chore(influxdb): pre-stage prune:disabled on live seed-influxdb objects (step 1/2) #388

2026-07-24T12:05:14Z

claude-bot commented

2026-07-24 12:05:14 +00:00

Step 1 of 2 for the InfluxDB seed→apps move — splitting per the review on #387, which correctly flagged that annotate+move+delete in one commit races the new KS's reconcile against the old KS's deletion-GC (a lost race = helm-uninstall of the live database).

This PR only adds kustomize.toolkit.fluxcd.io/prune: disabled to the HelmRelease, HelmRepository, and ExternalSecret in place under kubernetes/seed/influxdb/ — no move, no KS changes. Landing the annotation via the existing seed-influxdb KS guarantees it's live on the objects before any prune can ever run.

No behavioural change: only a kustomize metadata annotation is added → helm-controller does no upgrade, the server is untouched.

After merge: verify the annotation is live on all three objects (kubectl get helmrelease/helmrepository/externalsecret -n influxdb -o jsonpath='{.metadata.annotations}'), then I open step 2 — the actual git mv to apps/influxdb, the new influxdb KS, deleting seed-influxdb, plus the bootstrap.sh:334 rename and stale comment-path fixes the #387 review caught.

**Step 1 of 2** for the InfluxDB seed→apps move — splitting per the review on #387, which correctly flagged that annotate+move+delete in one commit races the new KS's reconcile against the old KS's deletion-GC (a lost race = helm-uninstall of the live database). This PR only adds `kustomize.toolkit.fluxcd.io/prune: disabled` to the **HelmRelease, HelmRepository, and ExternalSecret** *in place* under `kubernetes/seed/influxdb/` — no move, no KS changes. Landing the annotation via the existing `seed-influxdb` KS guarantees it's live on the objects **before** any prune can ever run. **No behavioural change:** only a kustomize metadata annotation is added → helm-controller does no upgrade, the server is untouched. **After merge:** verify the annotation is live on all three objects (`kubectl get helmrelease/helmrepository/externalsecret -n influxdb -o jsonpath='{.metadata.annotations}'`), then I open **step 2** — the actual `git mv` to `apps/influxdb`, the new `influxdb` KS, deleting `seed-influxdb`, plus the `bootstrap.sh:334` rename and stale comment-path fixes the #387 review caught.

claude-bot added 1 commit 2026-07-24 12:05:14 +00:00

chore(influxdb): pre-stage prune:disabled on live seed-influxdb objects

ci/woodpecker/pr/pr-review Pipeline was successful

Details

ed17ac78d9

Step 1 of a two-step seed->apps handoff for InfluxDB (the move itself follows
in a separate PR). Adds kustomize.toolkit.fluxcd.io/prune: disabled to the
HelmRelease, HelmRepository, and ExternalSecret *in place* under
kubernetes/seed/influxdb/, with no move and no KS changes.

Why split: doing the annotate + move + delete-old-KS in one commit races the
new KS's first reconcile (which stamps the annotation onto the live objects)
against the old KS's deletion-GC. If GC wins, it prunes the un-annotated
HelmRelease -> helm uninstall -> the running InfluxDB StatefulSet is torn down.
Landing the annotation via the existing seed-influxdb KS first guarantees it is
live on the objects before any prune can run, per Flux's documented pattern.

No behavioural change: only a kustomize metadata annotation is added, so
helm-controller performs no upgrade and the server is untouched. After merge,
verify the annotation is live on all three objects, then land the move PR.

Co-Authored-By: Claude Bot <claude-bot@renner.uno>
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

review-bot reviewed

2026-07-24 12:08:26 +00:00

review-bot left a comment

🤖 Automated review — model claude-haiku-4-5-20251001 (complexity: trivial), commit ed17ac78d9414e9117e06dcde58a246c14c9dbf2.

Advisory review by the review-bot pipeline. It never approves; a human merges. Push new commits to get a fresh review.

Summary

This PR adds the kustomize.toolkit.fluxcd.io/prune: disabled annotation to three critical InfluxDB objects in kubernetes/seed/influxdb/ — HelmRelease, HelmRepository, and ExternalSecret — to prevent them from being deleted during the pending seed→apps KustomizationSet ownership handoff (step 2). The change is metadata-only, purely defensive, and correctly targets the data-bearing resources that must survive the transition.

🟢 Nits

externalsecret.yaml:4 — Comment spans two lines with clear explanation, appropriate for the bootstrap Secret's criticality.

helmrelease.yaml:19-24 — The extended comment on HelmRelease is well-detailed and explains the CRITICAL nature clearly. The phrase "owned InfluxDB's data" is slightly informal but fits the tone elsewhere in the file.

Tests

This is a metadata-only change with no behavioral impact — no code or logic changes, only Kubernetes annotations. The PR author's post-merge verification step (using kubectl get ... -o jsonpath='{.metadata.annotations}') is the appropriate validation that the annotations are live on the cluster. No unit/integration tests are needed.

The functional test occurs in step 2 when the KS ownership transfer happens; the prune: disabled guard will be validated by a clean move without deletion side effects.

Recommendation

Looks reasonable — no blocking issues; annotations are syntactically correct and properly target the three objects specified. Ready to merge pending post-merge verification.

🤖 **Automated review** — model `claude-haiku-4-5-20251001` (complexity: trivial), commit `ed17ac78d9414e9117e06dcde58a246c14c9dbf2`. > Advisory review by the `review-bot` pipeline. It never approves; a human merges. Push new commits to get a fresh review. --- ## Summary This PR adds the `kustomize.toolkit.fluxcd.io/prune: disabled` annotation to three critical InfluxDB objects in `kubernetes/seed/influxdb/` — HelmRelease, HelmRepository, and ExternalSecret — to prevent them from being deleted during the pending seed→apps KustomizationSet ownership handoff (step 2). The change is metadata-only, purely defensive, and correctly targets the data-bearing resources that must survive the transition. ## 🟢 Nits **externalsecret.yaml:4** — Comment spans two lines with clear explanation, appropriate for the bootstrap Secret's criticality. **helmrelease.yaml:19-24** — The extended comment on HelmRelease is well-detailed and explains the CRITICAL nature clearly. The phrase "owned InfluxDB's data" is slightly informal but fits the tone elsewhere in the file. ## Tests This is a metadata-only change with no behavioral impact — no code or logic changes, only Kubernetes annotations. The PR author's post-merge verification step (using `kubectl get ... -o jsonpath='{.metadata.annotations}'`) is the appropriate validation that the annotations are live on the cluster. No unit/integration tests are needed. The functional test occurs in step 2 when the KS ownership transfer happens; the prune: disabled guard will be validated by a clean move without deletion side effects. ## Recommendation Looks reasonable — no blocking issues; annotations are syntactically correct and properly target the three objects specified. Ready to merge pending post-merge verification.

k.renner merged commit 37920ff0be into master

2026-07-24 12:51:09 +00:00

k.renner referenced this issue from a commit

2026-07-24 12:51:10 +00:00

Merge pull request 'chore(influxdb): pre-stage prune:disabled on live seed-influxdb objects (step 1/2)' (#388) from annotate-influxdb-prune-disabled into master

claude-bot referenced this issue from a commit

2026-07-24 12:56:13 +00:00

refactor(influxdb): move seed-influxdb to apps/influxdb (step 2/2)

claude-bot referenced this pull request

2026-07-24 12:56:27 +00:00

refactor(influxdb): move seed-influxdb to apps/influxdb (step 2/2) #390

Sign in to join this conversation.