From 8c6e0800c3c38f078527e081c9b22af5e03e3a4f Mon Sep 17 00:00:00 2001
From: Story Crater Bot <19826264+Riotpiaole@users.noreply.github.com>
Date: Thu, 13 Aug 2026 06:33:34 -0700
Subject: [PATCH] =?UTF-8?q?fix(homarr):=20tune=20probes=20via=20chart=20va?=
 =?UTF-8?q?lues,=20drop=20fragile=20fix-probes-job=20=E2=80=94=20first-boo?=
 =?UTF-8?q?t=20icon=20updater=20blocks=20health=20endpoint=20~50s;=20defau?=
 =?UTF-8?q?lt=2010s=C3=973=20liveness=20SIGTERMs=20the=20pod=20(247=20rest?=
 =?UTF-8?q?arts,=20503);=20chart=20exposes=20probes=20so=20the=20PostSync?=
 =?UTF-8?q?=20patch-job=20was=20unnecessary=20and=20reverted=20on=20every?=
 =?UTF-8?q?=20rollout?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 k8s/apps/homarr/fix-probes-job.yaml | 95 -----------------------------
 k8s/apps/homarr/homarr-values.yaml  | 19 +++++-
 k8s/apps/homarr/kustomization.yaml  |  8 +--
 3 files changed, 22 insertions(+), 100 deletions(-)
 delete mode 100644 k8s/apps/homarr/fix-probes-job.yaml

diff --git a/k8s/apps/homarr/fix-probes-job.yaml b/k8s/apps/homarr/fix-probes-job.yaml
deleted file mode 100644
index 4a4c8e3..0000000
--- a/k8s/apps/homarr/fix-probes-job.yaml
+++ /dev/null
@@ -1,95 +0,0 @@
-# PostSync hook to patch Homarr deployment probes
-# Chart v8.23.0 doesn't support probe customization via values
-apiVersion: batch/v1
-kind: Job
-metadata:
-  name: homarr-fix-probes
-  namespace: dashboard
-  annotations:
-    argocd.argoproj.io/hook: PostSync
-    argocd.argoproj.io/hook-delete-policy: BeforeHookCreation
-spec:
-  backoffLimit: 3
-  template:
-    spec:
-      restartPolicy: Never
-      serviceAccountName: homarr-probe-patcher
-      containers:
-      - name: patch
-        image: python:3.12-alpine
-        command:
-        - /bin/sh
-        - -c
-        - |
-          set -e
-          echo "Installing kubectl..."
-          wget -q -O /tmp/kubectl https://dl.k8s.io/release/v1.28.0/bin/linux/amd64/kubectl
-          chmod +x /tmp/kubectl
-          
-          echo "Patching Homarr deployment probes..."
-          /tmp/kubectl -n dashboard patch deployment homarr --type=json -p='[
-            {
-              "op": "replace",
-              "path": "/spec/template/spec/containers/0/livenessProbe/initialDelaySeconds",
-              "value": 60
-            },
-            {
-              "op": "replace",
-              "path": "/spec/template/spec/containers/0/livenessProbe/periodSeconds",
-              "value": 30
-            },
-            {
-              "op": "replace",
-              "path": "/spec/template/spec/containers/0/livenessProbe/timeoutSeconds",
-              "value": 5
-            },
-            {
-              "op": "replace",
-              "path": "/spec/template/spec/containers/0/readinessProbe/initialDelaySeconds",
-              "value": 45
-            },
-            {
-              "op": "replace",
-              "path": "/spec/template/spec/containers/0/readinessProbe/periodSeconds",
-              "value": 15
-            },
-            {
-              "op": "replace",
-              "path": "/spec/template/spec/containers/0/readinessProbe/timeoutSeconds",
-              "value": 5
-            }
-          ]'
-          
-          echo "✅ Probes patched successfully"
-          echo "  Liveness: 60s initial, 30s period, 5s timeout"
-          echo "  Readiness: 45s initial, 15s period, 5s timeout"
----
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: homarr-probe-patcher
-  namespace: dashboard
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: homarr-probe-patcher
-  namespace: dashboard
-rules:
-- apiGroups: ["apps"]
-  resources: ["deployments"]
-  verbs: ["get", "patch"]
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: homarr-probe-patcher
-  namespace: dashboard
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: homarr-probe-patcher
-subjects:
-- kind: ServiceAccount
-  name: homarr-probe-patcher
-  namespace: dashboard
diff --git a/k8s/apps/homarr/homarr-values.yaml b/k8s/apps/homarr/homarr-values.yaml
index 4535cc2..e3cdeeb 100644
--- a/k8s/apps/homarr/homarr-values.yaml
+++ b/k8s/apps/homarr/homarr-values.yaml
@@ -1,5 +1,22 @@
 # Homarr landing page with Authentik SSO
-# Probes patched via PostSync hook (chart doesn't support customization)
+
+# Probe tuning (chart DOES expose these — the old PostSync patch-job was
+# unnecessary and fragile: it only patched one Deployment revision, so any later
+# rollout reverted to the chart's aggressive defaults). Homarr's first-boot icon
+# updater blocks the event loop for ~50s ("icons updater took 49553ms"), during
+# which /api/health/live can't answer within the default 10s×3 window → kubelet
+# SIGTERMs the pod → CrashLoopBackOff (247 restarts, 503 at the ingress). Give
+# liveness a wide window so the icon import can finish without a kill.
+livenessProbe:
+  initialDelaySeconds: 60
+  periodSeconds: 30
+  timeoutSeconds: 5
+  failureThreshold: 10
+readinessProbe:
+  initialDelaySeconds: 30
+  periodSeconds: 15
+  timeoutSeconds: 5
+  failureThreshold: 6
 
 image:
   repository: ghcr.io/homarr-labs/homarr
diff --git a/k8s/apps/homarr/kustomization.yaml b/k8s/apps/homarr/kustomization.yaml
index 31f9141..6c96743 100644
--- a/k8s/apps/homarr/kustomization.yaml
+++ b/k8s/apps/homarr/kustomization.yaml
@@ -1,7 +1,7 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 namespace: dashboard
-resources:
-  - fix-probes-job.yaml
-# PostSync hook to patch Homarr deployment probes
-# (homarr-secrets.enc.yaml managed by sops-secrets Application)
+# Probes are now tuned via homarr-values.yaml (chart-native); the old
+# fix-probes-job PostSync hook is removed. homarr-secrets/auth-oidc/db-encryption
+# Secrets are delivered by the sops-secrets (ksops) Application.
+resources: []