fix(homarr): tune probes via chart values, drop fragile fix-probes-job — first-boot icon updater blocks health endpoint ~50s; default 10s×3 liveness SIGTERMs the pod (247 restarts, 503); chart exposes probes so the PostSync patch-job was unnecessary and reverted on every rollout

k8s/apps/homarr/fix-probes-job.yaml

@@ -1,95 +0,0 @@
-# PostSync hook to patch Homarr deployment probes
-# Chart v8.23.0 doesn't support probe customization via values
-apiVersion: batch/v1
-kind: Job
-metadata:
-  name: homarr-fix-probes
-  namespace: dashboard
-  annotations:
-    argocd.argoproj.io/hook: PostSync
-    argocd.argoproj.io/hook-delete-policy: BeforeHookCreation
-spec:
-  backoffLimit: 3
-  template:
-    spec:
-      restartPolicy: Never
-      serviceAccountName: homarr-probe-patcher
-      containers:
-      - name: patch
-        image: python:3.12-alpine
-        command:
-        - /bin/sh
-        - -c
-        - |
-          set -e
-          echo "Installing kubectl..."
-          wget -q -O /tmp/kubectl https://dl.k8s.io/release/v1.28.0/bin/linux/amd64/kubectl
-          chmod +x /tmp/kubectl
-          
-          echo "Patching Homarr deployment probes..."
-          /tmp/kubectl -n dashboard patch deployment homarr --type=json -p='[
-            {
-              "op": "replace",
-              "path": "/spec/template/spec/containers/0/livenessProbe/initialDelaySeconds",
-              "value": 60
-            },
-            {
-              "op": "replace",
-              "path": "/spec/template/spec/containers/0/livenessProbe/periodSeconds",
-              "value": 30
-            },
-            {
-              "op": "replace",
-              "path": "/spec/template/spec/containers/0/livenessProbe/timeoutSeconds",
-              "value": 5
-            },
-            {
-              "op": "replace",
-              "path": "/spec/template/spec/containers/0/readinessProbe/initialDelaySeconds",
-              "value": 45
-            },
-            {
-              "op": "replace",
-              "path": "/spec/template/spec/containers/0/readinessProbe/periodSeconds",
-              "value": 15
-            },
-            {
-              "op": "replace",
-              "path": "/spec/template/spec/containers/0/readinessProbe/timeoutSeconds",
-              "value": 5
-            }
-          ]'
-          
-          echo "✅ Probes patched successfully"
-          echo "  Liveness: 60s initial, 30s period, 5s timeout"
-          echo "  Readiness: 45s initial, 15s period, 5s timeout"
----
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: homarr-probe-patcher
-  namespace: dashboard
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: homarr-probe-patcher
-  namespace: dashboard
-rules:
-- apiGroups: ["apps"]
-  resources: ["deployments"]
-  verbs: ["get", "patch"]
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: homarr-probe-patcher
-  namespace: dashboard
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: homarr-probe-patcher
-subjects:
-- kind: ServiceAccount
-  name: homarr-probe-patcher
-  namespace: dashboard

k8s/apps/homarr/homarr-values.yaml

@@ -1,5 +1,22 @@
 # Homarr landing page with Authentik SSO
-# Probes patched via PostSync hook (chart doesn't support customization)
+
+# Probe tuning (chart DOES expose these — the old PostSync patch-job was
+# unnecessary and fragile: it only patched one Deployment revision, so any later
+# rollout reverted to the chart's aggressive defaults). Homarr's first-boot icon
+# updater blocks the event loop for ~50s ("icons updater took 49553ms"), during
+# which /api/health/live can't answer within the default 10s×3 window → kubelet
+# SIGTERMs the pod → CrashLoopBackOff (247 restarts, 503 at the ingress). Give
+# liveness a wide window so the icon import can finish without a kill.
+livenessProbe:
+  initialDelaySeconds: 60
+  periodSeconds: 30
+  timeoutSeconds: 5
+  failureThreshold: 10
+readinessProbe:
+  initialDelaySeconds: 30
+  periodSeconds: 15
+  timeoutSeconds: 5
+  failureThreshold: 6
 
 image:
   repository: ghcr.io/homarr-labs/homarr

k8s/apps/homarr/kustomization.yaml

@@ -1,7 +1,7 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 namespace: dashboard
-resources:
-  - fix-probes-job.yaml
-# PostSync hook to patch Homarr deployment probes
-# (homarr-secrets.enc.yaml managed by sops-secrets Application)
+# Probes are now tuned via homarr-values.yaml (chart-native); the old
+# fix-probes-job PostSync hook is removed. homarr-secrets/auth-oidc/db-encryption
+# Secrets are delivered by the sops-secrets (ksops) Application.
+resources: []