feat(chart): add deploymentAnnotations for Deployment metadata - #54
Open
louisgls wants to merge 2 commits into
Open
feat(chart): add deploymentAnnotations for Deployment metadata#54louisgls wants to merge 2 commits into
louisgls wants to merge 2 commits into
Conversation
The chart only exposed `podAnnotations`, which renders onto the pod
template. Controllers that watch the workload object itself had no way to
be configured through values.
The concrete failure: the TLS cert secret is mounted with `subPath`, and
kubelet never refreshes a subPath volume in place. When cert-manager
rotates the certificate, the running pods keep serving the old one until
they are restarted. Stakater Reloader does exactly that, but it reads
`reloader.stakater.com/auto` from `Deployment.metadata.annotations` — which
the chart could not render. The proxy therefore served an expired
certificate and every TLS client failed with `x509: certificate has
expired`.
Add `deploymentAnnotations` (default `{}`, declared in values.schema.json)
and render it onto the Deployment metadata. No behavior change when unset.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The 1.10.0 entry was inserted in place of the 1.9.3 heading line, leaving 1.9.3's dashboard sub-bullets attached to 1.10.0. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This was referenced Jul 29, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Context
Found while investigating a production incident on kube02: every Loki read
query failed with
against
cockpit-s3proxy.cockpit.svc.cluster.local:4433.cert-manager had renewed the certificate correctly — the secret held a cert
valid until 2026-09-24 — but the running pods were still serving the previous
one, issued in April and expired on July 26. The pods had started on
2026-06-25, hours before the renewal, and never picked up the new material.
Two things combined:
subPath. Kubelet never refreshes asubPath volume in place, so the file inside the container stays frozen at
whatever the secret held when the pod started. A pod restart is the only
way to pick up a renewed certificate.
podAnnotationsonly, which renders onto the podtemplate. Stakater Reloader reads
reloader.stakater.com/autofromDeployment.metadata.annotations, so there was no way to opt the workloadinto automatic restarts through values.
The consuming chart had already set
s3proxy.annotations.reloader.stakater.com/auto: "true"in its values, assuming it would land on the Deployment. No template consumed
that key, so it was silently dropped and the rotation went unnoticed until the
old certificate expired a month later.
Change
Add a
deploymentAnnotationsvalue (default{}, declared invalues.schema.json) rendered onto the Deployment's ownmetadata.annotations:Chart bumped 1.9.3 → 1.10.0. No behavior change when the value is unset.
Verification
helm lint— passes.helm templatewithout the value — Deployment metadata carries noannotationsblock, byte-identical to 1.9.3.helm templatewith the value — annotation renders on the Deploymentmetadata, correctly quoted.
🤖 Generated with Claude Code