titan/atlas-iac
3
0
Fork 0
Code Issues Pull Requests 9 Actions Packages Projects Releases Wiki Activity

fix(mailu): self-heal mailbox lock failures

Browse Source
This commit is contained in:
jenkins 2026-08-23 14:50:02 -03:00
parent 5b5df4ea59
commit 225793facd
3 changed files with 165 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

33
services/mailu/helmrelease.yaml
View File

@ -208,9 +208,10 @@ spec:
dovecot:
logLevel: DEBUG
nodeSelector:
hardware: rpi4
hardware: rpi5
node-role.kubernetes.io/worker: "true"
podAnnotations:
bstein.dev/storage-remount-at: "2026-08-22T17:49:52Z"
bstein.dev/storage-remount-at: "2026-08-23T17:55:00Z"
oletools:
logLevel: DEBUG
nodeSelector:
@ -575,6 +576,8 @@ spec:
metadata:
name: mailu-dovecot
spec:
strategy:
type: Recreate
template:
metadata:
annotations:
@ -634,6 +637,32 @@ spec:
$patch: delete
- name: VAULT_ENV_FILE
value: /vault/secrets/mailu-env.sh
livenessProbe:
exec:
command:
- sh
- -ec
- >-
kill -0 "$(cat /run/dovecot/master.pid)" &&
doveadm mailbox status -u brad@bstein.dev uidnext INBOX >/dev/null
initialDelaySeconds: 30
periodSeconds: 30
timeoutSeconds: 10
failureThreshold: 2
successThreshold: 1
readinessProbe:
exec:
command:
- sh
- -ec
- >-
kill -0 "$(cat /run/dovecot/master.pid)" &&
doveadm mailbox status -u brad@bstein.dev uidnext INBOX >/dev/null
initialDelaySeconds: 20
periodSeconds: 15
timeoutSeconds: 10
failureThreshold: 1
successThreshold: 1
volumeMounts:
- name: mailu-vault-entrypoint
mountPath: /entrypoint.sh

1
services/mailu/kustomization.yaml
View File

@ -15,6 +15,7 @@ resources:
- ingressroute.yaml
- mailu-sync-cronjob.yaml
- front-lb.yaml
- mailbox-watchdog.yaml
configMapGenerator:
- name: mailu-vault-env

133
services/mailu/mailbox-watchdog.yaml Normal file
View File

@ -0,0 +1,133 @@
# services/mailu/mailbox-watchdog.yaml
---
apiVersion: v1
kind: ServiceAccount
metadata:
name: mailu-mailbox-watchdog
namespace: mailu-mailserver
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
name: mailu-mailbox-watchdog
namespace: mailu-mailserver
rules:
- apiGroups: [""]
resources: ["pods"]
verbs: ["get", "list", "delete"]
- apiGroups: [""]
resources: ["pods/exec"]
verbs: ["create"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: mailu-mailbox-watchdog
namespace: mailu-mailserver
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: mailu-mailbox-watchdog
subjects:
- kind: ServiceAccount
name: mailu-mailbox-watchdog
namespace: mailu-mailserver
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: mailu-mailbox-watchdog
namespace: mailu-mailserver
spec:
replicas: 1
selector:
matchLabels:
app: mailu-mailbox-watchdog
template:
metadata:
labels:
app: mailu-mailbox-watchdog
spec:
serviceAccountName: mailu-mailbox-watchdog
automountServiceAccountToken: true
nodeSelector:
hardware: rpi5
node-role.kubernetes.io/worker: "true"
containers:
- name: watchdog
image: registry.bstein.dev/bstein/kubectl:1.35.0
imagePullPolicy: IfNotPresent
command: ["/bin/sh", "-ec"]
env:
- name: HOME
value: /tmp
args:
- |
failures=0
last_pod=""
sleep 60
while true; do
pod="$(kubectl get pods \
-l app.kubernetes.io/component=dovecot,app.kubernetes.io/instance=mailu \
--field-selector=status.phase=Running \
-o jsonpath='{.items[0].metadata.name}' 2>/dev/null || true)"
if [ -z "${pod}" ]; then
failures=0
last_pod=""
sleep 30
continue
fi
if [ "${pod}" != "${last_pod}" ]; then
failures=0
last_pod="${pod}"
echo "watching ${pod}; allowing startup grace"
sleep 60
continue
fi
if timeout 15s kubectl exec "${pod}" -c dovecot -- \
doveadm mailbox status -u brad@bstein.dev uidnext INBOX >/dev/null 2>&1; then
if [ "${failures}" -gt 0 ]; then
echo "mailbox health recovered after ${failures} failed checks"
fi
failures=0
else
failures=$((failures + 1))
echo "mailbox health check failed (${failures}/4) for ${pod}" >&2
fi
if [ "${failures}" -ge 4 ]; then
echo "recreating ${pod} to remount mailbox storage after persistent failures" >&2
kubectl delete pod "${pod}" --wait=false
failures=0
last_pod=""
sleep 180
continue
fi
sleep 30
done
resources:
requests:
cpu: 10m
memory: 32Mi
limits:
cpu: 100m
memory: 128Mi
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop: ["ALL"]
readOnlyRootFilesystem: true
runAsNonRoot: true
runAsUser: 65532
volumeMounts:
- name: tmp
mountPath: /tmp
imagePullSecrets:
- name: harbor-regcred
volumes:
- name: tmp
emptyDir: {}