The HelmRelease carries upgrade remediation with three retries and no strategy.
The Flux CRD says the strategy defaults to rollback, that remediation runs
between each attempt, and that the last failure is remediated too whenever
retries exceed zero. A failing upgrade would therefore roll Helm back to the old
version up to four times, against a database Django has already migrated
forward — the exact inconsistency the documentation warns about, triggered by
our own configuration. Disarming it comes before the version change, in its own
commit.
The two gates are merged deliberately: one file, one line, no signatures. The
substance is the verification, and a health endpoint is not part of it beyond
saying the process lives. The only check that counts is a real login through
Element, MAS and Authentik — the same confusion between liveness and usability
cost hours this morning.
Thore Cimbal
70823b4eb4