# Stalwart ConfigMap Hardening Test Results

**Date**: 2026-08-01  
**Issue**: DEV-431  
**Engineer**: CTO Agent

## Summary

Successfully hardened Stalwart ConfigMap mount to eliminate CrashLoopBackOff risk from subPath mounting race condition.

## Changes Deployed

**Commit**: 291feb96a39c8f28690ab73d742bb5d94ce65cfc

### Before (Problematic)
```yaml
volumeMounts:
- name: bootstrap-config
  mountPath: /etc/stalwart/config.json
  subPath: config.json  # ← Race condition risk
```

### After (Hardened)
```yaml
initContainers:
- name: copy-config
  image: busybox:latest
  command:
  - sh
  - -c
  - |
    cp /tmp/bootstrap-config/* /etc/stalwart/ && \
    echo "Config files copied successfully:" && \
    ls -la /etc/stalwart/
  volumeMounts:
  - name: bootstrap-config-source
    mountPath: /tmp/bootstrap-config
    readOnly: true
  - name: config
    mountPath: /etc/stalwart

containers:
- name: stalwart
  volumeMounts:
  - name: config  # ← emptyDir populated by init-container
    mountPath: /etc/stalwart
```

## Test Results

### 1. ConfigMap Hardening Verification ✅

**Pod Deletion Test (3 iterations)**

| Test | Recovery Time | Restart Count | Result |
|------|---------------|---------------|--------|
| 1    | 69s           | 0             | ✅ PASS |
| 2    | ~80s          | 0             | ✅ PASS |
| 3    | 93s           | 0             | ✅ PASS |

**Conclusion**: No CrashLoopBackOff observed. ConfigMap files are consistently populated before Stalwart starts.

### 2. Alert Delivery Test ⚠️

**Timeline**:
- 10:06:52 UTC: Pod terminated (scaled to 0)
- 10:08:52 UTC: Expected StalwartDown alert (2m threshold)
- 10:11:52 UTC: Expected StalwartExternalProbeFailure (5m threshold)

**Finding**: Alertmanager is configured to route ALL alerts to "null" receiver.

```yaml
route:
  receiver: "null"
receivers:
- name: "null"
```

**Implication**: 
- Alerts WILL fire in Prometheus when conditions are met
- Alerts WILL appear in Alertmanager UI
- Alerts will NOT be delivered to any external notification channel (no Slack, email, webhook, etc. configured)

**Status**: Can verify alert firing, but NOT external delivery (no notification channel exists).

### 3. Mail Service Health ⏳

Verification pending after alert test completes and service is scaled back to 1 replica.

## Artifacts

- Deployment manifest: `apps/stalwart/stalwart-fresh-deployment.yaml`
- Git commit: 291feb96a39c8f28690ab73d742bb5d94ce65cfc
- ArgoCD app: `stalwart` (namespace: argocd)

## Follow-up Recommendations

1. **Notification Channel**: Configure Alertmanager receiver for production alerting (Slack, email, PagerDuty, etc.)
2. **Alert Test**: Once notification channel is configured, re-run scale-to-0 test to verify end-to-end delivery
3. **Documentation**: Update STABILITY-CHECK.md with corrected alert delivery test procedure (accounting for ArgoCD auto-heal)