Skip to content

fix(helm): remove stale Chart.lock that pulls in conflicting Bitnami postgresql sub-chart#1632

Open
jay-mtl wants to merge 1 commit into
vectorize-io:mainfrom
jay-mtl:fix/remove-stale-chart-lock
Open

fix(helm): remove stale Chart.lock that pulls in conflicting Bitnami postgresql sub-chart#1632
jay-mtl wants to merge 1 commit into
vectorize-io:mainfrom
jay-mtl:fix/remove-stale-chart-lock

Conversation

@jay-mtl
Copy link
Copy Markdown

@jay-mtl jay-mtl commented May 14, 2026

Problem

The helm/hindsight/ chart contains a Chart.lock that references bitnami/postgresql@15.5.38 as a dependency, but Chart.yaml has no dependencies section. The chart has its own postgresql-statefulset.yaml template and does not use the Bitnami sub-chart.

Helm and GitOps controllers (e.g. Flux helm-controller) run helm dependency build whenever Chart.lock is present. This downloads and packages the Bitnami postgresql sub-chart into charts/postgresql/, causing two StatefulSets named hindsight-postgresql to be rendered:

  1. templates/postgresql-statefulset.yaml — the chart's own template (ankane/pgvector, standard postgres security context)
  2. charts/postgresql/templates/primary/statefulset.yaml — Bitnami (bitnami/postgresql, readOnlyRootFilesystem: true, runAsUser: 1001, selector: app.kubernetes.io/name: postgresql)

This causes two failures:

  • Immutable selector conflict: both StatefulSets share the name hindsight-postgresql but have different spec.selector.matchLabels; the second apply is rejected by the Kubernetes API with spec: Forbidden: updates to statefulset spec for fields other than 'replicas'...
  • CrashLoopBackOff: the Bitnami security context (readOnlyRootFilesystem: true) gets applied to the ankane/pgvector container, which needs to write to /var/run/postgresql at startup, causing: FATAL: could not create lock file "/var/run/postgresql/.s.PGSQL.5432.lock": Read-only file system

Fix

Remove the stale Chart.lock. Since Chart.yaml lists no dependencies, the lock file is a leftover artifact and serves no purpose — it only causes the above conflicts for anyone using Helm dependency resolution (including Flux, ArgoCD with Helm, and plain helm install with dependency building enabled).

Testing

After removing Chart.lock, helm dependency build is a no-op and the chart installs cleanly with only the parent chart's own postgresql StatefulSet rendered.

…postgresql sub-chart

Chart.yaml has no dependencies section, but Chart.lock still references
bitnami/postgresql@15.5.38. Helm and GitOps controllers (e.g. Flux
helm-controller) run `helm dependency build` whenever Chart.lock is
present, which downloads and packages the Bitnami sub-chart.

This causes two StatefulSets named hindsight-postgresql to be rendered:
one from the chart's own postgresql-statefulset.yaml template and one from
charts/postgresql/templates/primary/statefulset.yaml (Bitnami). They have
conflicting spec.selector.matchLabels, so the second apply is rejected by
Kubernetes with an immutable field error. The Bitnami security context
(readOnlyRootFilesystem: true, runAsUser: 1001) also crashes the
ankane/pgvector container which needs to write to /var/run/postgresql.

Since Chart.yaml lists no dependencies, Chart.lock is stale and serves
no purpose. Removing it prevents the Bitnami sub-chart from being
downloaded.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant