From b41bf71f5f5d4a99dfe9c9a33933838cd5849095 Mon Sep 17 00:00:00 2001 From: Pratapa Lakshmi Date: Thu, 27 Aug 2026 16:46:25 +0530 Subject: [PATCH] feat(plane-ce): opt-in Stakater Reloader annotation (1.8.0) 1.7.0 gave this chart the externalized-secret contract but nothing to restart the workloads when one of those Secrets changes, so a rotated credential would land in the Kubernetes Secret while the pods kept the value they started with. The credentials would be out of git and still effectively unrotatable. Same flag as plane-cloud 4.9.0, plane-enterprise 3.6.0 and plane-mcp-server 1.5.0: reloader.enabled annotates every workload with reloader.stakater.com/auto, on the workload rather than the pod template, which is where Reloader looks for it. This is what the two dev community environments need before their migration is worth anything -- 1.7.0 alone would move their credentials and leave rotation broken in a way that looks finished. Additive: with the flag off the default render is 0 lines different from published 1.7.0. With it on, 12 of 12 workloads are annotated in both of those environments' real values files. helm lint clean. Co-Authored-By: Claude Opus 5 (1M context) --- charts/plane-ce/Chart.yaml | 2 +- .../templates/workloads/admin.deployment.yaml | 4 ++++ .../templates/workloads/api.deployment.yaml | 4 ++++ .../workloads/beat-worker.deployment.yaml | 4 ++++ .../templates/workloads/live.deployment.yaml | 4 ++++ .../plane-ce/templates/workloads/migrator.job.yaml | 4 ++++ .../templates/workloads/minio.stateful.yaml | 8 ++++++++ .../templates/workloads/postgres.stateful.yaml | 4 ++++ .../templates/workloads/rabbitmq.stateful.yaml | 4 ++++ .../templates/workloads/redis.stateful.yaml | 4 ++++ .../templates/workloads/space.deployment.yaml | 4 ++++ .../templates/workloads/web.deployment.yaml | 4 ++++ .../templates/workloads/worker.deployment.yaml | 4 ++++ charts/plane-ce/values.yaml | 14 ++++++++++++++ 14 files changed, 67 insertions(+), 1 deletion(-) diff --git a/charts/plane-ce/Chart.yaml b/charts/plane-ce/Chart.yaml index e8bc52bf..eedd48eb 100644 --- a/charts/plane-ce/Chart.yaml +++ b/charts/plane-ce/Chart.yaml @@ -5,7 +5,7 @@ description: Meet Plane. An open-source software development tool to manage issu type: application -version: 1.7.0 +version: 1.8.0 appVersion: "1.4.1" home: https://plane.so diff --git a/charts/plane-ce/templates/workloads/admin.deployment.yaml b/charts/plane-ce/templates/workloads/admin.deployment.yaml index 8f2f7a84..81161df8 100644 --- a/charts/plane-ce/templates/workloads/admin.deployment.yaml +++ b/charts/plane-ce/templates/workloads/admin.deployment.yaml @@ -27,6 +27,10 @@ metadata: namespace: {{ .Release.Namespace }} name: {{ .Release.Name }}-admin-wl {{- include "plane.labelsAndAnnotations" (dict "context" $ "values" .Values.admin) }} + {{- if .Values.reloader.enabled }} + annotations: + reloader.stakater.com/auto: "true" + {{- end }} spec: replicas: {{ .Values.admin.replicas | default 1 }} selector: diff --git a/charts/plane-ce/templates/workloads/api.deployment.yaml b/charts/plane-ce/templates/workloads/api.deployment.yaml index bfce0e8f..710b05bc 100644 --- a/charts/plane-ce/templates/workloads/api.deployment.yaml +++ b/charts/plane-ce/templates/workloads/api.deployment.yaml @@ -27,6 +27,10 @@ metadata: namespace: {{ .Release.Namespace }} name: {{ .Release.Name }}-api-wl {{- include "plane.labelsAndAnnotations" (dict "context" $ "values" .Values.api) }} + {{- if .Values.reloader.enabled }} + annotations: + reloader.stakater.com/auto: "true" + {{- end }} spec: replicas: {{ .Values.api.replicas | default 1}} selector: diff --git a/charts/plane-ce/templates/workloads/beat-worker.deployment.yaml b/charts/plane-ce/templates/workloads/beat-worker.deployment.yaml