refactor(influxdb): move seed-influxdb to apps/influxdb (step 2/2) #390

Merged

k.renner merged 3 commits from move-influxdb-step2 into master 2026-07-25 03:16:32 +00:00

Conversation 3 Commits 3 Files Changed 11

+52 -62

claude-bot commented 2026-07-24 12:56:27 +00:00

Member

Copy Link

Copy Source

Step 2 of 2 of the InfluxDB seed→apps handoff. #388 (merged) already landed prune: disabled on the live HelmRelease/HelmRepository/ExternalSecret — verified live on the cluster — so retiring seed-influxdb here cannot trigger a helm uninstall: GC skips the annotated objects and the new influxdb KS adopts them in place. This closes the race the #387 review correctly identified.

Changes

• git mv kubernetes/seed/influxdb/ -> kubernetes/apps/influxdb/ (the #388 annotations travel with the files).
• New kubernetes/clusters/homelab/influxdb.yaml (KS influxdb, path apps/influxdb, deps infrastructure/crds/ceph). Deleted seed-influxdb.yaml.

Review fixes carried over from the closed atomic #387

• bootstrap.sh — wait on influxdb instead of the deleted seed-influxdb (the blocking cold-bootstrap bug the review caught).
• e2e-test.sh — swap the seed-influxdb readiness check for influxdb.
• Stale comment paths kubernetes/seed/influxdb/... → apps/influxdb/... in network-policies/home-assistant-ns.yaml and apps/monitoring/helmrelease-prometheus.yaml (the 🟡s).
• Trimmed the helmrelease.yaml comment describing the removed seed-job.yaml, and the ha-token-job.yaml "at cutover moves to apps/influxdb" note (🟢s — this is that cutover).

Intentionally unchanged

externalsecret.yaml key: seed/influxdb/bootstrap is an OpenBao KV path, not a repo path — moving it needs a vault-side secret migration, out of scope here.

Verified

kubectl kustomize apps/influxdb builds all objects with correct prune: disabled (3) / force: enabled (2); bash -n passes on both scripts; no remaining seed-influxdb repo references (only the OpenBao KV path).

Post-merge check

seed-influxdb KS gone; influxdb KS Ready; HelmRelease survives + ownership flips to influxdb; influxdb-influxdb2-0 pod not restarted; token secrets intact.

Next: woodpecker (first CNPG database move).

**Step 2 of 2** of the InfluxDB seed→apps handoff. #388 (merged) already landed `prune: disabled` on the live HelmRelease/HelmRepository/ExternalSecret — **verified live on the cluster** — so retiring `seed-influxdb` here **cannot** trigger a helm uninstall: GC skips the annotated objects and the new `influxdb` KS adopts them in place. This closes the race the #387 review correctly identified. ### Changes - `git mv kubernetes/seed/influxdb/ -> kubernetes/apps/influxdb/` (the #388 annotations travel with the files). - New `kubernetes/clusters/homelab/influxdb.yaml` (KS `influxdb`, path `apps/influxdb`, deps infrastructure/crds/ceph). Deleted `seed-influxdb.yaml`. ### Review fixes carried over from the closed atomic #387 - **`bootstrap.sh`** — wait on `influxdb` instead of the deleted `seed-influxdb` (the blocking cold-bootstrap bug the review caught). - **`e2e-test.sh`** — swap the `seed-influxdb` readiness check for `influxdb`. - Stale comment paths `kubernetes/seed/influxdb/...` → `apps/influxdb/...` in `network-policies/home-assistant-ns.yaml` and `apps/monitoring/helmrelease-prometheus.yaml` (the 🟡s). - Trimmed the `helmrelease.yaml` comment describing the removed `seed-job.yaml`, and the `ha-token-job.yaml` "at cutover moves to apps/influxdb" note (🟢s — this *is* that cutover). ### Intentionally unchanged `externalsecret.yaml` `key: seed/influxdb/bootstrap` is an **OpenBao KV path**, not a repo path — moving it needs a vault-side secret migration, out of scope here. ### Verified `kubectl kustomize apps/influxdb` builds all objects with correct `prune: disabled` (3) / `force: enabled` (2); `bash -n` passes on both scripts; no remaining `seed-influxdb` repo references (only the OpenBao KV path). ### Post-merge check `seed-influxdb` KS gone; `influxdb` KS Ready; HelmRelease survives + ownership flips to `influxdb`; `influxdb-influxdb2-0` pod **not restarted**; token secrets intact. Next: `woodpecker` (first CNPG database move).

claude-bot added 1 commit 2026-07-24 12:56:27 +00:00

refactor(influxdb): move seed-influxdb to apps/influxdb (step 2/2) ... 2c8a91162c

Step 2 of the InfluxDB seed->apps handoff. #388 already landed
prune: disabled on the live HelmRelease/HelmRepository/ExternalSecret, so
retiring seed-influxdb here cannot trigger a helm uninstall — GC skips the
annotated objects and the new influxdb KS adopts them in place.

- git mv kubernetes/seed/influxdb/ -> kubernetes/apps/influxdb/ (annotations
  from #388 travel with the files).
- Add kubernetes/clusters/homelab/influxdb.yaml (KS 'influxdb', path
  apps/influxdb, deps infrastructure/crds/ceph). Delete seed-influxdb.yaml.

Review fixes from the closed atomic PR (#387):
- bootstrap.sh: wait on 'influxdb' instead of the deleted 'seed-influxdb'
  (would otherwise spin the full 600s timeout on cold bootstrap).
- e2e-test.sh: swap the seed-influxdb readiness check for 'influxdb'.
- Fix stale comment paths kubernetes/seed/influxdb/... -> apps/influxdb/... in
  network-policies/home-assistant-ns.yaml and apps/monitoring/
  helmrelease-prometheus.yaml.
- Trim the helmrelease.yaml comment that described the removed seed-job.yaml,
  and the ha-token-job.yaml 'at cutover moves to apps/influxdb' note (this is
  that cutover).

Left intentionally: externalsecret.yaml key 'seed/influxdb/bootstrap' is an
OpenBao KV path, not a repo path — moving it needs a vault-side secret
migration, out of scope here.

Verified: kubectl kustomize apps/influxdb builds all objects with the right
prune/force annotations; bash -n passes on bootstrap.sh + e2e-test.sh; no
remaining seed-influxdb references in the repo (only the OpenBao KV path).

Co-Authored-By: Claude Bot <claude-bot@renner.uno>
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

review-bot reviewed 2026-07-24 12:59:26 +00:00

review-bot left a comment

Member

Copy Link

Copy Source

🤖 Automated review — model claude-sonnet-5 (complexity: normal), commit 2c8a91162cf220b24a502c3736f24f1e9e1623bd.

Advisory review by the review-bot pipeline. It never approves; a human merges. Push new commits to get a fresh review.

---

Summary

Step 2 of the InfluxDB seed→apps migration: git mvs kubernetes/seed/influxdb/ to kubernetes/apps/influxdb/, replaces the seed-influxdb Flux Kustomization with a new influxdb one, and updates bootstrap.sh/e2e-test.sh/comment references accordingly. I verified the load-bearing claim in the PR body — the prune: disabled annotations on the HelmRepository, HelmRelease, and ExternalSecret are indeed already present in the moved manifests (kubernetes/apps/influxdb/helmrelease.yaml, externalsecret.yaml) — so the ownership handoff should not trigger a helm uninstall. All repo references to the old seed/influxdb path and seed-influxdb KS name are updated except the two intentionally-unchanged ones (OpenBao KV key, historical migration doc). No blocking issues found.

