fix(hosting): sync webapp to a custom ClickHouse secret and add a startup probe

The webapp now resolves CLICKHOUSE_PASSWORD through the same
auth.existingSecret/existingSecretKey values the bundled server uses,
so pointing the chart at a custom credentials secret keeps both sides
on the same password. A startup probe gives ClickHouse up to ten
minutes to load metadata on first boot with a large adopted data
volume before liveness checks begin.

Author: matt-aitken

hosting/k8s/helm/templates/clickhouse.yaml

@@ -131,6 +131,17 @@ spec:
             failureThreshold: {{ .Values.clickhouse.readinessProbe.failureThreshold }}
             successThreshold: {{ .Values.clickhouse.readinessProbe.successThreshold }}
           {{- end }}
+          {{- if .Values.clickhouse.startupProbe.enabled }}
+          startupProbe:
+            httpGet:
+              path: /ping
+              port: http
+            initialDelaySeconds: {{ .Values.clickhouse.startupProbe.initialDelaySeconds }}
+            periodSeconds: {{ .Values.clickhouse.startupProbe.periodSeconds }}
+            timeoutSeconds: {{ .Values.clickhouse.startupProbe.timeoutSeconds }}
+            failureThreshold: {{ .Values.clickhouse.startupProbe.failureThreshold }}
+            successThreshold: {{ .Values.clickhouse.startupProbe.successThreshold }}
+          {{- end }}
           resources:
             {{- toYaml .Values.clickhouse.resources | nindent 12 }}
           volumeMounts:

hosting/k8s/helm/templates/webapp.yaml

@@ -419,11 +419,13 @@ spec:
                   name: {{ include "trigger-v4.clickhouse.external.secretName" . }}
                   key: {{ include "trigger-v4.clickhouse.external.passwordKey" . }}
             {{- else if .Values.clickhouse.deploy }}
+            {{- /* Same secret reference the bundled ClickHouse server uses, so a
+                   custom auth.existingSecret keeps the app and server in sync. */}}
             - name: CLICKHOUSE_PASSWORD
               valueFrom:
                 secretKeyRef:
-                  name: {{ include "trigger-v4.datastore.secretName" . }}
-                  key: clickhouse-admin-password
+                  name: {{ .Values.clickhouse.auth.existingSecret | default (include "trigger-v4.datastore.secretName" .) }}
+                  key: {{ .Values.clickhouse.auth.existingSecretKey | default "clickhouse-admin-password" }}
             {{- end }}
             - name: CLICKHOUSE_URL
               value: {{ include "trigger-v4.clickhouse.url" . | quote }}

hosting/k8s/helm/values.yaml

@@ -730,6 +730,15 @@ clickhouse:
     timeoutSeconds: 5
     failureThreshold: 5
     successThreshold: 1
+  # Generous startup window: first boot on a large adopted data volume can
+  # spend a while loading metadata before the HTTP listener answers.
+  startupProbe:
+    enabled: true
+    initialDelaySeconds: 5
+    periodSeconds: 10
+    timeoutSeconds: 5
+    failureThreshold: 60
+    successThreshold: 1
 
   # External ClickHouse connection (when deploy: false)
   external: