feedc0de/homelab-gitops
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Document completed Quay cutover and rollback data

Browse Source
This commit is contained in:
feedc0de
2026-10-20 09:09:05 +02:00
parent 0cfb370a68
commit f0be591558
1 changed files with 15 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
apps/quay/README.md
+15 -8
View File
@@ -14,16 +14,23 @@ Application without changing its name or spec. Its existing `quay` bucket is
bucket, and RGW data during any rollback.
`default/secret/quay-config` contains Quay's persistent encryption keys and
currently points at the shared PostgreSQL Service. It is retained as rollback
points at the former shared PostgreSQL Service. It is retained as rollback
data. `quay-config-next` contains the same keys and S3 credentials with only
`DB_URI` changed to `quay-postgresql.default.svc.cluster.local`; neither
Secret's contents belongs in this public repository. `quay-postgres` holds the
dedicated PostgreSQL passwords. Restore those Secrets from the encrypted
administrator backup before enabling `quay.enabled` in a new cluster.
administrator backup before restoring this installation in a new cluster.
The migration starts with `quay.enabled: false`, deploying only dedicated
PostgreSQL. Stop both legacy Quay Deployments before the final database dump,
restore that dump to `quay-postgresql`, switch the config Secret, then enable
Quay in this values file. Preserve the old shared database and PVC for rollback
until backups and live pulls/pushes have been verified. The old direct Gitea CD
writer must be removed after Argo adopts and verifies both Deployments.
The cutover stopped both old Quay Deployments, took a final PostgreSQL dump,
restored it into `quay-postgresql`, and enabled the registry with
`quay-config-next`. The final dump is stored outside Git at
`/home/feedc0de/migration-backups/quay/final-cutover-2026-10-20.dump` on the
administrator host. The old shared `quay` database and its PVC remain for
rollback; do not drop or overwrite them until off-cluster backups and actual
image pulls and pushes have been verified. The old direct Gitea deployment
writer and its kubeconfig were removed. Argo CD is the only normal writer.
The Argo Application intentionally has pruning disabled. In particular,
removing the adopted Rook object-user resource from Git must never silently
delete the credentials to the existing image bucket. Review data-bearing
resources individually before enabling pruning.