From b190b7e8331844dbe2b2aeda890d05f577fa1f91 Mon Sep 17 00:00:00 2001 From: jklein Date: Sun, 23 Aug 2026 19:03:07 +0200 Subject: [PATCH] samba: restart the pod when smb.conf changes smb.conf is rendered from samba.shares and mounted with subPath, so adding, renaming or re-scoping a share rewrote the ConfigMap while the running smbd kept its old share list: the pod template was unchanged, nothing restarted, and the kubelet does not refresh subPath mounts. The share simply did not exist for clients while the release looked healthy - the failure mode from #82. The pod template now carries checksum/config over the rendered ConfigMap. users.conf cannot be covered the same way: it comes from a 1Password-backed Secret whose content Helm never sees, and the operator's auto-restart only handles Deployments, not this StatefulSet. values.yaml now documents that limitation and the manual rollout restart it requires. Major bump: runtime behavior changes - a share change now costs a restart of the samba pod, which drops open SMB sessions (share data lives on PVCs and is unaffected). --- samba/Chart.yaml | 2 +- samba/templates/samba.sfs.yaml | 10 ++++++++++ samba/values.yaml | 13 +++++++++++++ 3 files changed, 24 insertions(+), 1 deletion(-) diff --git a/samba/Chart.yaml b/samba/Chart.yaml index ccd8d23..309cf92 100644 --- a/samba/Chart.yaml +++ b/samba/Chart.yaml @@ -5,6 +5,6 @@ icon: https://avatars.githubusercontent.com/u/13281359 type: application -version: 4.0.0+up4.23.10 +version: 5.0.0+up4.23.10 appVersion: 4.23.10 diff --git a/samba/templates/samba.sfs.yaml b/samba/templates/samba.sfs.yaml index 54cf6bd..1efc3c4 100644 --- a/samba/templates/samba.sfs.yaml +++ b/samba/templates/samba.sfs.yaml @@ -15,6 +15,16 @@ spec: name: {{ .Release.Name }}-{{ .Chart.Name }}-sfs labels: app: {{ .Release.Name }}-{{ .Chart.Name }}-sfs + annotations: + # Hash of the rendered ConfigMap: a changed smb.conf (i.e. a changed + # samba.shares list) changes the pod template and thus restarts the + # pod. Without it a new or renamed share never reaches the running + # smbd - smb.conf is mounted with subPath (never refreshed by the + # kubelet) and is read once at start. + # users.conf is NOT covered: it comes from a 1Password-backed Secret + # whose content Helm never sees. See secrets.sambaUsersSecretRef in + # values.yaml. + checksum/config: {{ include (print $.Template.BasePath "/samba-config.configmap.yaml") . | sha256sum }} spec: containers: - name: {{ .Release.Name }}-{{ .Chart.Name }}-sfs diff --git a/samba/values.yaml b/samba/values.yaml index 9476742..5ef358f 100644 --- a/samba/values.yaml +++ b/samba/values.yaml @@ -5,6 +5,19 @@ scaleDown: false secrets: + # users.conf is mounted into the samba container from the Secret the 1Password + # operator materializes from this item. + # + # Known limitation (#82): changing the item in the vault does NOT restart + # samba, so added, removed or re-passworded users stay invisible to the + # running smbd. Helm cannot hash the content (it never sees it - the operator + # fills the Secret in-cluster after rendering), so the checksum/config + # mechanism used for smb.conf does not apply here. The operator's own + # "operator.1password.io/auto-restart" annotation is no help either: it only + # ever restarts Deployments, and this workload is a StatefulSet (verified + # against onepassword-operator 1.12.0). After changing the users item, + # restart samba by hand: + # kubectl rollout restart statefulset -samba-sfs sambaUsersSecretRef: null samba: