Repository navigation
fix(recovery): keep the standby repair's isolation mark from being reverted - #4680
Conversation
… Flux The first protected run fenced wedding-db-1 with a default kubectl patch. kustomize-controller takes over fields owned by kubectl managers and removed the annotation at its next reconciliation, 22 seconds before the repair's own check held on the missing fence. Every patch now names its own field manager. Part of #4673 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@coderabbitai review |
✅ Action performedReview finished.
|
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configuration
📒 Files selected for processing (3)
Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review. 📜 Recent review details⏰ Context from checks skipped due to timeout. (1)
🔇 Additional comments (3)
📝 WalkthroughWalkthroughThe repair script now sets Priority: ⬆️ High Merge Risk: ⚪ Minimal · up to The repair’s fence writes use its dedicated field manager, and the reviewed changes show no uncovered path that would let reconciliation undo the fence. No actionable merge risk remains. 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Evaluation at
Not proven here: that the second dispatch completes. That is read from the run itself. |
Why
The reviewed repair for the broken wedding database replica stopped part-way on its first run. It marks the replica as isolated before touching its storage, and the platform's own Git synchronisation removed that mark seconds later because it did not recognise who had written it. The repair then saw the mark missing and held, so the replica is still down and production deploys that must restart its neighbours keep failing.
What
The repair now signs its changes with its own name, which the Git synchronisation leaves alone, so the isolation mark stays in place until the repair removes it. A new check fails if a repair step is ever sent without that name. Nothing in production changes until the repair is dispatched again from main.
Part of #4673
👉 After merge/promotion: dispatch the standby replacement once more from main; the previous attempt already made the old storage safe to keep.