You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
fix(ontoserver): remove allowScaledReadWrite, scaled read-write is unsupported
The chart exposed ontoserver.deployment.allowScaledReadWrite as an opt-out from
the scaled read-only guard, with two shipped scaled-rw-envoy-experimental.yaml
examples using it. That advertised a topology that does not exist.
Ontoserver forces read-only on any scaled deployment. ProviderBase.checkReadOnly
throws on `readonly || (scaled && scaledReadonly)`, and scaledReadonly defaults
to true, so setting ontoserver.deployment.scaled rejects writes whatever else is
configured. The upstream field comment states it exists only "to allow internal
experimentation with scaled read-write deployment" — it is not a public knob, and
the chart should not have surfaced one built on it.
Removes the value, its schema entry, both experimental examples, and every
public mention. The render-time guard no longer offers an escape hatch, and the
README now leads the deployment-modes section with the constraint rather than
burying it in a footnote. The scaledReadOnly env var collapses to a constant,
since the read-write branch is now unreachable.
Deliberately a fix rather than a breaking change: the option was inert, so
nothing that worked is being taken away. A values file still carrying
allowScaledReadWrite: true alongside type: scaled and isReadOnly: false now
fails to render instead of deploying a server that rejects every write. Migrate
by loading content with a single-instance read-write deployment and serving it
scaled and read-only.
-`scaled` requires `replicas` ≥ 2 (or 0 to scale to zero). `single` requires `replicas` < 2.
82
94
-`scaled` deployments cannot use the Postgres sidecar — an external database is required.
83
-
-`isReadOnly: true` is **required** for all scaled deployments — the chart refuses to render otherwise. Each replica maintains its own Lucene index on its own PVC, so content written through the round-robin Service is indexed only on the replica that served the write; requests that land on any other replica then fail. Integration tests confirm this on a scaled install: `ValueSet/$expand` and `CodeSystem/$validate-code` return HTTP 500 while the resources are present in the shared database and `$lookup` and `$translate` succeed. To ingest content, use a single-instance read-write deployment, then serve it scaled and read-only.
95
+
-`isReadOnly: true` is **required** for all scaled deployments — the chart refuses to render otherwise, and there is no opt-out. Ontoserver itself forces read-only whenever the deployment is scaled, so a scaled read-write server does not exist to configure. Each replica also maintains its own Lucene index on its own PVC, so content written through the round-robin Service is indexed only on the replica that served the write; requests that land on any other replica then fail. Integration tests confirm this on a scaled install: `ValueSet/$expand` and `CodeSystem/$validate-code` return HTTP 500 while the resources are present in the shared database and `$lookup` and `$translate` succeed. To ingest content, use a single-instance read-write deployment, then serve it scaled and read-only.
84
96
-`$closure` remains available in scaled read-only mode. It is a stateful operation, so it must always be routed to one specific pod — the chart provisions `<release>-ontoserver-pod0-service` for that and the `$closure` integration test verifies the routing.
85
-
- Scaled read-write can be opted into with `allowScaledReadWrite: true`, as the `scaled-rw-envoy-experimental.yaml` examples do. It is untested, known-broken per the above, and **must not be used in production**.
86
97
-`clusterName` sets `ontoserver.cluster.name` for auto-discovery, allowing independent scaled clusters on the same network. Defaults to `ontoserver` (the application default) when unset.
87
98
-`StatefulSet` kind always provisions PVCs via `volumeClaimTemplates`. `Deployment` kind requires `persistence.enabledForDeployment: true` to use PVCs.
88
99
- The `PodDisruptionBudget` is rendered **only for `scaled`** deployments. A single instance owns its Lucene index on a ReadWriteOnce PVC and must be replaced rather than kept available during a disruption, so a PDB there would block node drains without protecting anything. Set exactly one of `minAvailable` or `maxUnavailable` — both accept a whole number or a percentage string (`"25%"`), and the chart fails if both or neither are set. `minAvailable: 1` is the default, so clear it (`minAvailable: null`) when you want `maxUnavailable`.
@@ -129,6 +140,7 @@ ontoserver:
129
140
130
141
| `kind` | `type` | Database | Storage | Reason |
131
142
|---|---|---|---|---|
143
+
| *any* | `scaled` | *any* | *any* | **Read-write is not supported when scaled.** Hard rejected by the chart, and Ontoserver forces read-only on a scaled deployment regardless. There is no opt-in flag |
132
144
| `Deployment` | `scaled` | Sidecar | — | Hard rejected by the chart — scaled deployments require an external database |
133
145
| `Deployment` | `scaled` | External | `ReadWriteOnce` | All pods share one PVC; only one pod can mount it |
134
146
| `Deployment` | `scaled` | External | `ReadWriteMany` | All pods share the same directory; Lucene `write.lock` conflicts corrupt indexes |
@@ -1177,8 +1189,7 @@ Requires the [External Secrets Operator](https://external-secrets.io/) installed
1177
1189
| `ontoserver.deployment.containerPort` | Container port Ontoserver listens on. Use 8080 for HTTP (ONTOSERVER_INSECURE=true) or 8443 for HTTPS (ONTOSERVER_INSECURE=false). | `8080` |
1178
1190
| `ontoserver.deployment.lifecycle` | Container lifecycle hooks (postStart / preStop). Passed through as-is to the container spec. | `{}` |
1179
1191
| `ontoserver.deployment.imagePullSecrets` | Additional pre-created image pull secrets to attach to the pod (merged with the chart-managed pull secret when imageCredentials are set) | `[]` |
1180
-
| `ontoserver.deployment.isReadOnly` | Ontoserver in read‑only mode. Required to be true when type is scaled; see allowScaledReadWrite. | `true` |
1181
-
| `ontoserver.deployment.allowScaledReadWrite` | Opt in to the unsupported scaled read-write topology. Each replica has its own Lucene index, so content written through the round-robin Service is only indexed on the replica that served the write and $expand / $validate-code fail on the others. Load content with a single-instance read-write deployment instead, then serve it scaled and read-only. | `false` |
1192
+
| `ontoserver.deployment.isReadOnly` | Ontoserver in read‑only mode. Must be true when type is scaled — Ontoserver forces read-only on a scaled deployment regardless of this setting. | `true` |
1182
1193
| `ontoserver.deployment.replicas` | Number of replicas - min 2 for scaled deployment - can be set to 0 | `1` |
1183
1194
| `ontoserver.deployment.podManagementPolicy` | StatefulSet pod management policy (Parallel or OrderedReady); ignored when kind is Deployment. Parallel starts and replaces pods without waiting for Ready, so a multi-replica rolling update can leave the Service with no ready endpoint; OrderedReady waits for each pod to become Ready first. Immutable on a live StatefulSet - see the README for the --cascade=orphan recreate. | `Parallel` |
1184
1195
| `ontoserver.deployment.clusterName` | Cluster name for auto-discovery in scaled deployments (overrides the default "ontoserver" set in application.properties); ignored for single deployments | `""` |
0 commit comments