fold seed-immich into the immich KS (stage 2)

claude-bot referenced this pull request

2026-07-25 08:46:21 +00:00

refactor(immich): fold seed-immich into the immich KS (stage 2) #405

Sign in to join this conversation.