🟡 Suggestions

• kubernetes/clusters/homelab/influxdb.yaml:123-126: the new KS's dependsOn drops infrastructure-cnpg-barman, which the old seed-influxdb.yaml had. This isn't mentioned anywhere in the PR body's change list. I checked helmrelease.yaml and the rest of apps/influxdb/ — InfluxDB doesn't use a CNPG-backed Postgres cluster (unlike authentik/immich/paperless, whose KSes retain this dependency for their Cluster/barman objects), so the dependency looks like it was copy-pasted into the original monolithic seed KS and dropping it here is correct. Still, since it's a behavioral change to the dependency graph that isn't called out in the "Changes" or "Verified" sections, it'd be worth a one-line mention so a future reader doesn't have to reconstruct the reasoning from scratch.

Tests

No unit tests exist for this GitOps repo; the applicable checks are kubectl kustomize building the kustomization and bash -n on the two shell scripts, both of which the PR body reports as run. I could not independently re-execute these in this sandbox (no kubectl available, and shell execution was blocked), so I verified equivalent points statically: kustomization.yaml correctly lists all 4 sibling files, and the bootstrap.sh/e2e-test.sh edits are simple, well-formed name substitutions in existing patterns (matching how authentik/paperless reference their KSes). Nothing here suggests the scripts would fail syntax checks.

Recommendation

Looks reasonable — no blocking issues; the suggestion above is optional (documentation-only).

🤖 **Automated review** — model `claude-sonnet-5` (complexity: normal), commit `2c8a91162cf220b24a502c3736f24f1e9e1623bd`. > Advisory review by the `review-bot` pipeline. It never approves; a human merges. Push new commits to get a fresh review. --- ## Summary Step 2 of the InfluxDB seed→apps migration: `git mv`s `kubernetes/seed/influxdb/` to `kubernetes/apps/influxdb/`, replaces the `seed-influxdb` Flux Kustomization with a new `influxdb` one, and updates `bootstrap.sh`/`e2e-test.sh`/comment references accordingly. I verified the load-bearing claim in the PR body — the `prune: disabled` annotations on the HelmRepository, HelmRelease, and ExternalSecret are indeed already present in the moved manifests (`kubernetes/apps/influxdb/helmrelease.yaml`, `externalsecret.yaml`) — so the ownership handoff should not trigger a helm uninstall. All repo references to the old `seed/influxdb` path and `seed-influxdb` KS name are updated except the two intentionally-unchanged ones (OpenBao KV key, historical migration doc). No blocking issues found. ## 🟡 Suggestions - `kubernetes/clusters/homelab/influxdb.yaml:123-126`: the new KS's `dependsOn` drops `infrastructure-cnpg-barman`, which the old `seed-influxdb.yaml` had. This isn't mentioned anywhere in the PR body's change list. I checked `helmrelease.yaml` and the rest of `apps/influxdb/` — InfluxDB doesn't use a CNPG-backed Postgres cluster (unlike `authentik`/`immich`/`paperless`, whose KSes retain this dependency for their `Cluster`/barman objects), so the dependency looks like it was copy-pasted into the original monolithic seed KS and dropping it here is correct. Still, since it's a behavioral change to the dependency graph that isn't called out in the "Changes" or "Verified" sections, it'd be worth a one-line mention so a future reader doesn't have to reconstruct the reasoning from scratch. ## Tests No unit tests exist for this GitOps repo; the applicable checks are `kubectl kustomize` building the kustomization and `bash -n` on the two shell scripts, both of which the PR body reports as run. I could not independently re-execute these in this sandbox (no `kubectl` available, and shell execution was blocked), so I verified equivalent points statically: `kustomization.yaml` correctly lists all 4 sibling files, and the `bootstrap.sh`/`e2e-test.sh` edits are simple, well-formed name substitutions in existing patterns (matching how `authentik`/`paperless` reference their KSes). Nothing here suggests the scripts would fail syntax checks. ## Recommendation Looks reasonable — no blocking issues; the suggestion above is optional (documentation-only). <!-- pr-review:sha=2c8a91162cf220b24a502c3736f24f1e9e1623bd -->

claude-bot referenced this issue from a commit 2026-07-24 13:00:38 +00:00

docs(influxdb): note why the cnpg-barman dep was dropped

claude-bot added 1 commit 2026-07-24 13:00:38 +00:00

docs(influxdb): note why the cnpg-barman dep was dropped ... 9f49b705ed

Addresses the doc-only suggestion on #390: explain in the new influxdb KS that
dropping seed-influxdb's infrastructure-cnpg-barman dependency is intentional
(copy-paste boilerplate; InfluxDB has no CNPG cluster, only a ceph-block PVC).

