Update FerretDB v2.4.0 #1206
Update FerretDB v2.4.0 #1206
Conversation
|
Warning Rate limit exceeded@kvaps has exceeded the limit for the number of commits or files that can be reviewed per hour. Please wait 17 minutes and 14 seconds before requesting another review. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. 📒 Files selected for processing (9)
""" WalkthroughThe FerretDB Helm chart and deployment were updated to version 1.0.0, with the application version bumped to 2.4.0. The Makefile gained an Changes
Sequence Diagram(s)sequenceDiagram
participant User
participant Makefile
participant GitHub
participant ContainerRegistry
participant HelmChart
User->>Makefile: run update
Makefile->>GitHub: fetch latest FerretDB tag
Makefile->>ContainerRegistry: fetch latest postgres-documentdb image tag
Makefile->>HelmChart: update image tags and appVersion in YAML/templates
Suggested labels
Suggested reviewers
Poem
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
There was a problem hiding this comment.
Summary of Changes
Hello @kvaps, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!
This pull request delivers comprehensive updates to both the FerretDB and SeaweedFS Helm charts. For FerretDB, it focuses on version upgrades and streamlining its PostgreSQL integration. The changes to SeaweedFS are more extensive, introducing new deployment models like MultiZone topology and an all-in-one option, adding an SFTP server, and significantly expanding configuration flexibility. These updates aim to improve deployment versatility, operational stability, and feature richness for both applications.
Highlights
- FerretDB Update & PostgreSQL Integration: The FerretDB application has been updated to version
2.4.0(chart version1.0.0). This update includes a revised PostgreSQL connection method that dynamically fetches the password from a secret, and enablespg_documentdbextensions for enhanced functionality. An automatedmake updatecommand has also been added to streamline future version bumps. - SeaweedFS Major Version Upgrade & MultiZone Support: SeaweedFS has been upgraded to application version
3.94(chart version4.0.394). A significant new feature is the introduction of MultiZone topology support, allowing for more resilient deployments across different Kubernetes zones with per-zone volume configurations and robust preflight validation checks. - New SeaweedFS Deployment Options (All-in-One & SFTP): Two new deployment options have been added for SeaweedFS: an 'all-in-one' mode that consolidates master, volume, and filer roles for simplified deployments, and a dedicated SFTP server component, expanding SeaweedFS's data access capabilities.
- Enhanced Helm Chart Configurability & Upgrade Mechanism: The Helm charts have been extensively refactored to expose numerous new configuration options for all SeaweedFS components (master, volume, filer, S3, SFTP), including topology spread constraints, metrics IPs, and Raft settings. A new pre-upgrade hook has been implemented to ensure smoother transitions between major versions by gracefully deleting old components.
- Improved Monitoring and Secret Management: The Grafana dashboard for SeaweedFS has been enhanced with new S3 bucket traffic metrics. Secret generation for S3 and SFTP has been improved to ensure persistence across upgrades using new Helm helpers, and the security configmap now preserves JWT signing keys.
Using Gemini Code Assist
The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.
Invoking Gemini
You can request assistance from Gemini at any point in your pull request via creating an issue comment (i.e. comment on the pull request page) using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands.
| Feature | Command | Description |
|---|---|---|
| Code Review | /gemini review |
Performs a code review for the current pull request in its current state. |
| Pull Request Summary | /gemini summary |
Provides a summary of the current pull request in its current state. |
| Comment | @gemini-code-assist | Responds in comments when explicitly tagged, both in issue comments and review comments. |
| Help | /gemini help |
Displays a list of available commands. |
Customization
To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.
Limitations & Feedback
Gemini Code Assist is currently in preview and may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments to provide feedback.
You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.
Footnotes
-
Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩
There was a problem hiding this comment.
Code Review
This pull request is a substantial update, upgrading FerretDB and SeaweedFS, and introducing significant new features like MultiZone topology for SeaweedFS. The changes are extensive and demonstrate a good understanding of Helm and Kubernetes patterns. The introduction of a pre-upgrade hook for migrating SeaweedFS is a thoughtful addition for managing breaking changes.
I have identified a few issues that need attention:
- A critical bug in a new Go template helper function that will cause the volume resize functionality to fail.
- A high severity security concern where FerretDB connects to its PostgreSQL backend with superuser privileges.
- A medium severity issue regarding Helm chart best practices for versioning.
There was a problem hiding this comment.
Actionable comments posted: 3
🔭 Outside diff range comments (1)
packages/apps/ferretdb/templates/ferretdb.yaml (1)
23-30: YAML-lint catches invalid indentation – deployment will not render
yamllintreports “wrong indentation: expected 8 but found 10”.
