From 291feb96a39c8f28690ab73d742bb5d94ce65cfc Mon Sep 17 00:00:00 2001
From: CTO Agent <cto@basicstack.de>
Date: Sat, 1 Aug 2026 09:47:22 +0000
Subject: [PATCH] Harden Stalwart ConfigMap mount to eliminate CrashLoop risk

Issue: During stability testing (DEV-426), pod restart hit a ConfigMap
subPath mounting race, leaving config.json empty/unparseable and causing
CrashLoopBackOff. This undermines the HA work.

Root cause: Kubernetes subPath ConfigMap mounts can race during pod
restart, resulting in empty or incomplete files before the container starts.

Changes:
- Add copy-config init-container that copies ConfigMap files to emptyDir
- Replace subPath mount with directory mount from emptyDir
- Config files are now guaranteed to be complete before Stalwart starts
- Eliminates the ConfigMap subPath mounting race entirely

This is a critical hardening fix for production mail server stability.

Resolves DEV-431.

Co-Authored-By: Paperclip <noreply@paperclip.ing>
---
 apps/stalwart/stalwart-fresh-deployment.yaml | 27 +++++++++++++++++---
 1 file changed, 23 insertions(+), 4 deletions(-)

diff --git a/apps/stalwart/stalwart-fresh-deployment.yaml b/apps/stalwart/stalwart-fresh-deployment.yaml
index 85326f8..9db8be6 100644
--- a/apps/stalwart/stalwart-fresh-deployment.yaml
+++ b/apps/stalwart/stalwart-fresh-deployment.yaml
@@ -91,6 +91,22 @@ spec:
         app: stalwart
     spec:
       initContainers:
+      # Copy ConfigMap files to emptyDir to avoid subPath mounting race
+      - name: copy-config
+        image: busybox:latest
+        command:
+        - sh
+        - -c
+        - |
+          cp /tmp/bootstrap-config/* /etc/stalwart/ && \
+          echo "Config files copied successfully:" && \
+          ls -la /etc/stalwart/
+        volumeMounts:
+        - name: bootstrap-config-source
+          mountPath: /tmp/bootstrap-config
+          readOnly: true
+        - name: config
+          mountPath: /etc/stalwart
       - name: fix-permissions
         image: busybox:latest
         command: ["sh", "-c", "chown -R 2000:2000 /var/lib/stalwart && chmod -R 755 /var/lib/stalwart"]
@@ -125,9 +141,8 @@ spec:
         volumeMounts:
         - name: data
           mountPath: /var/lib/stalwart
-        - name: bootstrap-config
-          mountPath: /etc/stalwart/config.json
-          subPath: config.json
+        - name: config
+          mountPath: /etc/stalwart
         - name: tls-certs
           mountPath: /etc/stalwart/certs
           readOnly: true
@@ -178,7 +193,11 @@ spec:
       - name: data
         persistentVolumeClaim:
           claimName: stalwart-data
-      - name: bootstrap-config
+      # emptyDir for config files (populated by copy-config init-container)
+      - name: config
+        emptyDir: {}
+      # ConfigMap source for init-container (no longer mounted directly via subPath)
+      - name: bootstrap-config-source
         configMap:
           name: stalwart-bootstrap-config
       - name: tls-certs