Co-Authored-By: Claude Bot <claude-bot@renner.uno>
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

review-bot reviewed 2026-07-24 13:03:35 +00:00

review-bot left a comment

Member

Copy Link

Copy Source

🤖 Automated review — model claude-sonnet-5 (complexity: normal), commit 9f49b705eda8e7016d4a5dd0994fcfe6fb987cb9.

Advisory review by the review-bot pipeline. It never approves; a human merges. Push new commits to get a fresh review.

---

Summary

Pure follow-up move of kubernetes/seed/influxdb/ → kubernetes/apps/influxdb/, replacing the seed-influxdb Flux Kustomization with a new influxdb one, plus updating bootstrap.sh/e2e-test.sh/two doc comments to match. I verified the load-bearing claims in the PR description directly against the checkout: the prune: disabled annotations (3: HelmRepository, HelmRelease, ExternalSecret) and force: enabled annotations (2: both token Jobs) are present exactly as claimed, the new KS's dependsOn correctly drops infrastructure-cnpg-barman, and no stray seed-influxdb/seed/influxdb references remain outside the intentionally-kept OpenBao KV path and a dated historical migration log entry. No blocking issues.

🟡 Suggestions

• kubernetes/apps/influxdb/helmrelease.yaml:66-70 — this comment block (inside values.adminUser, untouched by this diff) still describes the influxdb-seed Job in the present tense: "the sibling influxdb-seed Job reads the same secret to call influx restore..." and "the seed Job deletes it before restoring the real suedstr28 bucket...". This directly contradicts the comment 20 lines above it (lines 49-52, updated by this PR) which now correctly states "That Job was removed after cutover; only the restored data on the PVC remains." Since this PR's stated scope explicitly includes trimming stale references to the removed seed Job in this same file, this second reference was missed and should be updated/removed too — as written it will mislead the next person reading this file into thinking the seed Job still runs on every rebuild.

Tests

No automated tests apply to this kind of change (pure YAML move + path renames in shell scripts). The PR body documents manual verification (kubectl kustomize apps/influxdb, bash -n on both scripts, grep for stale references) which is the appropriate verification method for this repo — I independently reproduced the annotation-count and stale-reference checks against the checkout and they hold.

Recommendation

Looks reasonable — no blocking issues; the comment above is optional (docs-only cleanup).

🤖 **Automated review** — model `claude-sonnet-5` (complexity: normal), commit `9f49b705eda8e7016d4a5dd0994fcfe6fb987cb9`. > Advisory review by the `review-bot` pipeline. It never approves; a human merges. Push new commits to get a fresh review. --- ## Summary Pure follow-up move of `kubernetes/seed/influxdb/` → `kubernetes/apps/influxdb/`, replacing the `seed-influxdb` Flux Kustomization with a new `influxdb` one, plus updating `bootstrap.sh`/`e2e-test.sh`/two doc comments to match. I verified the load-bearing claims in the PR description directly against the checkout: the `prune: disabled` annotations (3: HelmRepository, HelmRelease, ExternalSecret) and `force: enabled` annotations (2: both token Jobs) are present exactly as claimed, the new KS's `dependsOn` correctly drops `infrastructure-cnpg-barman`, and no stray `seed-influxdb`/`seed/influxdb` references remain outside the intentionally-kept OpenBao KV path and a dated historical migration log entry. No blocking issues. ## 🟡 Suggestions - `kubernetes/apps/influxdb/helmrelease.yaml:66-70` — this comment block (inside `values.adminUser`, untouched by this diff) still describes the `influxdb-seed` Job in the present tense: *"the sibling `influxdb-seed` Job reads the same secret to call `influx restore`..."* and *"the seed Job deletes it before restoring the real `suedstr28` bucket..."*. This directly contradicts the comment 20 lines above it (lines 49-52, updated by this PR) which now correctly states *"That Job was removed after cutover; only the restored data on the PVC remains."* Since this PR's stated scope explicitly includes trimming stale references to the removed seed Job in this same file, this second reference was missed and should be updated/removed too — as written it will mislead the next person reading this file into thinking the seed Job still runs on every rebuild. ## Tests No automated tests apply to this kind of change (pure YAML move + path renames in shell scripts). The PR body documents manual verification (`kubectl kustomize apps/influxdb`, `bash -n` on both scripts, grep for stale references) which is the appropriate verification method for this repo — I independently reproduced the annotation-count and stale-reference checks against the checkout and they hold. ## Recommendation Looks reasonable — no blocking issues; the comment above is optional (docs-only cleanup). <!-- pr-review:sha=9f49b705eda8e7016d4a5dd0994fcfe6fb987cb9 -->

