thwap/thwap-pagesd

Watch

Fork 0

feat(kubernetes): implement storage for site assets #139

Merged

fuzzy merged 2 commits from feat/site-asset-storage into main

2026-08-02 20:51:45 +00:00

automation commented

2026-08-02 20:22:22 +00:00

Owner

What

Implement configurable storage for site assets in internal/kubernetes:

#56 — emptyDir or PVC:
- New config keys kubernetes.storage_type (emptyDir default | pvc) and kubernetes.storage_class (empty → cluster default)
- pvcTemplate builds a per-site PersistentVolumeClaim (<site>-data, ReadWriteOnce, storage class, 1Gi)
- PublishSite upserts the PVC when PVC storage is configured; DeleteSite removes it
- The Deployment's site volume source switches between emptyDir and the PVC
#57 — production-version symlink:
- Versioned layout: the site volume mounts at /var/www with versions/ subdirectories; nginx root stays /var/www/site
- A symlink init container creates /var/www/site → /var/www/versions/$SITE_VERSION at pod start
- SymlinkVersion(root, version) helper creates/re-points the symlink (used by the publish flow in #73)

Tests: fake-clientset coverage for emptyDir vs PVC volume sources, PVC publish/delete, and TempDir-based symlink tests (create + re-point).

Why

Phase 4 task #58 — completes the Kubernetes Integration phase. The storage plumbing the webhook receiver (#73) uses to serve published site content.

Testing

go build ./...
go vet ./...
go test -race ./internal/kubernetes/ — 23 tests pass
gofmt -l ./cmd ./internal ./pkg clean
golangci-lint run — 0 issues
pre-commit hooks all pass

Breaking Changes

None.

Notes

The init container pins SITE_VERSION to v0.0.0 for now; the publish flow (#73) will set the real version.
Content population into the volume is the publish flow's job (#73); this task delivers the storage + symlink mechanics.
Issues #56–#58 were closed via the Forgejo API as part of this task per the workflow.
Phase 4 (Kubernetes Integration) is now complete.

Closes #56
Closes #57
Closes #58

## What Implement configurable storage for site assets in `internal/kubernetes`: - **#56 — emptyDir or PVC**: - New config keys `kubernetes.storage_type` (`emptyDir` default | `pvc`) and `kubernetes.storage_class` (empty → cluster default) - `pvcTemplate` builds a per-site PersistentVolumeClaim (`<site>-data`, ReadWriteOnce, storage class, 1Gi) - `PublishSite` upserts the PVC when PVC storage is configured; `DeleteSite` removes it - The Deployment's `site` volume source switches between `emptyDir` and the PVC - **#57 — production-version symlink**: - Versioned layout: the site volume mounts at `/var/www` with `versions/` subdirectories; nginx root stays `/var/www/site` - A `symlink` init container creates `/var/www/site → /var/www/versions/$SITE_VERSION` at pod start - `SymlinkVersion(root, version)` helper creates/re-points the symlink (used by the publish flow in #73) **Tests**: fake-clientset coverage for emptyDir vs PVC volume sources, PVC publish/delete, and TempDir-based symlink tests (create + re-point). ## Why Phase 4 task #58 — completes the Kubernetes Integration phase. The storage plumbing the webhook receiver (#73) uses to serve published site content. ## Testing - [x] `go build ./...` - [x] `go vet ./...` - [x] `go test -race ./internal/kubernetes/` — 23 tests pass - [x] `gofmt -l ./cmd ./internal ./pkg` clean - [x] `golangci-lint run` — 0 issues - [x] pre-commit hooks all pass ## Breaking Changes None. ## Notes - The init container pins `SITE_VERSION` to `v0.0.0` for now; the publish flow (#73) will set the real version. - Content population into the volume is the publish flow's job (#73); this task delivers the storage + symlink mechanics. - Issues #56–#58 were closed via the Forgejo API as part of this task per the workflow. - Phase 4 (Kubernetes Integration) is now complete. Closes #56 Closes #57 Closes #58

automation added 1 commit

2026-08-02 20:22:22 +00:00

feat(kubernetes): implement storage for site assets

Test and Release / lint (pull_request) Successful in 4m28s

Details

Test and Release / test (pull_request) Has been cancelled

Details

ffdc6e5a78

Add configurable site asset storage for the serving pods:

- storage_type (emptyDir default | pvc) and storage_class config keys;
  the Deployment site volume switches between emptyDir and a per-site
  PersistentVolumeClaim (<site>-data)
- pvcTemplate with access mode ReadWriteOnce, storage class, and 1Gi
  request; PublishSite upserts the PVC when pvc storage is configured
  and DeleteSite removes it
- versioned layout: the site volume mounts at /var/www with versions/
  subdirectories, and an init container creates the /var/www/site
  symlink to the active version (SITE_VERSION env)
- SymlinkVersion helper creates and re-points the /var/www/site
  symlink to root/versions/<version>

Add fake-clientset tests for emptyDir vs PVC volume sources, PVC
publish/delete, and TempDir-based symlink tests. Mark task done in
ROADMAP.md.

closes #56
closes #57
closes #58

automation added the

Kind/Feature

label

2026-08-02 20:22:28 +00:00

fuzzy scheduled this pull request to auto merge when all checks succeed

2026-08-02 20:24:19 +00:00

the.auditor requested changes

2026-08-02 20:34:30 +00:00

Dismissed

the.auditor left a comment

Review Summary

Verified locally on the PR head (ffdc6e5): go build, go vet, go mod verify, gofmt, golangci-lint run all clean; all 23 kubernetes tests pass with -race.

The storage refactor is otherwise well done — siteVolume cleanly switches between emptyDir and PVC, pvcTemplate/upsertPVC/deletePVC mirror the established upsert pattern, storage_class nil-handling correctly falls back to the cluster default, and SymlinkVersion (create + re-point, tested against a real TempDir) is solid.

Blocking Issue

internal/kubernetes/templates.go — the symlink init container's shell script writes to the wrong path. The init container mounts the site volume at siteVolumePath (/var/www), but the command is mkdir -p /www/versions && ln -sfn /www/versions/"$SITE_VERSION" /www/site. Everything lands in the container's ephemeral rootfs at /www, not in the shared volume at /var/www. The static container mounts the same volume at /var/www and nginx's root is /var/www/site, so /var/www/site never exists and published sites serve nothing.

Empirically confirmed by rendering deploymentTemplate (mount /var/www vs script /www/...). The fake clientset just stores the object, so the existing tests don't catch this.

Fix: point the script at the mount path — mkdir -p /var/www/versions && ln -sfn /var/www/versions/"$SITE_VERSION" /var/www/site (or mount the volume at /www). Consider a unit test asserting the init container's script references the same path as its VolumeMounts.

Non-blocking Suggestions

PVC spec (accessModes/storageClassName/resources) is largely immutable once bound — the upsertPVC Update path is really create-or-error-on-drift. Fine for identical re-publishes, but worth knowing a storage-class change on an existing site will fail rather than migrate.
SymlinkVersion is Remove + Symlink (non-atomic) — brief window without the link. Acceptable for now; a rename-based swap would be cleaner later.

The blocking item is a one-word path fix in the init container command.

## Review Summary Verified locally on the PR head (`ffdc6e5`): `go build`, `go vet`, `go mod verify`, `gofmt`, `golangci-lint run` all clean; all 23 kubernetes tests pass with `-race`. The storage refactor is otherwise well done — `siteVolume` cleanly switches between emptyDir and PVC, `pvcTemplate`/`upsertPVC`/`deletePVC` mirror the established upsert pattern, `storage_class` nil-handling correctly falls back to the cluster default, and `SymlinkVersion` (create + re-point, tested against a real TempDir) is solid. ## Blocking Issue 1. `internal/kubernetes/templates.go` — the `symlink` init container's shell script writes to the wrong path. The init container mounts the site volume at `siteVolumePath` (`/var/www`), but the command is `mkdir -p /www/versions && ln -sfn /www/versions/"$SITE_VERSION" /www/site`. Everything lands in the container's ephemeral rootfs at `/www`, not in the shared volume at `/var/www`. The static container mounts the same volume at `/var/www` and nginx's `root` is `/var/www/site`, so `/var/www/site` never exists and published sites serve nothing. Empirically confirmed by rendering `deploymentTemplate` (mount `/var/www` vs script `/www/...`). The fake clientset just stores the object, so the existing tests don't catch this. **Fix:** point the script at the mount path — `mkdir -p /var/www/versions && ln -sfn /var/www/versions/"$SITE_VERSION" /var/www/site` (or mount the volume at `/www`). Consider a unit test asserting the init container's script references the same path as its `VolumeMounts`. ## Non-blocking Suggestions 1. PVC spec (accessModes/storageClassName/resources) is largely immutable once bound — the `upsertPVC` Update path is really create-or-error-on-drift. Fine for identical re-publishes, but worth knowing a storage-class change on an existing site will fail rather than migrate. 2. `SymlinkVersion` is `Remove` + `Symlink` (non-atomic) — brief window without the link. Acceptable for now; a `rename`-based swap would be cleaner later. The blocking item is a one-word path fix in the init container command.

fuzzy added 1 commit

2026-08-02 20:44:25 +00:00

fix(kubernetes): point symlink init container at volume mount path

Test and Release / lint (pull_request) Successful in 4m1s

Details

Test and Release / test (pull_request) Successful in 7m17s

Details

4b558c0866

The symlink init container script referenced /www/... while its volume
is mounted at /var/www, so /var/www/site never existed in the shared
volume and published sites served nothing. Correct the script to use
/var/www, matching the mount path.

Add a regression test asserting the init container script references
its own volume mount path and creates the /var/www/site symlink.

automation commented

2026-08-02 20:44:29 +00:00

Author

Owner

Review changes addressed in 4b558c0:

Blocking issue — the symlink init container script now uses /var/www/versions/... and /var/www/site, matching the volume mount path siteVolumePath (/var/www). Previously the script wrote to /www, so the symlink landed in the ephemeral rootfs instead of the shared volume.

Regression test added — TestInitContainerScriptMatchesMountPath asserts the init container's command references its own volume mount path and creates the /var/www/site symlink.

Verified: go build, go vet, gofmt, golangci-lint run clean; all 24 kubernetes tests pass with -race.

Review changes addressed in `4b558c0`: **Blocking issue** — the `symlink` init container script now uses `/var/www/versions/...` and `/var/www/site`, matching the volume mount path `siteVolumePath` (`/var/www`). Previously the script wrote to `/www`, so the symlink landed in the ephemeral rootfs instead of the shared volume. **Regression test added** — `TestInitContainerScriptMatchesMountPath` asserts the init container's command references its own volume mount path and creates the `/var/www/site` symlink. Verified: `go build`, `go vet`, `gofmt`, `golangci-lint run` clean; all 24 kubernetes tests pass with `-race`.

the.auditor approved these changes

2026-08-02 20:47:00 +00:00

the.auditor left a comment

Review Summary

The blocking issue from the previous review is resolved.

Blocker fixed — the symlink init container's command now operates on the actual mount path: mkdir -p /var/www/versions && ln -sfn /var/www/versions/"$SITE_VERSION" /var/www/site, matching the volume mount at /var/www. The symlink now lands in the shared volume where nginx's root /var/www/site can follow it.
Regression covered — new TestInitContainerScriptMatchesMountPath asserts the init container's script references its volume mount path and the siteMountPath symlink, closing exactly the gap that let the original bug slip through.

Verified locally on the PR head (4b558c0): go build, go vet, go mod verify, gofmt, golangci-lint run all clean; all 23 kubernetes tests pass with -race.

No blocking issues. The non-blocking notes from the previous review (PVC spec immutability on upsert, non-atomic symlink swap) still stand but don't block.

Approving.

## Review Summary The blocking issue from the previous review is resolved. 1. **Blocker fixed** — the `symlink` init container's command now operates on the actual mount path: `mkdir -p /var/www/versions && ln -sfn /var/www/versions/"$SITE_VERSION" /var/www/site`, matching the volume mount at `/var/www`. The symlink now lands in the shared volume where nginx's `root /var/www/site` can follow it. 2. **Regression covered** — new `TestInitContainerScriptMatchesMountPath` asserts the init container's script references its volume mount path and the `siteMountPath` symlink, closing exactly the gap that let the original bug slip through. Verified locally on the PR head (`4b558c0`): `go build`, `go vet`, `go mod verify`, `gofmt`, `golangci-lint run` all clean; all 23 kubernetes tests pass with `-race`. **No blocking issues.** The non-blocking notes from the previous review (PVC spec immutability on upsert, non-atomic symlink swap) still stand but don't block. Approving.

fuzzy merged commit 4b558c0866 into main

2026-08-02 20:51:45 +00:00

fuzzy deleted branch feat/site-asset-storage

2026-08-02 20:51:46 +00:00