From ed17ac78d9414e9117e06dcde58a246c14c9dbf2 Mon Sep 17 00:00:00 2001 From: Claude Bot Date: Fri, 24 Jul 2026 14:05:01 +0200 Subject: [PATCH] chore(influxdb): pre-stage prune:disabled on live seed-influxdb objects Step 1 of a two-step seed->apps handoff for InfluxDB (the move itself follows in a separate PR). Adds kustomize.toolkit.fluxcd.io/prune: disabled to the HelmRelease, HelmRepository, and ExternalSecret *in place* under kubernetes/seed/influxdb/, with no move and no KS changes. Why split: doing the annotate + move + delete-old-KS in one commit races the new KS's first reconcile (which stamps the annotation onto the live objects) against the old KS's deletion-GC. If GC wins, it prunes the un-annotated HelmRelease -> helm uninstall -> the running InfluxDB StatefulSet is torn down. Landing the annotation via the existing seed-influxdb KS first guarantees it is live on the objects before any prune can run, per Flux's documented pattern. No behavioural change: only a kustomize metadata annotation is added, so helm-controller performs no upgrade and the server is untouched. After merge, verify the annotation is live on all three objects, then land the move PR. Co-Authored-By: Claude Bot Co-Authored-By: Claude Opus 4.8 (1M context) --- kubernetes/seed/influxdb/externalsecret.yaml | 4 ++++ kubernetes/seed/influxdb/helmrelease.yaml | 11 +++++++++++ 2 files changed, 15 insertions(+) diff --git a/kubernetes/seed/influxdb/externalsecret.yaml b/kubernetes/seed/influxdb/externalsecret.yaml index 3ce2efdd..4cff7948 100644 --- a/kubernetes/seed/influxdb/externalsecret.yaml +++ b/kubernetes/seed/influxdb/externalsecret.yaml @@ -3,6 +3,10 @@ kind: ExternalSecret metadata: name: influxdb-bootstrap namespace: influxdb + annotations: + # Prune-disabled ahead of the seed->apps handoff so the bootstrap Secret + # (admin token) can't be deleted out from under the token Jobs mid-move. + kustomize.toolkit.fluxcd.io/prune: disabled spec: refreshInterval: 1h secretStoreRef: diff --git a/kubernetes/seed/influxdb/helmrelease.yaml b/kubernetes/seed/influxdb/helmrelease.yaml index f084982c..b73ef13e 100644 --- a/kubernetes/seed/influxdb/helmrelease.yaml +++ b/kubernetes/seed/influxdb/helmrelease.yaml @@ -3,6 +3,9 @@ kind: HelmRepository metadata: name: influxdata namespace: influxdb + annotations: + # Prune-disabled so a later seed->apps ownership handoff never deletes it. + kustomize.toolkit.fluxcd.io/prune: disabled spec: interval: 24h url: https://helm.influxdata.com/ @@ -12,6 +15,14 @@ kind: HelmRelease metadata: name: influxdb namespace: influxdb + annotations: + # CRITICAL: prune-disabled. This HelmRelease owns InfluxDB's data (its + # StatefulSet + the chart-provisioned influxdb-influxdb2 PVC). Landing this + # annotation on the live object *before* the KS is ever moved/deleted is + # step 1 of a two-step seed->apps handoff: once it's live here, a later + # prune of this KS can't tear the HelmRelease down (which would helm- + # uninstall the running server). Kept afterwards as a standing guard. + kustomize.toolkit.fluxcd.io/prune: disabled spec: interval: 30m chart: -- 2.54.0