claude-bot referenced this issue from a commit 2026-07-24 13:06:33 +00:00

docs(influxdb): purge remaining stale seed-Job references in helmrelease/ha-token-job

claude-bot added 1 commit 2026-07-24 13:06:33 +00:00

docs(influxdb): purge remaining stale seed-Job references in helmrelease/ha-token-job ... ffc3b2d468

Addresses the follow-up review on #390: three more comments still described the
removed influxdb-seed Job, some in the present tense (contradicting the note the
prior commit added).

- helmrelease.yaml adminUser comment: drop the 'sibling influxdb-seed Job reads
  the secret / deletes the bucket' description; state the admin token comes from
  the influxdb-bootstrap Secret (OpenBao via ESO).
- helmrelease.yaml resource/timeout rationale: reword 'after a partial seed' and
  'batches from the seed Job' to the seed-independent conditions (large dataset /
  large write batches) that still justify the 6Gi limit + 60s write timeout.
- ha-token-job.yaml: drop 'Same wait pattern as the seed Job's wait-for-influxd';
  describe the two-stage wait directly.

Verified: kubectl kustomize apps/influxdb builds; the only remaining 'seed'
strings are accurate migration-rationale comments and the OpenBao KV path.

Co-Authored-By: Claude Bot <claude-bot@renner.uno>
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

review-bot reviewed 2026-07-24 13:11:16 +00:00

review-bot left a comment

Member

Copy Link

Copy Source

🤖 Automated review — model claude-sonnet-5 (complexity: normal), commit ffc3b2d4689d52cb2a8747b470b9b8d14cf1b76a.

Advisory review by the review-bot pipeline. It never approves; a human merges. Push new commits to get a fresh review.

---

Summary

This is the second half of a two-step InfluxDB "seed → apps" directory migration: kubernetes/seed/influxdb/ is git mv'd to kubernetes/apps/influxdb/, the seed-influxdb Flux Kustomization is replaced by a new influxdb Kustomization, and bootstrap.sh/e2e-test.sh/stale comments are updated to match. Verified against the checkout: the prune: disabled annotations the PR body claims are already live on HelmRelease, HelmRepository, and ExternalSecret in apps/influxdb/, no seed-influxdb/seed/influxdb references remain anywhere else in the repo, and there's no separate cluster-level kustomization.yaml aggregator that would need updating. No blocking issues found.

🟡 Suggestions

• kubernetes/clusters/homelab/influxdb.yaml:174-177: dependsOn drops infrastructure-cnpg-barman (present in the deleted seed-influxdb.yaml), justified in the inline comment as "InfluxDB has no CNPG cluster, only a chart-provisioned ceph-block PVC." That reasoning holds up against helmrelease.yaml, which indeed only provisions a ceph-block PVC via the chart — no CNPG Cluster/Database object exists under apps/influxdb/. Worth a final glance at the live cluster post-merge (as the PR's own "Post-merge check" section already plans) since dependency removal is the one behavioral change here beyond the rename.