index bf33e81f..d55bd3de 100644 --- a/charts/plane-ce/templates/workloads/beat-worker.deployment.yaml +++ b/charts/plane-ce/templates/workloads/beat-worker.deployment.yaml @@ -4,6 +4,10 @@ metadata: namespace: {{ .Release.Namespace }} name: {{ .Release.Name }}-beat-worker-wl {{- include "plane.labelsAndAnnotations" (dict "context" $ "values" .Values.beatworker) }} + {{- if .Values.reloader.enabled }} + annotations: + reloader.stakater.com/auto: "true" + {{- end }} spec: replicas: {{ .Values.beatworker.replicas | default 1 }} selector: diff --git a/charts/plane-ce/templates/workloads/live.deployment.yaml b/charts/plane-ce/templates/workloads/live.deployment.yaml index d2323fde..2a5b4554 100644 --- a/charts/plane-ce/templates/workloads/live.deployment.yaml +++ b/charts/plane-ce/templates/workloads/live.deployment.yaml @@ -27,6 +27,10 @@ metadata: namespace: {{ .Release.Namespace }} name: {{ .Release.Name }}-live-wl {{- include "plane.labelsAndAnnotations" (dict "context" $ "values" .Values.live) }} + {{- if .Values.reloader.enabled }} + annotations: + reloader.stakater.com/auto: "true" + {{- end }} spec: replicas: {{ .Values.live.replicas | default 1 }} selector: diff --git a/charts/plane-ce/templates/workloads/migrator.job.yaml b/charts/plane-ce/templates/workloads/migrator.job.yaml index 941b5fe7..89ddbc81 100644 --- a/charts/plane-ce/templates/workloads/migrator.job.yaml +++ b/charts/plane-ce/templates/workloads/migrator.job.yaml @@ -5,6 +5,10 @@ metadata: namespace: {{ .Release.Namespace }} name: {{ .Release.Name }}-api-migrate-{{ .Release.Revision }} {{- include "plane.labelsAndAnnotations" (dict "context" $ "values" .Values.api) }} + {{- if .Values.reloader.enabled }} + annotations: + reloader.stakater.com/auto: "true" + {{- end }} spec: backoffLimit: 3 template: diff --git a/charts/plane-ce/templates/workloads/minio.stateful.yaml b/charts/plane-ce/templates/workloads/minio.stateful.yaml index 19921bdc..f42a69c8 100644 --- a/charts/plane-ce/templates/workloads/minio.stateful.yaml +++ b/charts/plane-ce/templates/workloads/minio.stateful.yaml @@ -31,6 +31,10 @@ metadata: namespace: {{ .Release.Namespace }} name: {{ .Release.Name }}-minio-wl {{- include "plane.labelsAndAnnotations" (dict "context" $ "values" .Values.minio) }} + {{- if .Values.reloader.enabled }} + annotations: + reloader.stakater.com/auto: "true" + {{- end }} spec: selector: matchLabels: @@ -90,6 +94,10 @@ metadata: namespace: {{ .Release.Namespace }} name: {{ .Release.Name }}-minio-bucket-{{ .Release.Revision }} {{- include "plane.labelsAndAnnotations" (dict "context" $ "values" .Values.minio) }} + {{- if .Values.reloader.enabled }} + annotations: + reloader.stakater.com/auto: "true" + {{- end }} spec: backoffLimit: 6 completionMode: NonIndexed diff --git a/charts/plane-ce/templates/workloads/postgres.stateful.yaml b/charts/plane-ce/templates/workloads/postgres.stateful.yaml index bee68fa0..e994fe09 100644 --- a/charts/plane-ce/templates/workloads/postgres.stateful.yaml +++ b/charts/plane-ce/templates/workloads/postgres.stateful.yaml @@ -27,6 +27,10 @@ metadata: namespace: {{ .Release.Namespace }} name: {{ .Release.Name }}-pgdb-wl {{- include "plane.labelsAndAnnotations" (dict "context" $ "values" .Values.postgres) }} + {{- if .Values.reloader.enabled }} + annotations: + reloader.stakater.com/auto: "true" + {{- end }} spec: selector: matchLabels: diff --git a/charts/plane-ce/templates/workloads/rabbitmq.stateful.yaml b/charts/plane-ce/templates/workloads/rabbitmq.stateful.yaml index f770fdff..10a4c136 100644 --- a/charts/plane-ce/templates/workloads/rabbitmq.stateful.yaml +++ b/charts/plane-ce/templates/workloads/rabbitmq.stateful.yaml @@ -31,6 +31,10 @@ metadata: namespace: {{ .Release.Namespace }} name: {{ .Release.Name }}-rabbitmq-wl {{- include "plane.labelsAndAnnotations" (dict "context" $ "values" .Values.rabbitmq) }} + {{- if .Values.reloader.enabled }} + annotations: + reloader.stakater.com/auto: "true" + {{- end }} spec: selector: matchLabels: diff --git a/charts/plane-ce/templates/workloads/redis.stateful.yaml b/charts/plane-ce/templates/workloads/redis.stateful.yaml index 3e300a44..4c2201d8 100644 --- a/charts/plane-ce/templates/workloads/redis.stateful.yaml +++ b/charts/plane-ce/templates/workloads/redis.stateful.yaml @@ -29,6 +29,10 @@ metadata: namespace: {{ .Release.Namespace }} name: {{ .Release.Name }}-redis-wl {{- include "plane.labelsAndAnnotations" (dict "context" $ "values" .Values.redis) }} + {{- if .Values.reloader.enabled }} + annotations: + reloader.stakater.com/auto: "true" + {{- end }} spec: selector: matchLabels: diff --git a/charts/plane-ce/templates/workloads/space.deployment.yaml b/charts/plane-ce/templates/workloads/space.deployment.yaml index b1a6bcac..b63cbb69 100644 --- a/charts/plane-ce/templates/workloads/space.deployment.yaml +++ b/charts/plane-ce/templates/workloads/space.deployment.yaml @@ -27,6 +27,10 @@ metadata: namespace: {{ .Release.Namespace }} name: {{ .Release.Name }}-space-wl {{- include "plane.labelsAndAnnotations" (dict "context" $ "values" .Values.space) }} + {{- if .Values.reloader.enabled }} + annotations: + reloader.stakater.com/auto: "true" + {{- end }} spec: replicas: {{ .Values.space.replicas | default 1 }} selector: diff --git a/charts/plane-ce/templates/workloads/web.deployment.yaml b/charts/plane-ce/templates/workloads/web.deployment.yaml index d681b36d..464f4878 100644 --- a/charts/plane-ce/templates/workloads/web.deployment.yaml +++ b/charts/plane-ce/templates/workloads/web.deployment.yaml @@ -27,6 +27,10 @@ metadata: namespace: {{ .Release.Namespace }} name: {{ .Release.Name }}-web-wl {{- include "plane.labelsAndAnnotations" (dict "context" $ "values" .Values.web) }} + {{- if .Values.reloader.enabled }} + annotations: + reloader.stakater.com/auto: "true" + {{- end }} spec: replicas: {{ .Values.web.replicas | default 1 }} selector: diff --git a/charts/plane-ce/templates/workloads/worker.deployment.yaml b/charts/plane-ce/templates/workloads/worker.deployment.yaml index 0d040735..8a2ceefe 100644 --- a/charts/plane-ce/templates/workloads/worker.deployment.yaml +++ b/charts/plane-ce/templates/workloads/worker.deployment.yaml @@ -4,6 +4,10 @@ metadata: namespace: {{ .Release.Namespace }} name: {{ .Release.Name }}-worker-wl {{- include "plane.labelsAndAnnotations" (dict "context" $ "values" .Values.worker) }} + {{- if .Values.reloader.enabled }} + annotations: + reloader.stakater.com/auto: "true" + {{- end }} spec: replicas: {{ .Values.worker.replicas | default 1 }} selector: diff --git a/charts/plane-ce/values.yaml b/charts/plane-ce/values.yaml index 9437f1af..864e7453 100644 --- a/charts/plane-ce/values.yaml +++ b/charts/plane-ce/values.yaml @@ -347,3 +347,17 @@ env: default_cluster_domain: cluster.local api_key_rate_limit: "60/minute" + +# ------------------------------------------------------------------ +# Stakater Reloader +# ------------------------------------------------------------------ +# Adds reloader.stakater.com/auto to every workload, so a rolling restart happens +# when a Secret or ConfigMap it references changes -- including the Secrets named +# in external_secrets, which is how a rotated credential reaches a running pod. +# Without it, whatever manages those Secrets refreshes them on its own schedule and +# the pods keep the values they started with. +# +# Requires Reloader to be installed in the cluster; the chart does not install it. +reloader: + enabled: false +