The list items underenv:must be indented exactly two spaces less (align with the key). Helm tolerates additional spaces in many cases, but some CI pipelines (and editors) refuse to parse this. Fixing it removes the lint error without altering semantics.- - name: POSTGRESQL_PASSWORD - valueFrom: - secretKeyRef: - name: {{ .Release.Name }}-postgres-superuser - key: password - - name: FERRETDB_POSTGRESQL_URL - value: "postgresql://postgres:$(POSTGRESQL_PASSWORD)@{{ .Release.Name }}-postgres-rw:5432/postgres" + - name: POSTGRESQL_PASSWORD + valueFrom: + secretKeyRef: + name: {{ .Release.Name }}-postgres-superuser + key: password + - name: FERRETDB_POSTGRESQL_URL + value: "postgresql://postgres:$(POSTGRESQL_PASSWORD)@{{ .Release.Name }}-postgres-rw:5432/postgres"Side note: variable substitution with
$(POSTGRESQL_PASSWORD)works only becausePOSTGRESQL_PASSWORDis declared first; keep this order if more env-vars are added.
🧹 Nitpick comments (1)
packages/apps/ferretdb/templates/ferretdb.yaml (1)
19-19: Pin the image tag to a digest for reproducible & secure releasesThe move to
ghcr.io/ferretdb/ferretdb:2.4.0is fine, but relying solely on a mutable tag means the exact image can change without notice. Pinning the SHA-256 digest guarantees that every deployment uses the identical bits and protects against supply-chain surprises.- image: ghcr.io/ferretdb/ferretdb:2.4.0 + # pin to digest to ensure immutability / reproducibility + image: ghcr.io/ferretdb/ferretdb@sha256:<insert-real-digest-here>
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (8)
packages/apps/ferretdb/Chart.yaml(1 hunks)packages/apps/ferretdb/Makefile(1 hunks)packages/apps/ferretdb/templates/ferretdb.yaml(1 hunks)packages/apps/ferretdb/templates/init-job.yaml(0 hunks)packages/apps/ferretdb/templates/init-script.yaml(0 hunks)packages/apps/ferretdb/templates/postgres.yaml(2 hunks)packages/apps/ferretdb/values.yaml(1 hunks)packages/apps/versions_map(1 hunks)
💤 Files with no reviewable changes (2)
- packages/apps/ferretdb/templates/init-job.yaml
- packages/apps/ferretdb/templates/init-script.yaml
🧰 Additional context used
🧠 Learnings (1)
packages/apps/ferretdb/Makefile (1)
Learnt from: NickVolynkin
PR: cozystack/cozystack#1196
File: packages/apps/http-cache/Makefile:24-27
Timestamp: 2025-07-14T16:23:12.758Z
Learning: In the cozystack repository, the `readme-generator` tool removes enum contents from values.schema.json files during its operation. Therefore, when using readme-generator in Makefiles, any enum values need to be injected back into the schema using yq commands after readme-generator has run, not before.
🪛 YAMLlint (1.37.1)
packages/apps/ferretdb/templates/ferretdb.yaml
[warning] 23-23: wrong indentation: expected 8 but found 10
(indentation)
[error] 26-26: syntax error: expected , but found ''
(syntax)
🔇 Additional comments (3)
packages/apps/ferretdb/values.yaml (1)
58-60: Default preset bumped to “micro” – double-check cluster sizing & docsMoving the default from
nanotomicroroughly quadruples the CPU/memory requests (per the preset map).
Please make sure:
- CI/test clusters still have head-room.
- README / values.schema.json examples mention the new default, otherwise users will be surprised.
No code change required if that is intentional.
packages/apps/ferretdb/Chart.yaml (1)
19-25: Version bump looks goodChart version and
appVersionare aligned with the upstream release.packages/apps/ferretdb/templates/postgres.yaml (1)
8-10: UID/GID hard-coded to 999 – verify host filesystem compatibilitySome distros already use UID 999 (e.g.
systemd-network). If the underlying
nodes run with that user, volume ownership may collide. Consider leaving the
defaults or making these values configurable.
