[Maintenance] Stability Improvements (#1880)

Author: ajanikow

CHANGELOG.md

@@ -17,6 +17,7 @@
 - (Maintenance) Update Envoy to v1.32.5
 - (Maintenance) Generate CRD with Schemas
 - (Feature) DebugPackage Improvements
+- (Feature) Improve Bootstrap time
 
 ## [1.2.47](https://github.com/arangodb/kube-arangodb/tree/1.2.47) (2025-03-28)
 - (Bugfix) Use Profile Annotations

chart/kube-arangodb-arm64/templates/debug/role.yaml

@@ -14,9 +14,13 @@ metadata:
         release: {{ .Release.Name }}
 rules:
   - apiGroups:
+# Core
     - ""
     - "apps"
     - "batch"
+# Arango
+    - "analytics.arangodb.com"
+    - "ml.arangodb.com"
     resources: ["*"]
     verbs: ["get", "list"]
   - apiGroups: [""]

chart/kube-arangodb-enterprise-arm64/templates/debug/role.yaml

@@ -14,9 +14,13 @@ metadata:
         release: {{ .Release.Name }}
 rules:
   - apiGroups:
+# Core
     - ""
     - "apps"
     - "batch"
+# Arango
+    - "analytics.arangodb.com"
+    - "ml.arangodb.com"
     resources: ["*"]
     verbs: ["get", "list"]
   - apiGroups: [""]

chart/kube-arangodb-enterprise/templates/debug/role.yaml

@@ -14,9 +14,13 @@ metadata:
         release: {{ .Release.Name }}
 rules:
   - apiGroups:
+# Core
     - ""
     - "apps"
     - "batch"
+# Arango
+    - "analytics.arangodb.com"
+    - "ml.arangodb.com"
     resources: ["*"]
     verbs: ["get", "list"]
   - apiGroups: [""]

chart/kube-arangodb/templates/debug/role.yaml

@@ -14,9 +14,13 @@ metadata:
         release: {{ .Release.Name }}
 rules:
   - apiGroups:
+# Core
     - ""
     - "apps"
     - "batch"
+# Arango
+    - "analytics.arangodb.com"
+    - "ml.arangodb.com"
     resources: ["*"]
     verbs: ["get", "list"]
   - apiGroups: [""]

pkg/apis/scheduler/v1beta1/pod/resources/scheduling.go

@@ -64,7 +64,9 @@ func (s *Scheduling) Apply(template *core.PodTemplateSpec) error {
 	} else {
 		template.Spec.NodeSelector = map[string]string{}
 		for k, v := range s.NodeSelector {
-			template.Spec.NodeSelector[k] = v
+			if v != "-" {
+				template.Spec.NodeSelector[k] = v
+			}
 		}
 	}
 

pkg/crd/apply.go

@@ -68,7 +68,11 @@ func EnsureCRDWithOptions(ctx context.Context, client kclient.Client, opts Ensur
 
 		getAccess := verifyCRDAccess(ctx, client, crdName, access.Get)
 		if !getAccess.Allowed {
-			logger.Str("crd", crdName).Info("Get Operations is not allowed. Continue")
+			logger.
+				Str("crd", crdName).
+				Str("reason", getAccess.Reason).
+				Str("evaluationError", getAccess.EvaluationError).
+				Info("Get Operations is not allowed. Continue")
 			continue
 		}
 
@@ -195,14 +199,20 @@ func tryApplyCRD(ctx context.Context, client kclient.Client, def crds.Definition
 	c, err := crdDefinitions.Get(ctx, crdName, meta.GetOptions{})
 	if err != nil {
 		if !errors.IsNotFound(err) {
-			logger.Err(err).Str("crd", crdName).Warn("Get Operations is not allowed due to error")
+			logger.Err(err).
+				Str("crd", crdName).
+				Warn("Get Operations is not allowed due to error")
 			return err
 		}
 
 		createAccess := verifyCRDAccess(ctx, client, crdName, access.Create)
 
 		if !createAccess.Allowed {
-			logger.Str("crd", crdName).Info("Create Operations is not allowed but CRD is missing. Continue")
+			logger.
+				Str("crd", crdName).
+				Str("reason", createAccess.Reason).
+				Str("evaluationError", createAccess.EvaluationError).
+				Info("Create Operations is not allowed but CRD is missing. Continue")
 			return nil
 		}
 
@@ -219,7 +229,10 @@ func tryApplyCRD(ctx context.Context, client kclient.Client, def crds.Definition
 
 	updateAccess := verifyCRDAccess(ctx, client, crdName, access.Update)
 	if !updateAccess.Allowed {
-		logger.Str("crd", crdName).Info("Update Operations is not allowed. Continue")
+		logger.Str("crd", crdName).
+			Str("reason", updateAccess.Reason).
+			Str("evaluationError", updateAccess.EvaluationError).
+			Info("Update Operations is not allowed. Continue")
 		return nil
 	}
 

pkg/deployment/reconcile/plan_builder_bootstrap.go

@@ -1,7 +1,7 @@
 //
 // DISCLAIMER
 //
-// Copyright 2016-2022 ArangoDB GmbH, Cologne, Germany
+// Copyright 2016-2025 ArangoDB GmbH, Cologne, Germany
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -39,6 +39,8 @@ func (r *Reconciler) createBootstrapPlan(ctx context.Context, apiObject k8sutil.
 		return nil
 	}
 
+	var plan api.Plan
+
 	for user, secret := range spec.Bootstrap.PasswordSecretNames {
 		if secret.IsNone() {
 			continue
@@ -52,8 +54,11 @@ func (r *Reconciler) createBootstrapPlan(ctx context.Context, apiObject k8sutil.
 			}
 		}
 
-		return api.Plan{actions.NewClusterAction(api.ActionTypeBootstrapSetPassword, "Updating password").AddParam("user", user)}
+		plan = append(plan, actions.NewClusterAction(api.ActionTypeBootstrapSetPassword, "Updating password").AddParam("user", user))
 	}
 
-	return api.Plan{actions.NewClusterAction(api.ActionTypeBootstrapUpdate, "Finalizing bootstrap")}
+	plan = append(plan, r.updateClusterLicense(ctx, apiObject, spec, status, context)...)
+	plan = append(plan, actions.NewClusterAction(api.ActionTypeBootstrapUpdate, "Finalizing bootstrap"))
+
+	return plan
 }

pkg/deployment/reconcile/plan_builder_high.go

@@ -262,7 +262,7 @@ func (r *Reconciler) updateMemberRotationConditions(apiObject k8sutil.APIObject,
 			}
 			// We need to do graceful rotation
 			if member.Conditions.IsTrue(api.ConditionTypePendingRestart) {
-				return nil, nil
+				return restartMemberConditionAction(group, member.ID, reason), nil
 			}
 
 			switch a := spec.MemberPropagationMode.Get(); a {

pkg/util/k8sutil/access/access.go

@@ -144,8 +144,9 @@ func VerifyAccessRequest(ctx context.Context, client kclient.Client, in authoriz
 
 	if err != nil {
 		return authorization.SubjectAccessReviewStatus{
-			Allowed: false,
-			Reason:  fmt.Sprintf("Unable to check access: %s", err.Error()),
+			Allowed:         false,
+			Reason:          fmt.Sprintf("Unable to check access: %s", err.Error()),
+			EvaluationError: err.Error(),
 		}
 	}