Repository navigation
fix(chart): a ConfigMap/Secret change rolls the portal — checksum annotations on the pod template - #2801
Merged
Conversation
…otations on the pod template Config and secrets reach the portal as ENV at pod start. Without a hash of the rendered ConfigMap/Secret on the pod template, `helm upgrade` with a changed value reports "deployed", the rendered objects carry the value, and no running process ever reads it. Measured on memex-cloud revision 21 (2026-08-30 16:13Z): memex-portal-secrets rendered PluginCatalog__OpenRegistration__Key, the image was unchanged, both pods stayed up and kept answering 401. The two annotations turn a configuration change into the same graceful one-at-a-time rollout an image change gets, and into nothing when nothing changed: both templates render deterministically from values, so `helm template` twice with the same values yields the same hash, and only the secrets hash moves when a secret moves (proved by rendering with and without --set secrets.memex_portal.PluginCatalog__OpenRegistration__Key). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01C1SquDKJNKZxEUbuaPjUgu
Contributor
There was a problem hiding this comment.
Pull request overview
This PR fixes a Helm chart rollout gap where updates to the rendered ConfigMap/Secret (consumed via envFrom) did not trigger a Deployment rollout, leaving running portal pods on stale configuration. It does this by adding checksum annotations to the pod template so any config/secret change causes a graceful rolling restart, and documents the behavior change in What’s New.
Changes:
- Add pod-template annotations hashing the rendered
memex-portalConfigMap and Secret to trigger rollouts on configuration-only upgrades. - Add a What’s New entry documenting that config/secret-only Helm upgrades now restart the portal pods.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| deploy/helm/templates/memex-portal/deployment.yaml | Adds checksum/config and checksum/secrets annotations to the pod template to force a rollout when ConfigMap/Secret content changes. |
| src/MeshWeaver.Documentation/Data/WhatsNew/2026-08-30-a-configuration-change-now-restarts-the-portal.md | Documents the operational behavior change for configuration/secret updates. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Contributor
Contributor
Contributor
Contributor
Contributor
Contributor
Contributor
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The defect, measured
deploy/helm/templates/memex-portal/deployment.yamlcarries no hash of the rendered ConfigMap/Secret on its pod template. The portal reads both as env at pod start (envFrom: configMapRef memex-portal-config / secretRef memex-portal-secrets), so ahelm upgradethat changes only configuration rolls nothing:helm-release.yml deploy→ revision 21,Release "memexcloud" has been upgraded, image kept (ci.6762).kubectl get secret memex-portal-secrets(key names only):PluginCatalog__OpenRegistration__Keypresent.POST /api/instances/registerwithout a key: still 401A valid registration bootstrap key is required— the process never loaded the value.This is the "we set it and it vanished" shape
helm-release.yml's header warns about, from the other side: the value did land, in an object nobody re-read.The fix
Two annotations on the pod template, hashing the rendered
config.yamlandsecrets.yaml:A configuration change now gets exactly the rollout an image change gets — graceful, one pod at a time under the PDB and the drain budget already on this template — and an upgrade that changes nothing restarts nothing.
Verification
helm lint deploy/helm→ 0 failed.helm templatetwice with the same values → identical hashes. With--set secrets.memex_portal.PluginCatalog__OpenRegistration__Key=…→ onlychecksum/secretschanges,checksum/configidentical (both templates render deterministically: norand/now/lookup).check-chart-invariants.sh→ all 3 values combinations self-consistent;check-values-are-read.sh→ all 115 keys read.memex-portal-deploymentconsumes these objects (portal-next.yamlreferences neither), so the scope is that one Deployment.What's New entry included (Category: Fix).
🤖 Generated with Claude Code
https://claude.ai/code/session_01C1SquDKJNKZxEUbuaPjUgu