From 86cdcade36c4a3bac5573c92d0939269907abff1 Mon Sep 17 00:00:00 2001 From: rock Date: Wed, 28 Oct 2026 02:13:31 -0700 Subject: [PATCH] fix(forgejo): restart the pod when the database password changes GITEA__DATABASE_PASSWD comes from forgejo-db-app, which the CNPG Cluster CR owns and generates. There is no bootstrap secret, so nothing but cloudnative-pg knows that password. The Deployment reads it into the environment at start. So a regenerated password leaves Forgejo authenticating with a value the database no longer accepts: the pod stays Ready, every query fails, and the symptom looks like a network problem rather than a credential problem. The cnpg.io/reload label on the Secret is only a hint; this annotation is what makes Reloader act on it. --- k8s/bootstrap/phase3-forgejo/forgejo-values.yaml | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/k8s/bootstrap/phase3-forgejo/forgejo-values.yaml b/k8s/bootstrap/phase3-forgejo/forgejo-values.yaml index 4ad62e3..cf6d45a 100644 --- a/k8s/bootstrap/phase3-forgejo/forgejo-values.yaml +++ b/k8s/bootstrap/phase3-forgejo/forgejo-values.yaml @@ -102,6 +102,20 @@ persistence: accessModes: - ReadWriteOnce +# Pod annotations. +# +# GITEA__DATABASE_PASSWD comes from forgejo-db-app, a Secret the CNPG Cluster CR owns +# and generates: cloudnative-pg created it, and there is no bootstrap secret, so +# nothing else knows that password. The Deployment reads it into the environment at +# start, so a regenerated password would leave Forgejo authenticating with a value the +# database no longer accepts — the pod stays up and every query fails. +# +# The cnpg.io/reload label on the Secret is only a hint. This annotation is what makes +# Stakater Reloader restart the pod when the Secret changes, so the environment is +# refreshed instead of silently stale. +podAnnotations: + reloader.stakater.com/auto: "true" + # Ingress ingress: enabled: true