From 1d8ba0512329c267a5be98201eb6b2b5f8737690 Mon Sep 17 00:00:00 2001 From: Claude Bot Date: Fri, 28 Aug 2026 11:44:19 +0200 Subject: [PATCH] fix(gatus): reload the pod when its config changes MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Dropping the PBS 2 check in the previous commit reconciled cleanly and changed nothing. The ConfigMap in the cluster no longer lists it; the running instance still reports Infrastructure 1, because Gatus reads its config once at startup and the pod is 26 hours old. Nothing about that state looks wrong from the outside. Flux reports the Kustomization applied, the ConfigMap matches git, and no resource is failing — the only symptom is that the endpoint list served by the app disagrees with the one in the repo. Adding a check would have been just as invisible as removing one. Reloader has been installed cluster-wide for 40 days and eleven other workloads already carry its annotation, across the apps, home-assistant, woodpecker, wordpress and authentik namespaces. Gatus was simply never given one. The annotation form for a ConfigMap is confirmed against upstream rather than recalled: configmap.reloader.stakater.com/reload takes the ConfigMap name. The pod restarts on reload and the deployment uses Recreate for its RWO volume, so the status page has a short gap whenever the config changes. That is the correct trade against serving checks that silently no longer match the repo. Not addressed: the deployment trips PodSecurity restricted on four counts (allowPrivilegeEscalation, capabilities, runAsNonRoot, seccompProfile). That predates this and is its own change. --- kubernetes/apps/gatus/deployment.yaml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/kubernetes/apps/gatus/deployment.yaml b/kubernetes/apps/gatus/deployment.yaml index 6ade5c28..a971f47a 100644 --- a/kubernetes/apps/gatus/deployment.yaml +++ b/kubernetes/apps/gatus/deployment.yaml @@ -5,6 +5,12 @@ metadata: namespace: apps labels: app: gatus + annotations: + # Gatus reads its config once at startup and never re-reads the file, so + # without this a ConfigMap change reconciles cleanly and then does nothing: + # git and the running checks drift apart silently, with no failed resource + # to notice. Adding a check would not take effect either. + configmap.reloader.stakater.com/reload: gatus-config spec: replicas: 1 # RWO PVC (`gatus-data`, ceph-block) — RollingUpdate's default 25% surge -- 2.54.0