fix(paperless): drop runtime apk add from fetch-bridge-cert #448

2026-07-30T12:39:56Z

claude-bot commented

2026-07-30 12:39:56 +00:00

Second of the runtime apk add cleanups. The fetch-bridge-cert init container ran apk add --no-cache openssl on every paperless pod start.

This one genuinely needs an image

Unlike the multus CNI installer — where busybox wget/tar already covered the need, so no image was required — the openssl CLI is absent from the alpine base. Verified:

openssl: ABSENT     nc: /usr/bin/nc      wget: /usr/bin/wget
jq:      ABSENT     curl: ABSENT

The base carries the libraries but not the command, and busybox has no s_client equivalent, so the STARTTLS certificate capture can't be done with what's already there.

Change

Adds ci/images/alpine-openssl, named for what it is rather than for this consumer. Script logic is untouched — only the apk add line is removed and the image swapped.

Verified the published image:

OpenSSL 3.3.7 7 Apr 2026 (Library: OpenSSL 3.3.7 7 Apr 2026)
/usr/bin/openssl

Image already exists and pulls (built by this branch's push build, pipeline 3097), so merging can't strand the Deployment. Plus woodpecker lint, kustomize build, server-side dry run; zero non-comment apk add left in the file.

Note on the pod roll

This changes the pod template, so merging rolls paperless. The init container blocks until the Proton Mail Bridge presents a cert via STARTTLS — that's pre-existing behaviour (it re-fetches on every restart by design, so a bridge cert rotation is picked up by a rollout), but worth knowing the new pod won't go ready until the bridge answers.

Remaining

kubernetes/apps/home-assistant/mosquitto-bootstrap.yaml — apk add curl jq across 7 Job blocks. Coming as its own PR, with alpine-curl-jq layered FROM alpine-jq so jq is defined in one place rather than duplicated.

🤖 Generated with Claude Code

Second of the runtime `apk add` cleanups. The `fetch-bridge-cert` init container ran `apk add --no-cache openssl` on **every paperless pod start**. ## This one genuinely needs an image Unlike the multus CNI installer — where busybox `wget`/`tar` already covered the need, so no image was required — the openssl CLI is **absent from the alpine base**. Verified: ``` openssl: ABSENT nc: /usr/bin/nc wget: /usr/bin/wget jq: ABSENT curl: ABSENT ``` The base carries the libraries but not the command, and busybox has no `s_client` equivalent, so the STARTTLS certificate capture can't be done with what's already there. ## Change Adds `ci/images/alpine-openssl`, named for what it is rather than for this consumer. Script logic is **untouched** — only the `apk add` line is removed and the image swapped. Verified the published image: ``` OpenSSL 3.3.7 7 Apr 2026 (Library: OpenSSL 3.3.7 7 Apr 2026) /usr/bin/openssl ``` Image already exists and pulls (built by this branch's push build, pipeline 3097), so merging can't strand the Deployment. Plus `woodpecker lint`, `kustomize build`, server-side dry run; zero non-comment `apk add` left in the file. ## Note on the pod roll This changes the pod template, so merging rolls paperless. The init container blocks until the Proton Mail Bridge presents a cert via STARTTLS — that's pre-existing behaviour (it re-fetches on every restart by design, so a bridge cert rotation is picked up by a rollout), but worth knowing the new pod won't go ready until the bridge answers. ## Remaining `kubernetes/apps/home-assistant/mosquitto-bootstrap.yaml` — `apk add curl jq` across **7 Job blocks**. Coming as its own PR, with `alpine-curl-jq` layered `FROM alpine-jq` so jq is defined in one place rather than duplicated. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

review-bot reviewed

2026-07-30 12:41:28 +00:00

review-bot left a comment

🤖 Automated review — model CLI default (complexity: complex), commit a0af5987d52ea069f1ee2d7fb75fef9d28aeeef8.

