From b8797c03134e8ddcb2ccf45763e82d08aec3978c Mon Sep 17 00:00:00 2001
From: rajivmucheli <rajiv.mucheli@sap.com>
Date: Wed, 9 Sep 2026 20:47:42 +0530
Subject: [PATCH 1/3] [barbican] add batched db-cleanup nanny container

Adds a db-cleanup sidecar to the barbican-nanny Deployment, backed by a
new barbican-manage db clean loop script.  All cleanup operations now
use the --batch-size flag introduced in sapcc/barbican#52 to prevent
InnoDB buffer pool exhaustion on large deployments.

New values under barbican_nanny.db_cleanup:
  enabled                      - toggle the container (default: false)
  batch_size                   - rows per committed batch (default: 10000)
  min_num_days                 - threshold age for hard-deletes (default: 14)
  clean_unassociated_projects  - pass --clean-unassociated-projects flag
  soft_delete_expired_secrets  - pass --soft-delete-expired-secrets flag

The nanny Deployment now renders when either db_secret_move or
db_cleanup is enabled (previously gated on db_secret_move only).
---
 .../templates/barbican-nanny-deployment.yaml  | 64 ++++++++++++++++++-
 .../barbican/templates/scripts-configmap.yaml |  8 ++-
 .../templates/scripts/_db-cleanup.sh.tpl      | 45 +++++++++++++
 openstack/barbican/values.yaml                |  8 +++
 4 files changed, 122 insertions(+), 3 deletions(-)
 create mode 100644 openstack/barbican/templates/scripts/_db-cleanup.sh.tpl

diff --git a/openstack/barbican/templates/barbican-nanny-deployment.yaml b/openstack/barbican/templates/barbican-nanny-deployment.yaml
index a5f19c75b7c..0fe298a370c 100644
--- a/openstack/barbican/templates/barbican-nanny-deployment.yaml
+++ b/openstack/barbican/templates/barbican-nanny-deployment.yaml
@@ -1,5 +1,5 @@
 {{- if .Values.barbican_nanny.enabled }}
-{{- if .Values.barbican_nanny.db_secret_move.enabled }}
+{{- if or .Values.barbican_nanny.db_secret_move.enabled .Values.barbican_nanny.db_cleanup.enabled }}
 kind: Deployment
 apiVersion: apps/v1
 metadata:
@@ -107,6 +107,67 @@ spec:
           mountPath: /tmp
         {{- include "utils.proxysql.volume_mount" . | indent 8 }}
         {{- include "utils.trust_bundle.volume_mount" . | indent 8 }}
+{{- end }}
+{{- if .Values.barbican_nanny.db_cleanup.enabled }}
+      - name: db-cleanup
+        image: {{required ".Values.global.registry is missing" .Values.global.registry }}/loci-barbican:{{required "Values.imageVersionBarbicanApi is missing" .Values.imageVersionBarbicanApi}}
+        imagePullPolicy: IfNotPresent
+        securityContext:
+          readOnlyRootFilesystem: true
+          allowPrivilegeEscalation: false
+        command:
+        - dumb-init
+{{- if not .Values.barbican_nanny.debug }}
+        - /bin/bash
+        - /scripts/db-cleanup.sh
+{{- else }}
+        - sleep
+        - inf
+{{- end }}
+        env:
+        - name: BARBICAN_DB_CLEANUP_ENABLED
+          value: {{ .Values.barbican_nanny.db_cleanup.enabled | quote }}
+        - name: BARBICAN_DB_CLEANUP_BATCH_SIZE
+          value: {{ .Values.barbican_nanny.db_cleanup.batch_size | quote }}
+        - name: BARBICAN_DB_CLEANUP_MIN_NUM_DAYS
+          value: {{ .Values.barbican_nanny.db_cleanup.min_num_days | quote }}
+        - name: BARBICAN_DB_CLEANUP_CLEAN_UNASSOCIATED_PROJECTS
+          value: {{ .Values.barbican_nanny.db_cleanup.clean_unassociated_projects | quote }}
+        - name: BARBICAN_DB_CLEANUP_SOFT_DELETE_EXPIRED_SECRETS
+          value: {{ .Values.barbican_nanny.db_cleanup.soft_delete_expired_secrets | quote }}
+        - name: BARBICAN_NANNY_INTERVAL
+          value: {{ .Values.barbican_nanny.interval | quote }}
+        {{- if .Values.sentry.enabled }}
+        - name: SENTRY_DSN
+          valueFrom:
+            secretKeyRef:
+              name: sentry
+              key: barbican.DSN.python
+        {{- end }}
+        resources:
+          requests:
+            memory: "250Mi"
+            cpu: "25m"
+          limits:
+            memory: "250Mi"
+            cpu: "100m"
+        volumeMounts:
+        - name: barbican-scripts
+          mountPath: /scripts/db-cleanup.sh
+          subPath: db-cleanup.sh
+          readOnly: true
+        - name: barbican-etc
+          mountPath: /etc/barbican/logging.ini
+          subPath: logging.ini
+          readOnly: true
+        - name: barbican-etc-confd
+          mountPath: /etc/barbican/barbican.conf.d
+          readOnly: true
+        - name: nanny-tmp
+          mountPath: /tmp
+        {{- include "utils.proxysql.volume_mount" . | indent 8 }}
+        {{- include "utils.trust_bundle.volume_mount" . | indent 8 }}
+{{- end }}
       {{- if not .Values.proxysql.native_sidecar }}
       {{- tuple . 1 | include "utils.proxysql.container" | indent 6 }}
       {{- end }}
@@ -126,4 +187,3 @@ spec:
       {{- include "utils.trust_bundle.volumes" . | indent 6 }}
 {{- end }}
 {{- end }}
-{{- end }}
diff --git a/openstack/barbican/templates/scripts-configmap.yaml b/openstack/barbican/templates/scripts-configmap.yaml
index 5d632f7016b..4fc5e4cdb09 100644
--- a/openstack/barbican/templates/scripts-configmap.yaml
+++ b/openstack/barbican/templates/scripts-configmap.yaml
@@ -1,4 +1,4 @@
-{{- if .Values.barbican_nanny.db_secret_move.enabled }}
+{{- if or .Values.barbican_nanny.db_secret_move.enabled .Values.barbican_nanny.db_cleanup.enabled }}
 apiVersion: v1
 kind: ConfigMap
 metadata:
@@ -9,6 +9,12 @@ metadata:
     component: barbican
 
