Draft: Integrated: Clean up resources that are duplicates

General MR

[0.9.3-bb.1] - 2026-07-21

Added

• Added docs/UPGRADE-0.9.3-bb.1.md: full PV migration procedure (Path A data-loss and Path B PV rebinding) for operators whose StatefulSet was not already named garage before this release; includes credentials Secret rename notice and Flux suspend/resume instructions for both the forward upgrade and rollback paths

Changed

• Removed templates/bigbang/metrics-svc.yaml and templates/bigbang/servicemonitor.yaml; upstream Service and ServiceMonitor are now used directly via BB umbrella post-render patches, eliminating the wrapper-owned duplicates
• Removed monitoring.serviceMonitor values block and all stale comments referencing the deleted wrapper metrics resources from chart/values.yaml
• Removed monitoring.serviceMonitor schema block from values.schema.json
• Moved domain to top of chart/values.yaml to match BB package convention
• Added upstream.fullnameOverride: garage to chart/values.yaml; fixes StatefulSet, Service, and Secret names resolving to garage-garage instead of garage when the Helm release name contains the chart name
• Updated tests/test-values.yaml: renamed packages: to addons:, moved garageInit credentials, buckets, and adminToken to first-class addon keys, removed stale monitoring.serviceMonitor tlsConfig override and upstream.environment GARAGE_ADMIN_TOKEN injection, removed explicit minio.enabled: false and minioOperator.enabled: false disables
• Updated tests/scripts/test-garage.sh: replaced hardcoded garage service name and BBTEST_RELEASE_NAME with GARAGE_SVC_NAME env var so pod selectors, service lookups, and credentials Secret references resolve correctly when the release name differs from the chart fullname; added GARAGE_REGION env var (sourced from garageInit.region, default garage) to replace hardcoded us-east-1 in all SigV4 signing strings
• Added alloy-alloy-metrics@alloy/alloy-metrics to port 3903 NetworkPolicy ingress in chart/values.yaml alongside the existing Prometheus entry, so Alloy metrics scraping is gated on alloy.alloyMetrics.enabled
• Added GARAGE_REGION to bbtests.scripts.envs in chart/values.yaml, sourced from garageInit.region, so CRUD tests sign S3 requests with the configured Garage region instead of a hardcoded value
• Rewrote docs/credential-rotation.md: corrected HTTP method for DeleteKey (POST, not DELETE); replaced the single-step helm-upgrade rotation model with a nine-step blue/green procedure (import new key, grant permissions, switch consumers, delete old key); added explicit consumer restart commands and S3 health verification step before old-key deletion; added rollback procedures for before and after step 9 with consumer restart commands; added tombstone warning (deleted key IDs cannot be reimported); updated admin token rotation to reflect the simplified automatic rollout model
• Updated docs/DEVELOPMENT_MAINTENANCE.md: renamed packages: to addons: in all command examples; removed stale "Monitoring and troubleshooting", "Secure Deployment Profile", "Cluster-scoped RBAC", "Capacity planning", and "Known package limits" sections that referenced deleted wrapper resources or described superseded patterns
• Updated docs/dev-overrides.yaml: renamed packages: to addons:, moved garageInit to first-class addon keys, added bb-common.istio.authorizationPolicies.generateFromNetpol: true, removed stale upstream.environment GARAGE_ADMIN_TOKEN injection and monitoring.serviceMonitor tlsConfig override
• Restructured renovate.json: replaced branchPrefix/branchTopic with branchName: "renovate/ironbank"; updated labels to ["garage", "Package Sustainment", "kind::maintenance"]; added postUpdateOptions: ["helmUpdateSubChartArchives"]; consolidated docker and helm packageRules with registryUrls; removed update-garage-vendored-chart from post-upgrade commands; split gitea-tags into its own packageRule with Garage-specific changelog command; pruned fileFilters to only files the bot actually modifies
• Updated docs/UPGRADE-0.9.3-bb.1.md: added note that enabling bb-common.istio.sidecar.enabled: true on upgrade requires a manual pod restart to inject the Istio sidecar into existing Garage pods; namespace label change alone does not recycle running pods

Fixed

• Fixed garage-init-job.yaml, garage-credentials.yaml, and garage-admin-svc.yaml: replaced all hardcoded {{ .Release.Name }}-prefixed names, selectors, and URLs with garage.fullname/garage.name subchart helpers so all resources resolve correctly when the Helm release name differs from the chart fullname
• Fixed rpc-ring-svc.yaml: replaced hardcoded garage-rpc name and garage label selector with garage.fullname/garage.name subchart helpers
• Fixed garageInit job: replaced the broken delete-then-reimport key sync with an idempotent import loop; treats 409 KeyAlreadyExists as success instead of failing; the prior DELETE /v2/DeleteKey used the wrong HTTP method and Garage permanently tombstones deleted key IDs preventing reimport
• Fixed garageInit job: truncated GARAGE_ACCESS_KEY_ID in log output to ${GARAGE_ACCESS_KEY_ID:0:10}... to avoid exposing the full key ID in pod logs
• Fixed docs/credential-rotation.md: replaced kubectl rollout restart/status statefulset --all (invalid flag) with kubectl get statefulset -o name | xargs -I{} kubectl rollout restart/status
• Fixed chart/tests/scripts/test-garage.sh: changed missing --aws-sigv4 check from exit 1 to a graceful skip with warning so the overall test suite passes on runner images without SigV4 curl support

Relevant logs/screenshots

Umbrella Branch

staging-garage-epic

Linked Issue

Relates to #23 (closed)

Upgrade Notices

This release adds upstream.fullnameOverride: garage, which unconditionally sets the StatefulSet name to garage. Migration is required if your Helm release name in 0.9.3-bb.0 was anything other than garage - in that case the StatefulSet was named after the release, and the addition of fullnameOverride will attempt to rename it on upgrade. Before upgrading, verify your current StatefulSet name with kubectl get sts -n garage. If it is already named garage, upgrade normally. If it differs, manual PV migration is required before running helm upgrade. See docs/UPGRADE-0.9.3-bb.1.md for the full procedure.