jakman85andClaude Opus 4.8
7b8777c1e1
Seerr v3.4.1 (ghcr.io/seerr-team/seerr) runs as the non-root user node:node (UID/GID 1000), unlike the old root-running sctx/overseerr image. Its root-owned Longhorn RWO config PVC at /app/config was not writable by UID 1000, so the pod CrashLoopBackOff'd with: Error: EACCES: permission denied, mkdir '/app/config/logs/' Add a podSecurityContext with fsGroup=1000 (plus runAsUser/runAsGroup/runAsNonRoot) to the seerr ServiceDefinition — the same schema 1.3.0 mechanism semaphore uses. Longhorn's CSIDriver fsGroupPolicy: ReadWriteOnceWithFSType applies fsGroup to this RWO filesystem volume, group-owning the PVC to GID 1000 so the process can write. Re-rendered apps/wave-2/seerr.yaml from the catalog source. Co-Authored-By: Claude Opus 4.8 <[email protected]>
apps
App-tier manifests, rendered from catalog/*.yaml ServiceDefinitions by catalog/render.py
and split into dependency-ordered waves (wave-<N>/).
- Each
wave-<N>/is reconciled by its own Flux Kustomizationapps-wave-<N>(clusters/base/apps-wave-<N>.yaml), whichdependsOnwave N-1 (wave 0 dependsOnplatform-config) and health-gates (wait: true) ONLY that wave. A crashlooping workload in a later wave can no longer stall an earlier wave or block new revisions. wave-<N>/kustomization.yamlandclusters/base/apps-wave-<N>.yamlare generated — runpython3 catalog/render.py --emit-wavesafter onboarding a service; do not hand-edit them.- Wave assignment = longest dependency-path depth over the catalog
dependencies:graph; a co-located CNPG database<svc>-dbis a leaf and always lands strictly below its consumer.
See ../DESIGN-waves.md for the wave table, Flux topology, and the
cutover runbook.