Advisory review by the review-bot pipeline. It never approves; a human merges. Push new commits to get a fresh review.

Summary

Removes the apk add --no-cache openssl that ran on every paperless pod start in the fetch-bridge-cert init container, replacing it with a purpose-built alpine-openssl image built via a new kaniko step in .woodpecker/build-ci-images.yml. Script logic in the init container is untouched. This closely mirrors the existing alpine-jq pattern in the same file (same step shape, same depends_on: []/when: path gating, same dated-tag convention), and the base image is pinned by digest. No issues found.

🟡 Suggestions

ci/images/alpine-openssl/Containerfile:1 and kubernetes/apps/paperless/paperless.yaml:96 — the alpine-openssl image is pushed with both a dated tag and :latest (.woodpecker/build-ci-images.yml:189-190), but the Deployment pins the dated tag directly rather than by digest, same as the existing alpine-jq consumer. Not a regression introduced by this PR (it's the established convention), but worth noting the dated tag is still mutable if the same-day build is re-triggered manually (event: manual) before the pod pulls it — a digest pin would remove that residual drift risk. Purely optional given it matches existing precedent.

Tests

No test suite applies to this Kubernetes/CI-config change. The PR body documents manual verification (image builds and pulls from pipeline 3097, woodpecker lint, kustomize build, a server-side dry run, and confirming the published image actually contains a working openssl binary) — appropriate for this kind of change and consistent with how the sibling alpine-jq PR was presumably verified.

Recommendation

Looks reasonable — no blocking issues; comment above is optional.

🤖 **Automated review** — model `CLI default` (complexity: complex), commit `a0af5987d52ea069f1ee2d7fb75fef9d28aeeef8`. > Advisory review by the `review-bot` pipeline. It never approves; a human merges. Push new commits to get a fresh review. --- ## Summary Removes the `apk add --no-cache openssl` that ran on every paperless pod start in the `fetch-bridge-cert` init container, replacing it with a purpose-built `alpine-openssl` image built via a new kaniko step in `.woodpecker/build-ci-images.yml`. Script logic in the init container is untouched. This closely mirrors the existing `alpine-jq` pattern in the same file (same step shape, same `depends_on: []`/`when: path` gating, same dated-tag convention), and the base image is pinned by digest. No issues found. ## 🟡 Suggestions - `ci/images/alpine-openssl/Containerfile:1` and `kubernetes/apps/paperless/paperless.yaml:96` — the `alpine-openssl` image is pushed with both a dated tag and `:latest` (`.woodpecker/build-ci-images.yml:189-190`), but the Deployment pins the dated tag directly rather than by digest, same as the existing `alpine-jq` consumer. Not a regression introduced by this PR (it's the established convention), but worth noting the dated tag is still mutable if the same-day build is re-triggered manually (`event: manual`) before the pod pulls it — a digest pin would remove that residual drift risk. Purely optional given it matches existing precedent. ## Tests No test suite applies to this Kubernetes/CI-config change. The PR body documents manual verification (image builds and pulls from pipeline 3097, `woodpecker lint`, `kustomize build`, a server-side dry run, and confirming the published image actually contains a working `openssl` binary) — appropriate for this kind of change and consistent with how the sibling `alpine-jq` PR was presumably verified. ## Recommendation Looks reasonable — no blocking issues; comment above is optional.

claude-bot force-pushed paperless-drop-apk from a0af5987d5 to a6effdd4cf

2026-07-30 12:50:08 +00:00

Compare

review-bot reviewed

2026-07-30 12:52:19 +00:00

review-bot left a comment

🤖 Automated review — model CLI default (complexity: complex), commit a6effdd4cf7b3938e7e19fdea09bcd96a365249a.

Advisory review by the review-bot pipeline. It never approves; a human merges. Push new commits to get a fresh review.

