[barbican] add batched db-cleanup nanny container - #12754
Open
rajivmucheli wants to merge 3 commits into
Open
rajivmucheli wants to merge 3 commits into
rajivmucheli wants to merge 3 commits into
Conversation
Adds a db-cleanup sidecar to the barbican-nanny Deployment, backed by a new barbican-manage db clean loop script. All cleanup operations now use the --batch-size flag introduced in sapcc/barbican#52 to prevent InnoDB buffer pool exhaustion on large deployments. New values under barbican_nanny.db_cleanup: enabled - toggle the container (default: false) batch_size - rows per committed batch (default: 10000) min_num_days - threshold age for hard-deletes (default: 14) clean_unassociated_projects - pass --clean-unassociated-projects flag soft_delete_expired_secrets - pass --soft-delete-expired-secrets flag The nanny Deployment now renders when either db_secret_move or db_cleanup is enabled (previously gated on db_secret_move only).
rajivmucheli
requested review from
BerndKue,
JoJoPuppe and
dorneanu
as code owners
September 9, 2026 15:18
s10
requested changes
Sep 10, 2026
- --min-num-days is not a valid flag; upstream uses --min-days / -m (barbican/cmd/db_manage.py:111) - db cleanup should run on its own cadence, not the shared nanny interval; add barbican_nanny.db_cleanup.interval (default 60 min) and wire it through the deployment env var and the shell script
s10
approved these changes
Sep 10, 2026
dorneanu
approved these changes
Sep 11, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds a
db-cleanupsidecar container to the barbican-nanny Deployment that periodically runsbarbican-manage db cleanwith the--batch-sizeflag introduced in sapcc/barbican#52. Without batching, the one-shot DELETE exhausts the InnoDB buffer pool on large deployments.scripts/_db-cleanup.sh.tpl— loops on$BARBICAN_DB_CLEANUP_INTERVAL, passes--batch-size,--min-days, and optional--clean-unassociated-projects/--soft-delete-expired-secretsflags controlled by env varsscripts-configmap.yaml— gate changed fromdb_secret_move.enabledtoor db_secret_move.enabled db_cleanup.enabled;db-cleanup.shadded conditionallybarbican-nanny-deployment.yaml— outer gate updated toor;move-secretsanddb-cleanupcontainers each independently conditional;volumes:block moved outside both container conditionals (latent bug in original)values.yaml— newbarbican_nanny.db_cleanupblock (all defaults off / safe)New values:
Test plan
helm templatewithdb_cleanup.enabled: falseproduces identical output to current master (no regressions)helm templatewithdb_cleanup.enabled: true, db_secret_move.enabled: falserenders a single-container nanny Deployment withdb-cleanupcontainer and correct env varshelm templatewith both enabled renders both containers in the same pod