Date: 2026-04-06
Namespace: bodylog
bodylog-ci service account RBAC bootstrap deadlock that blocked kubectl apply of ServiceAccount, Role, and RoleBinding resources from the Gitea deployment workflow.k8s/07-ci-deployer-rbac.yaml once with an admin-capable kubeconfig.bodylog-postgres-secrets in namespace bodylog with runtime-only credentials.bodylog-app-config in namespace bodylog with PostgreSQL connection settings.k8s/03-pvc.yaml, k8s/04-network-policies.yaml, k8s/06-postgres.yaml, and k8s/05-deployment-service-ingress.yaml.bodylog-postgres deployment to remove the capabilities.drop: ["ALL"] setting after initial startup failed.system:serviceaccount:bodylog:bodylog-ci could not get/apply ServiceAccount, Role, and RoleBinding resources in namespace bodylog.Initial PostgreSQL startup failed with:
chmod: /var/run/postgresql: Operation not permittedchown: /var/lib/postgresql/data/pgdata: Operation not permittedRoot cause:
postgres:16-alpine entrypoint needs to adjust ownership and permissions during initial database bootstrap on the mounted PVC.A subsequent app rollout failed with:
failed to connect to PostgreSQL: Configuration(InvalidPort)Root cause:
bodylog-ci can now server-dry-run apply the current RBAC, app-config, PVC, network policy, Postgres, and BodyLog deployment manifests.deployment/bodylog-postgres rolled out successfully.deployment/bodylog rolled out successfully after password rotation.Commits pushed to BodyLog/Bodylog.dev main:
26c4869 k8s: fix bodylog db rolloutc8842db backend: build postgres options safelyRepo changes applied:
k8s/02-bodylog-app-config.yaml.k8s/02-config-and-secrets.yaml during automated rollout.k8s/kustomization.yaml to use the dedicated BodyLog app config manifest.capabilities.drop: ["ALL"] from k8s/06-postgres.yaml.k8s/02-config-and-secrets.yaml still contains placeholder/example data and should not be used for direct live apply.sha-26c48696f059) while the later backend commit (c8842db) waits for its normal Gitea Actions rollout.