Summary

Removes the runtime apk add --no-cache openssl from the paperless fetch-bridge-cert init container by introducing a new pre-built ci/images/alpine-openssl image (built via a new woodpecker step) and pointing the Deployment at a dated tag of it. Script logic in the init container is unchanged. This is a clean, low-risk change that follows an established pattern already used in this repo (alpine-jq, cni-plugins) closely enough that it's easy to verify.

No blocking issues found.

🟡 Suggestions

kubernetes/apps/paperless/paperless.yaml:96 — the new image is referenced only by a dated tag (alpine-openssl:2026-07-30), with no :latest fallback and no digest pin. That matches the existing convention (alpine-jq:2026-07-30, cni-plugins:2026-07-30), so it's consistent, but it does mean this Deployment's correctness depends on the build-alpine-openssl woodpecker step in .woodpecker/build-ci-images.yml having actually run and pushed that exact tag before/at merge time — the PR body asserts this was verified (pipeline 3097), which I can't independently confirm from the checkout, but it's the one thing that would break the rollout if untrue (ImagePullBackOff on the next pod recreate, since strategy: Recreate means paperless would go fully down, not just fail to roll a replica).

Tests

No automated tests apply to this kind of infra/manifest change in this repo, and none exist elsewhere for the analogous alpine-jq/cni-plugins images either — consistent with existing practice. The PR body documents manual verification (woodpecker lint, kustomize build, server-side dry run, and pulling/inspecting the built image) which is the appropriate level of diligence for this kind of change.

Recommendation

Looks reasonable — no blocking issues; comment above is optional.

🤖 **Automated review** — model `CLI default` (complexity: complex), commit `a6effdd4cf7b3938e7e19fdea09bcd96a365249a`. > Advisory review by the `review-bot` pipeline. It never approves; a human merges. Push new commits to get a fresh review. --- ## Summary Removes the runtime `apk add --no-cache openssl` from the paperless `fetch-bridge-cert` init container by introducing a new pre-built `ci/images/alpine-openssl` image (built via a new woodpecker step) and pointing the Deployment at a dated tag of it. Script logic in the init container is unchanged. This is a clean, low-risk change that follows an established pattern already used in this repo (`alpine-jq`, `cni-plugins`) closely enough that it's easy to verify. No blocking issues found. ## 🟡 Suggestions - `kubernetes/apps/paperless/paperless.yaml:96` — the new image is referenced only by a dated tag (`alpine-openssl:2026-07-30`), with no `:latest` fallback and no digest pin. That matches the existing convention (`alpine-jq:2026-07-30`, `cni-plugins:2026-07-30`), so it's consistent, but it does mean this Deployment's correctness depends on the `build-alpine-openssl` woodpecker step in `.woodpecker/build-ci-images.yml` having actually run and pushed that exact tag before/at merge time — the PR body asserts this was verified (pipeline 3097), which I can't independently confirm from the checkout, but it's the one thing that would break the rollout if untrue (`ImagePullBackOff` on the next pod recreate, since `strategy: Recreate` means paperless would go fully down, not just fail to roll a replica). ## Tests No automated tests apply to this kind of infra/manifest change in this repo, and none exist elsewhere for the analogous `alpine-jq`/`cni-plugins` images either — consistent with existing practice. The PR body documents manual verification (`woodpecker lint`, `kustomize build`, server-side dry run, and pulling/inspecting the built image) which is the appropriate level of diligence for this kind of change. ## Recommendation Looks reasonable — no blocking issues; comment above is optional.

k.renner merged commit 57d333a2f1 into master

2026-07-30 12:52:48 +00:00

k.renner referenced this issue from a commit

2026-07-30 12:52:48 +00:00

Merge pull request 'fix(paperless): drop runtime apk add from fetch-bridge-cert' (#448) from paperless-drop-apk into master

claude-bot referenced this pull request

2026-07-30 12:55:49 +00:00

fix(mosquitto): drop runtime apk add from the 7 bootstrap Jobs #449

Sign in to join this conversation.

2 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: konairius/homelab#448