 data:
+{{- if .Values.barbican_nanny.db_secret_move.enabled }}
   move-secrets.sh: |
 {{ include (print .Template.BasePath "/scripts/_move-secrets.sh.tpl") . | indent 4 }}
+{{- end }}
+{{- if .Values.barbican_nanny.db_cleanup.enabled }}
+  db-cleanup.sh: |
+{{ include (print .Template.BasePath "/scripts/_db-cleanup.sh.tpl") . | indent 4 }}
+{{- end }}
 {{- end}}
diff --git a/openstack/barbican/templates/scripts/_db-cleanup.sh.tpl b/openstack/barbican/templates/scripts/_db-cleanup.sh.tpl
new file mode 100644
index 00000000000..952068f5ef3
--- /dev/null
+++ b/openstack/barbican/templates/scripts/_db-cleanup.sh.tpl
@@ -0,0 +1,45 @@
+#!/bin/bash
+#
+# Copyright (c) 2026 SAP SE
+# All Rights Reserved.
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+#
+
+set -e
+
+unset http_proxy https_proxy all_proxy no_proxy
+
+EXTRA_FLAGS=""
+if [ "$BARBICAN_DB_CLEANUP_CLEAN_UNASSOCIATED_PROJECTS" = "True" ] || [ "$BARBICAN_DB_CLEANUP_CLEAN_UNASSOCIATED_PROJECTS" = "true" ]; then
+    EXTRA_FLAGS="$EXTRA_FLAGS --clean-unassociated-projects"
+fi
+if [ "$BARBICAN_DB_CLEANUP_SOFT_DELETE_EXPIRED_SECRETS" = "True" ] || [ "$BARBICAN_DB_CLEANUP_SOFT_DELETE_EXPIRED_SECRETS" = "true" ]; then
+    EXTRA_FLAGS="$EXTRA_FLAGS --soft-delete-expired-secrets"
+fi
+
+echo "INFO: starting a loop to periodically run the barbican db cleanup"
+while true; do
+
+    if [ "$BARBICAN_DB_CLEANUP_ENABLED" = "True" ] || [ "$BARBICAN_DB_CLEANUP_ENABLED" = "true" ]; then
+        date
+        /var/lib/openstack/bin/barbican-manage db clean \
+            --min-num-days "$BARBICAN_DB_CLEANUP_MIN_NUM_DAYS" \
+            --batch-size "$BARBICAN_DB_CLEANUP_BATCH_SIZE" \
+            --verbose \
+            $EXTRA_FLAGS
+    fi
+    echo -n "INFO: waiting $BARBICAN_NANNY_INTERVAL minutes before starting the next loop run - "
+    date
+    sleep $(( 60 * $BARBICAN_NANNY_INTERVAL ))
+done
diff --git a/openstack/barbican/values.yaml b/openstack/barbican/values.yaml
index 2993252f39f..4507671d013 100644
--- a/openstack/barbican/values.yaml
+++ b/openstack/barbican/values.yaml
@@ -564,6 +564,14 @@ barbican_nanny:
   interval: 1
   db_secret_move:
     enabled: false
+  db_cleanup:
+    enabled: false
+    # Number of rows deleted per committed batch (see barbican-manage db clean --batch-size)
+    batch_size: 10000
+    # Minimum age of soft-deleted rows to hard-delete (days); -1 means all
+    min_num_days: 14
+    clean_unassociated_projects: false
+    soft_delete_expired_secrets: false
 
 # SCIBPL-218: restrict kubectl exec / port-forward / attach on the
 # barbican-api pods via a ValidatingAdmissionPolicy (K8s >= 1.30).

From 7b3bf54ab5695238d2266dced6160dfd0b3e6ea2 Mon Sep 17 00:00:00 2001
From: rajiv <rajiv.mucheli@gmail.com>
Date: Thu, 10 Sep 2026 20:40:27 +0530
Subject: [PATCH 2/3] fix: correct --min-days flag and add dedicated db_cleanup
 interval

- --min-num-days is not a valid flag; upstream uses --min-days / -m
  (barbican/cmd/db_manage.py:111)
- db cleanup should run on its own cadence, not the shared nanny
  interval; add barbican_nanny.db_cleanup.interval (default 60 min)
  and wire it through the deployment env var and the shell script
---
 openstack/barbican/templates/barbican-nanny-deployment.yaml | 4 ++--
 openstack/barbican/templates/scripts/_db-cleanup.sh.tpl     | 6 +++---
 openstack/barbican/values.yaml                              | 2 ++
 3 files changed, 7 insertions(+), 5 deletions(-)

diff --git a/openstack/barbican/templates/barbican-nanny-deployment.yaml b/openstack/barbican/templates/barbican-nanny-deployment.yaml
index 0fe298a370c..0c57d25683b 100644
--- a/openstack/barbican/templates/barbican-nanny-deployment.yaml
+++ b/openstack/barbican/templates/barbican-nanny-deployment.yaml
@@ -135,8 +135,8 @@ spec:
           value: {{ .Values.barbican_nanny.db_cleanup.clean_unassociated_projects | quote }}
         - name: BARBICAN_DB_CLEANUP_SOFT_DELETE_EXPIRED_SECRETS
           value: {{ .Values.barbican_nanny.db_cleanup.soft_delete_expired_secrets | quote }}
-        - name: BARBICAN_NANNY_INTERVAL
-          value: {{ .Values.barbican_nanny.interval | quote }}
+        - name: BARBICAN_DB_CLEANUP_INTERVAL
+          value: {{ .Values.barbican_nanny.db_cleanup.interval | quote }}
         {{- if .Values.sentry.enabled }}
         - name: SENTRY_DSN
           valueFrom:
diff --git a/openstack/barbican/templates/scripts/_db-cleanup.sh.tpl b/openstack/barbican/templates/scripts/_db-cleanup.sh.tpl
index 952068f5ef3..8a0dbaf462d 100644
--- a/openstack/barbican/templates/scripts/_db-cleanup.sh.tpl
+++ b/openstack/barbican/templates/scripts/_db-cleanup.sh.tpl
@@ -34,12 +34,12 @@ while true; do
     if [ "$BARBICAN_DB_CLEANUP_ENABLED" = "True" ] || [ "$BARBICAN_DB_CLEANUP_ENABLED" = "true" ]; then
         date
         /var/lib/openstack/bin/barbican-manage db clean \
-            --min-num-days "$BARBICAN_DB_CLEANUP_MIN_NUM_DAYS" \
+            --min-days "$BARBICAN_DB_CLEANUP_MIN_NUM_DAYS" \
             --batch-size "$BARBICAN_DB_CLEANUP_BATCH_SIZE" \
             --verbose \
             $EXTRA_FLAGS
     fi
-    echo -n "INFO: waiting $BARBICAN_NANNY_INTERVAL minutes before starting the next loop run - "
+    echo -n "INFO: waiting $BARBICAN_DB_CLEANUP_INTERVAL minutes before starting the next loop run - "
     date
-    sleep $(( 60 * $BARBICAN_NANNY_INTERVAL ))
+    sleep $(( 60 * $BARBICAN_DB_CLEANUP_INTERVAL ))
 done
diff --git a/openstack/barbican/values.yaml b/openstack/barbican/values.yaml
index 4507671d013..7566da3d40d 100644
--- a/openstack/barbican/values.yaml
+++ b/openstack/barbican/values.yaml
@@ -570,6 +570,8 @@ barbican_nanny:
     batch_size: 10000
     # Minimum age of soft-deleted rows to hard-delete (days); -1 means all
     min_num_days: 14
+    # Sleep time in minutes between cleanup runs
+    interval: 60
     clean_unassociated_projects: false
     soft_delete_expired_secrets: false
 

From e682c3b0dae3978e1e88f20df892f2d08c2ddd4f Mon Sep 17 00:00:00 2001
From: rajiv <rajiv.mucheli@gmail.com>
Date: Thu, 10 Sep 2026 20:46:56 +0530
Subject: [PATCH 3/3] chore(barbican): set conservative db_cleanup defaults
 (batch 1000, min_days 30)

---
 openstack/barbican/values.yaml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/openstack/barbican/values.yaml b/openstack/barbican/values.yaml
index 7566da3d40d..297f1ad5119 100644
--- a/openstack/barbican/values.yaml
+++ b/openstack/barbican/values.yaml
@@ -567,9 +567,9 @@ barbican_nanny:
   db_cleanup:
     enabled: false
     # Number of rows deleted per committed batch (see barbican-manage db clean --batch-size)
-    batch_size: 10000
+    batch_size: 1000
     # Minimum age of soft-deleted rows to hard-delete (days); -1 means all
-    min_num_days: 14
+    min_num_days: 30
     # Sleep time in minutes between cleanup runs
     interval: 60
     clean_unassociated_projects: false