sean/seanfarm
Watch
1
0
Fork
You've already forked seanfarm
 0
Code Issues Pull requests Projects Releases 386 Packages Wiki Activity

fix(argo): let Flux replace a one-shot retirement Job #470

Merged
binjovi-bot merged 1 commit from sean/tombstone-force into trunk 2026-09-09 08:15:29 +00:00 AGit
Conversation 0 Commits 1 Files changed 8 +129
sean commented 2026-09-09 08:10:04 +00:00
Owner
Copy link

A Job's pod template is immutable, so the read-grant fix could not reach either tombstone: Flux's dry-run refused it with 'field is immutable', and because that dry-run fails the WHOLE pipelines-retirement Kustomization went Ready: False -- nothing in it reconciled, not the corrected Job, not the ClusterRole beside it, not the other four tombstones. That is the worst property for the one component whose purpose is to run a script once and be corrected when it is wrong. kustomize.toolkit.fluxcd.io/force: enabled makes Flux recreate instead of patch; it is the same annotation rustfs-identities/tempo.yaml already carries. A new guard requires it of every Job in the component, refuses to pass on an empty scan, and has a negative control. https://claude.ai/code/session_01KZoQin34jeyt6nDGqvJA76

A Job's pod template is immutable, so the read-grant fix could not reach either tombstone: Flux's dry-run refused it with 'field is immutable', and because that dry-run fails the WHOLE pipelines-retirement Kustomization went Ready: False -- nothing in it reconciled, not the corrected Job, not the ClusterRole beside it, not the other four tombstones. That is the worst property for the one component whose purpose is to run a script once and be corrected when it is wrong. kustomize.toolkit.fluxcd.io/force: enabled makes Flux recreate instead of patch; it is the same annotation rustfs-identities/tempo.yaml already carries. A new guard requires it of every Job in the component, refuses to pass on an empty scan, and has a negative control. https://claude.ai/code/session_01KZoQin34jeyt6nDGqvJA76
fix(argo): let Flux replace a one-shot retirement Job
All checks were successful
binjovi/ci Binjovi completed the frozen plan
Details
32cc016e1e
 
A Job's pod template is IMMUTABLE. The read-grant fix in the previous commit
could not reach either tombstone: Flux's server-side dry-run refused it,

  Job/flux-system/argo-crd-retire dry-run failed (Invalid):
  spec.template: ... field is immutable

and because that dry-run fails the WHOLE `pipelines-retirement` Kustomization
went `Ready: False`. Nothing in it reconciled -- not the corrected Job, not the
ClusterRole beside it, not the other four tombstones.

That is the worst property this component could have. Its entire purpose is to
run a script once and be corrected when the script turns out to be wrong, and
correcting one wedged all of them.

`kustomize.toolkit.fluxcd.io/force: enabled` makes Flux recreate the Job
instead of trying to patch it. It is the same annotation
`rustfs-identities/tempo.yaml` already carries, and for the same reason. All
six Jobs here get it.

`tests/retirement-jobs-are-replaceable.sh` requires it of every Job in the
component, refuses to pass if it finds no Jobs at all -- the component is
nothing but Jobs, so an empty scan proves nothing -- and has a negative control
that strips the annotation from one Job and requires the check to go red.

Claude-Session: https://claude.ai/code/session_01KZoQin34jeyt6nDGqvJA76
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
sean/seanfarm!470
No description provided.