From 41d696e9fe5438fbeb6b3cd6440379c861921d84 Mon Sep 17 00:00:00 2001 From: Keith Jackson Date: Wed, 26 Aug 2026 02:09:22 -0500 Subject: [PATCH] =?UTF-8?q?fix(apps):=20semaphore=20SEMAPHORE=5FPORT=20?= =?UTF-8?q?=E2=80=94=20shadow=20kubelet=20service-link=20injection?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit With the config PVC now writable (fsGroup), semaphore got past config write and pinged its PostgreSQL successfully, then crashed on: panic: value of field 'Port' is not valid: tcp://:3000 Because the Service is named `semaphore`, the kubelet injects the Docker-link-style SEMAPHORE_PORT=tcp://:3000, which collides with Semaphore's OWN SEMAPHORE_PORT (its HTTP listen port). Add an explicit SEMAPHORE_PORT=":3000" env entry — user-defined env takes precedence over service-link vars — pinning the listen port back to :3000 (matches containerPort/Service). Uses the existing env field; only apps/semaphore.yaml changes, all others byte-identical. Co-Authored-By: Claude Opus 4.8 --- apps/semaphore.yaml | 2 ++ catalog/semaphore.yaml | 7 +++++++ 2 files changed, 9 insertions(+) diff --git a/apps/semaphore.yaml b/apps/semaphore.yaml index f750f94..a0a2e57 100644 --- a/apps/semaphore.yaml +++ b/apps/semaphore.yaml @@ -116,6 +116,8 @@ spec: secretKeyRef: name: semaphore-bootstrap key: access-key-encryption + - name: SEMAPHORE_PORT + value: :3000 volumeMounts: - name: config mountPath: /etc/semaphore diff --git a/catalog/semaphore.yaml b/catalog/semaphore.yaml index eb78054..736f79e 100644 --- a/catalog/semaphore.yaml +++ b/catalog/semaphore.yaml @@ -66,6 +66,13 @@ env: secretKeyRef: name: semaphore-bootstrap key: access-key-encryption + # Because the Service is named `semaphore`, the kubelet injects a Docker-link-style + # SEMAPHORE_PORT=tcp://:3000 env var, which COLLIDES with Semaphore's OWN SEMAPHORE_PORT + # (its HTTP listen port) and crashes config validation ("field 'Port' is not valid: tcp://..."). An + # explicit env entry shadows the injected one (the kubelet gives user-defined env precedence over + # service links), pinning the listen port back to :3000 (matches containerPort/Service). + - name: SEMAPHORE_PORT + value: ":3000" # The semaphoreui/semaphore image runs as the non-root user UID 1001 / GID 0 (tini -> server-wrapper), # and on boot the wrapper writes its generated config.json into the config dir. A mounted Longhorn PVC # is root:root, so UID 1001 cannot write it -> the pod panics ("permission denied"). fsGroup=1001 makes