From 799f9edc49c6f3663b5f16eaf897a25a56dd2f07 Mon Sep 17 00:00:00 2001 From: Petrus Repo Date: Wed, 5 Aug 2026 13:40:42 +0300 Subject: [PATCH 1/2] fix: Skip the keycloak CNPG PDB for a single instance A CloudNativePG Cluster with instances: 1 gets a -primary PodDisruptionBudget at minAvailable: 1, which permits zero disruptions for as long as the cluster is single-instance. That PDB protects nothing, since there is no second replica to keep serving, and it blocks kubectl drain on whichever node the pod sits on. Node maintenance then stalls until an operator disables it by hand on the live cluster, out of band from Git. enablePDB now defaults to false while instances is 1 and true from two instances up, and an explicit cnpg.enablePDB wins either way. --- sources/keycloak-old/templates/keycloak-cnpg.yaml | 3 +++ sources/keycloak-old/values.yaml | 7 +++++++ 2 files changed, 10 insertions(+) diff --git a/sources/keycloak-old/templates/keycloak-cnpg.yaml b/sources/keycloak-old/templates/keycloak-cnpg.yaml index d1f4d11a..ee35097c 100644 --- a/sources/keycloak-old/templates/keycloak-cnpg.yaml +++ b/sources/keycloak-old/templates/keycloak-cnpg.yaml @@ -20,6 +20,9 @@ spec: - GRANT CREATE ON SCHEMA public TO {{ .Values.postgresql.username }} secret: name: {{ .Values.postgresql.userSecretName }} + {{- /* An explicit value wins; otherwise a single instance gets no PDB, + since one that never permits a disruption only blocks drains. */}} + enablePDB: {{ if kindIs "invalid" .Values.cnpg.enablePDB }}{{ gt (int .Values.cnpg.instances) 1 }}{{ else }}{{ .Values.cnpg.enablePDB }}{{ end }} imageName: ghcr.io/cloudnative-pg/postgresql:17 instances: {{ .Values.cnpg.instances }} nodeMaintenanceWindow: diff --git a/sources/keycloak-old/values.yaml b/sources/keycloak-old/values.yaml index fbce3db5..1c839edf 100644 --- a/sources/keycloak-old/values.yaml +++ b/sources/keycloak-old/values.yaml @@ -7,6 +7,13 @@ hostname: "" cnpg: enabled: true instances: 1 + # PodDisruptionBudget for the primary. Left unset, it follows instances: + # off for a single instance, on for two or more. A single-instance PDB + # protects nothing, because there is no second replica to keep serving, + # and it blocks `kubectl drain` on the node the pod happens to sit on, + # so node maintenance stalls until someone disables it by hand. + # Set true or false to override. + enablePDB: null storage: storageClassName: "default" From 5dfbc507278cbc0d13b373e7a90ec3cac648c6da Mon Sep 17 00:00:00 2001 From: Petrus Repo Date: Wed, 5 Aug 2026 13:51:51 +0300 Subject: [PATCH 2/2] fix: Skip the keycloak-config CNPG PDB for a single instance keycloak-config renders the same keycloak-cnpg Cluster as keycloak-old, so it carries the same drain blocker. A single-instance PDB permits zero disruptions, which protects nothing and only stalls `kubectl drain` on whichever node the primary sits on. Introduce the cnpg values block this chart lacked and derive enablePDB from instances, with an explicit value winning. Matches the pattern already applied to keycloak-old in this branch. --- .../keycloak-config/templates/keycloak-cluster.yaml | 5 ++++- sources/keycloak-config/values.yaml | 10 ++++++++++ 2 files changed, 14 insertions(+), 1 deletion(-) diff --git a/sources/keycloak-config/templates/keycloak-cluster.yaml b/sources/keycloak-config/templates/keycloak-cluster.yaml index 60ac23e8..128e766d 100644 --- a/sources/keycloak-config/templates/keycloak-cluster.yaml +++ b/sources/keycloak-config/templates/keycloak-cluster.yaml @@ -75,8 +75,11 @@ spec: - GRANT CREATE ON SCHEMA public TO keycloak secret: name: keycloak-cnpg-user + {{- /* An explicit value wins; otherwise a single instance gets no PDB, + since one that never permits a disruption only blocks drains. */}} + enablePDB: {{ if kindIs "invalid" .Values.cnpg.enablePDB }}{{ gt (int .Values.cnpg.instances) 1 }}{{ else }}{{ .Values.cnpg.enablePDB }}{{ end }} imageName: ghcr.io/cloudnative-pg/postgresql:17 - instances: 1 + instances: {{ .Values.cnpg.instances }} nodeMaintenanceWindow: inProgress: false reusePVC: true diff --git a/sources/keycloak-config/values.yaml b/sources/keycloak-config/values.yaml index f97ac442..8f577f31 100644 --- a/sources/keycloak-config/values.yaml +++ b/sources/keycloak-config/values.yaml @@ -1 +1,11 @@ domain: # to be filled by cluster-forge app + +cnpg: + instances: 1 + # PodDisruptionBudget for the primary. Left unset, it follows instances: + # off for a single instance, on for two or more. A single-instance PDB + # protects nothing, because there is no second replica to keep serving, + # and it blocks `kubectl drain` on the node the pod happens to sit on, + # so node maintenance stalls until someone disables it by hand. + # Set true or false to override. + enablePDB: null