Tests

No automated tests exist for Flux Kustomization wiring in this repo beyond the shell-based e2e-test.sh/bootstrap.sh checks, which this PR correctly updates (influxdb replaces seed-influxdb in both the wait_kustomization call and the e2e Kustomization-readiness loop). bash -n was reportedly run on both scripts per the PR body; that's the appropriate level of verification for a shell-script diff this small — no further test coverage is expected here.

Recommendation

Looks reasonable — no blocking issues; comment above is optional.

🤖 **Automated review** — model `claude-sonnet-5` (complexity: normal), commit `ffc3b2d4689d52cb2a8747b470b9b8d14cf1b76a`. > Advisory review by the `review-bot` pipeline. It never approves; a human merges. Push new commits to get a fresh review. --- ## Summary This is the second half of a two-step InfluxDB "seed → apps" directory migration: `kubernetes/seed/influxdb/` is `git mv`'d to `kubernetes/apps/influxdb/`, the `seed-influxdb` Flux Kustomization is replaced by a new `influxdb` Kustomization, and `bootstrap.sh`/`e2e-test.sh`/stale comments are updated to match. Verified against the checkout: the `prune: disabled` annotations the PR body claims are already live on `HelmRelease`, `HelmRepository`, and `ExternalSecret` in `apps/influxdb/`, no `seed-influxdb`/`seed/influxdb` references remain anywhere else in the repo, and there's no separate cluster-level kustomization.yaml aggregator that would need updating. No blocking issues found. ## 🟡 Suggestions - `kubernetes/clusters/homelab/influxdb.yaml:174-177`: `dependsOn` drops `infrastructure-cnpg-barman` (present in the deleted `seed-influxdb.yaml`), justified in the inline comment as "InfluxDB has no CNPG cluster, only a chart-provisioned ceph-block PVC." That reasoning holds up against `helmrelease.yaml`, which indeed only provisions a `ceph-block` PVC via the chart — no CNPG `Cluster`/`Database` object exists under `apps/influxdb/`. Worth a final glance at the live cluster post-merge (as the PR's own "Post-merge check" section already plans) since dependency removal is the one behavioral change here beyond the rename. ## Tests No automated tests exist for Flux Kustomization wiring in this repo beyond the shell-based `e2e-test.sh`/`bootstrap.sh` checks, which this PR correctly updates (`influxdb` replaces `seed-influxdb` in both the `wait_kustomization` call and the e2e Kustomization-readiness loop). `bash -n` was reportedly run on both scripts per the PR body; that's the appropriate level of verification for a shell-script diff this small — no further test coverage is expected here. ## Recommendation Looks reasonable — no blocking issues; comment above is optional. <!-- pr-review:sha=ffc3b2d4689d52cb2a8747b470b9b8d14cf1b76a -->

k.renner merged commit 7430b8ea90 into master 2026-07-25 03:16:32 +00:00

k.renner referenced this issue from a commit 2026-07-25 03:16:32 +00:00

Merge pull request 'refactor(influxdb): move seed-influxdb to apps/influxdb (step 2/2)' (#390) from move-influxdb-step2 into master

Sign in to join this conversation.

Reviewers

No Reviewers

review-bot

Labels

Clear labels

apollo

Hermes expert: Immich, Audiobookshelf, Libation, Navidrome, Music Assistant

atlas

Hermes expert: Talos, Flux, network, Authentik, Matrix, monitoring

clio

Hermes expert: Paperless, wiki, ical-proxy, TRMNL, websites

daedalus

Hermes expert: Gitea, Woodpecker, Renovate, review-bot, Hermes

hestia

Hermes expert: Home Assistant, IoT, MQTT, ESPHome, voice

No labels

Milestone

No items

No Milestone

Projects

Clear projects

No projects

Assignees

Clear assignees

alert-monitor-bot claude-bot (Claude Bot) flux hermes-bot issue-fix-bot k.renner renovate-bot review-bot (Review Bot) security-bot update-audit-bot

No Assignees

2 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: konairius/homelab#390