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
packages/apps/ferretdb/templates/ferretdb.yaml (1)
23-29: Consider keeping the entire connection string in a secretPlacing the raw password into an env var and then re-embedding it in another env var duplicates sensitive data and exposes it via
kubectl describe pod&psoutput inside the container. A more secure pattern is:
- Store the full
postgresql://…URI in the secret (as before).- Mount it via
valueFrom.secretKeyRefdirectly toFERRETDB_POSTGRESQL_URL.This removes the extra
POSTGRESQL_PASSWORDvariable entirely.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (8)
packages/apps/ferretdb/Chart.yaml(1 hunks)packages/apps/ferretdb/Makefile(1 hunks)packages/apps/ferretdb/templates/ferretdb.yaml(1 hunks)packages/apps/ferretdb/templates/init-job.yaml(0 hunks)packages/apps/ferretdb/templates/init-script.yaml(0 hunks)packages/apps/ferretdb/templates/postgres.yaml(2 hunks)packages/apps/ferretdb/values.yaml(1 hunks)packages/apps/versions_map(1 hunks)
💤 Files with no reviewable changes (2)
- packages/apps/ferretdb/templates/init-job.yaml
- packages/apps/ferretdb/templates/init-script.yaml
🚧 Files skipped from review as they are similar to previous changes (5)
- packages/apps/ferretdb/templates/postgres.yaml
- packages/apps/ferretdb/values.yaml
- packages/apps/ferretdb/Chart.yaml
- packages/apps/ferretdb/Makefile
- packages/apps/versions_map
🧰 Additional context used
🧠 Learnings (1)
📓 Common learnings
Learnt from: kvaps
PR: cozystack/cozystack#1206
File: packages/apps/versions_map:30-31
Timestamp: 2025-07-16T13:17:07.532Z
Learning: In packages/apps/versions_map, using HEAD for certain versions (like ferretdb 1.0.0) is intentional and part of the core logic, not an oversight that needs to be fixed for reproducibility.
🪛 YAMLlint (1.37.1)
packages/apps/ferretdb/templates/ferretdb.yaml
[warning] 23-23: wrong indentation: expected 8 but found 10
(indentation)
[error] 26-26: syntax error: expected , but found ''
(syntax)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
- GitHub Check: Build
🔇 Additional comments (1)
packages/apps/ferretdb/templates/ferretdb.yaml (1)
19-19: Image tag bump looks goodThe container image is correctly updated to
2.4.0, matching the chart’sappVersion.
There was a problem hiding this comment.
Actionable comments posted: 3
♻️ Duplicate comments (1)
packages/apps/ferretdb/templates/postgres.yaml (1)
64-78: Extension name mismatch still present
(see prior review)
shared_preload_librarieslistspg_documentdb, but theCREATE EXTENSION
command uses plaindocumentdb. Unless the image exposes that alias the
statement will fail.Same recommendation as before:
CREATE EXTENSION IF NOT EXISTS pg_documentdb …
🧹 Nitpick comments (1)
packages/apps/ferretdb/templates/backup.yaml (1)
1-2: Template passes YAML-lint but not Helm – leading hyphen after{{- if … }}Helm will render:
<empty> --- apiVersion: …The leading blank line (
<empty>) is produced because theifdirective
doesn’t trim the trailing newline. This confuses some YAML linters / GitOps
systems.Quick tidy-up:
-{{- if .Values.backup.enabled }} --- +{{- if .Values.backup.enabled -}} +---
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (7)
packages/apps/ferretdb/images/postgres-backup.tag(0 hunks)packages/apps/ferretdb/templates/backup-cronjob.yaml(0 hunks)packages/apps/ferretdb/templates/backup-script.yaml(0 hunks)packages/apps/ferretdb/templates/backup-secret.yaml(0 hunks)packages/apps/ferretdb/templates/backup.yaml(1 hunks)packages/apps/ferretdb/templates/postgres.yaml(2 hunks)packages/apps/ferretdb/values.yaml(1 hunks)
💤 Files with no reviewable changes (4)
- packages/apps/ferretdb/images/postgres-backup.tag
- packages/apps/ferretdb/templates/backup-cronjob.yaml
- packages/apps/ferretdb/templates/backup-script.yaml
- packages/apps/ferretdb/templates/backup-secret.yaml
🧰 Additional context used
🧠 Learnings (1)
📓 Common learnings
Learnt from: kvaps
PR: cozystack/cozystack#1206
File: packages/apps/versions_map:30-31
Timestamp: 2025-07-16T13:17:07.532Z
Learning: In packages/apps/versions_map, using HEAD for certain versions (like ferretdb 1.0.0) is intentional and part of the core logic, not an oversight that needs to be fixed for reproducibility.
🪛 YAMLlint (1.37.1)
packages/apps/ferretdb/templates/backup.yaml
[error] 1-1: syntax error: expected the node content, but found '-'
(syntax)
🪛 Gitleaks (8.27.2)
packages/apps/ferretdb/values.yaml
47-47: Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
(generic-api-key)
48-48: Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
(generic-api-key)
🔇 Additional comments (2)
packages/apps/ferretdb/values.yaml (1)
69-70: Preset switch looks saneChanging the default preset from
nanotomicrois non-breaking (larger
requests/limits only). No objections.packages/apps/ferretdb/templates/backup.yaml (1)
8-9: Propagate the fixed 5-field cron expressionOnce
values.yamlis corrected, ensure the template still quotes the value to
keep the leading zero, e.g."0 2 * * *".
There was a problem hiding this comment.
Actionable comments posted: 0
🔭 Outside diff range comments (1)
packages/apps/ferretdb/values.schema.json (1)
105-118: Description mentions presetnone, but it’s missing fromenum– validation will failIf a user sets
resourcesPreset: none, Helm-schema validation errors out."enum": [ + "none", "nano", "micro", "small", "medium", "large", "xlarge", "2xlarge" ]
🧹 Nitpick comments (2)
packages/apps/ferretdb/README.md (1)
40-47:resources/resourcesPresetrows duplicated under Bootstrap — likely a doc slipThese parameters are global but appear inside the “Bootstrap parameters” table, which might confuse users into thinking they are bootstrap-only.
Move them back to the “Common/Configuration” sections or drop the duplicate rows.packages/apps/ferretdb/values.schema.json (1)
68-77: Mark secret fields withformat: passwordto prevent accidental loggingFor
s3AccessKeyands3SecretKey, adding the JSON-Schema hint keeps some UIs (e.g., ArgoCD, Lens) from echoing secrets:- "type": "string", + "type": "string", + "format": "password",
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (9)
packages/apps/ferretdb/README.md(1 hunks)packages/apps/ferretdb/images/postgres-backup.tag(0 hunks)packages/apps/ferretdb/templates/backup-cronjob.yaml(0 hunks)packages/apps/ferretdb/templates/backup-script.yaml(0 hunks)packages/apps/ferretdb/templates/backup-secret.yaml(0 hunks)packages/apps/ferretdb/templates/backup.yaml(1 hunks)packages/apps/ferretdb/templates/postgres.yaml(2 hunks)packages/apps/ferretdb/values.schema.json(2 hunks)packages/apps/ferretdb/values.yaml(1 hunks)
💤 Files with no reviewable changes (4)
- packages/apps/ferretdb/images/postgres-backup.tag
- packages/apps/ferretdb/templates/backup-secret.yaml
- packages/apps/ferretdb/templates/backup-cronjob.yaml
- packages/apps/ferretdb/templates/backup-script.yaml
🚧 Files skipped from review as they are similar to previous changes (2)
- packages/apps/ferretdb/values.yaml
- packages/apps/ferretdb/templates/postgres.yaml
🧰 Additional context used
🪛 YAMLlint (1.37.1)
packages/apps/ferretdb/templates/backup.yaml
[error] 1-1: syntax error: expected the node content, but found '-'
(syntax)
🔇 Additional comments (2)
packages/apps/ferretdb/templates/backup.yaml (1)
8-11: Verify 6-field cron expression is actually supported by CloudNativePG
spec.scheduleuses the expression0 2 * * * *(seconds + classic 5-field cron).
CloudNativePG examples/documentation show the standard 5-field format.
If the controller treats a 6-field pattern as invalid, theScheduledBackupwill never be reconciled.- schedule: {{ .Values.backup.schedule | quote }} + # CloudNativePG currently expects a 5-field cron expression. + schedule: {{ .Values.backup.schedule | quote }}Double-check controller docs / run
kubectl describe scheduledbackup …after installation.packages/apps/ferretdb/README.md (1)
28-37: Avoid exposing cloud credentials via plain-text values
s3AccessKey/s3SecretKeyare documented here as regular chart values.
Publishing or committing these fields invalues.yamlleaks long-lived IAM keys.Recommend:
- Remove default dummy credentials from the table.
- Accept them only through a referenced
Secret, e.g.:backup: s3CredentialsSecret: name: ferretdb-backup-creds keyAccess: access-key keySecret: secret-keyThis keeps credentials out of Git and aligns with Kubernetes best-practice.
⛔ Skipped due to learnings
Learnt from: NickVolynkin PR: cozystack/cozystack#1120 File: packages/apps/ferretdb/README.md:35-37 Timestamp: 2025-07-02T09:58:11.406Z Learning: In the cozystack repository, the maintainer NickVolynkin prefers to keep realistic-looking example credentials in README documentation rather than using generic placeholders like <ACCESS_KEY>, even though they are just examples and not real secrets.
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
What this PR does
This PR updates FerretDB from v1 to v2
Breaking change: before upgrading your ferretdb, please backup and restore your data, using this guide:
Release note
Summary by CodeRabbit
New Features
ScheduledBackupresource.Improvements
Removals
Chores