Add resources to the subPath permissions init container

README.md.gotmpl

@@ -158,14 +158,33 @@ persistence:
 Set `subPath` on both volumes when they share a PVC; otherwise the one without
 a `subPath` mounts the PVC root and still sees the other's directory.
 
+When `persistence.logs` uses the same claim as `persistence.worker`, the chart
+mounts the logs from the worker's `sites-dir` volume (with `logs.subPath`)
+instead of declaring a second volume for the same claim: a pod that references
+one PVC in two volumes never gets past `ContainerCreating`.
+
 > **Warning:** setting `persistence.worker.subPath` on a claim that already holds
 > sites at its root mounts only that subdirectory, so the existing sites and
 > their configuration are no longer visible to the workloads. Move the existing
 > data into the subdirectory before switching.
 
 When a `subPath` is set, an init container (`persistence.subPathPermissions.enabled`,
 default `true`) creates the directory and sets its ownership before the main
-containers start.
+containers start. Set `persistence.subPathPermissions.resources` when the
+namespace has a ResourceQuota on CPU or memory: the quota then requires every
+container, init containers included, to declare them.
+
+```yaml
+persistence:
+  subPathPermissions:
+    enabled: true
+    resources:
+      requests:
+        cpu: 10m
+        memory: 16Mi
+      limits:
+        memory: 32Mi
+```
 
 ### Access Modes
 

erpnext/README.md

@@ -61,7 +61,7 @@ The following table lists the configurable parameters of the ERPNext chart and t
 
 ### erpnext
 
-![Version: 8.0.83](https://img.shields.io/badge/Version-8.0.83-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: v16.37.0](https://img.shields.io/badge/AppVersion-v16.37.0-informational?style=flat-square)
+![Version: 8.0.89](https://img.shields.io/badge/Version-8.0.89-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: v16.52.1](https://img.shields.io/badge/AppVersion-v16.52.1-informational?style=flat-square)
 
 Kubernetes Helm Chart for ERPNext and Frappe Framework Apps.
 
@@ -100,7 +100,7 @@ Kubernetes Helm Chart for ERPNext and Frappe Framework Apps.
 | httproute.rules[0].matches[0].pathType | string | `"PathPrefix"` |  |
 | image.pullPolicy | string | `"IfNotPresent"` |  |
 | image.repository | string | `"frappe/erpnext"` |  |
-| image.tag | string | `"v16.37.0"` |  |
+| image.tag | string | `"v16.52.1"` |  |
 | imagePullSecrets | list | `[]` |  |
 | ingress.annotations | object | `{}` |  |
 | ingress.enabled | bool | `false` |  |
@@ -270,6 +270,7 @@ Kubernetes Helm Chart for ERPNext and Frappe Framework Apps.
 | persistence.logs.enabled | bool | `false` |  |
 | persistence.logs.size | string | `"8Gi"` |  |
 | persistence.subPathPermissions.enabled | bool | `true` |  |
+| persistence.subPathPermissions.resources | object | `{}` |  |
 | persistence.worker.accessModes[0] | string | `"ReadWriteMany"` |  |
 | persistence.worker.enabled | bool | `true` |  |
 | persistence.worker.size | string | `"8Gi"` |  |
@@ -502,14 +503,33 @@ persistence:
 Set `subPath` on both volumes when they share a PVC; otherwise the one without
 a `subPath` mounts the PVC root and still sees the other's directory.
 
+When `persistence.logs` uses the same claim as `persistence.worker`, the chart
+mounts the logs from the worker's `sites-dir` volume (with `logs.subPath`)
+instead of declaring a second volume for the same claim: a pod that references
+one PVC in two volumes never gets past `ContainerCreating`.
+
 > **Warning:** setting `persistence.worker.subPath` on a claim that already holds
 > sites at its root mounts only that subdirectory, so the existing sites and
 > their configuration are no longer visible to the workloads. Move the existing
 > data into the subdirectory before switching.
 
 When a `subPath` is set, an init container (`persistence.subPathPermissions.enabled`,
 default `true`) creates the directory and sets its ownership before the main
-containers start.
+containers start. Set `persistence.subPathPermissions.resources` when the
+namespace has a ResourceQuota on CPU or memory: the quota then requires every
+container, init containers included, to declare them.
+
+```yaml
+persistence:
+  subPathPermissions:
+    enabled: true
+    resources:
+      requests:
+        cpu: 10m
+        memory: 16Mi
+      limits:
+        memory: 32Mi
+```
 
 ### Access Modes
 

erpnext/templates/_helpers.tpl

@@ -97,6 +97,25 @@ Gets the redis cache host name
 {{ .Values.redisCacheHost }}
 {{- end -}}
 
+{{/*
+Name of the volume the logs are mounted from. When persistence.logs uses the same
+PVC as persistence.worker (e.g. both existingClaim set to the same claim), the logs
+are mounted from the sites-dir volume, with their own subPath, instead of a second
+"logs" volume: a pod that references the same PVC in two volumes never gets past
+ContainerCreating, because the kubelet mounts the claim once and keeps waiting for
+the second volume.
+*/}}
+{{- define "erpnext.logsVolumeName" -}}
+{{- $p := .Values.persistence -}}
+{{- $sitesClaim := default (include "erpnext.fullname" .) $p.worker.existingClaim -}}
+{{- $logsClaim := default (printf "%s-logs" (include "erpnext.fullname" .)) $p.logs.existingClaim -}}
+{{- if and $p.worker.enabled $p.logs.enabled (eq $sitesClaim $logsClaim) -}}
+sites-dir
+{{- else -}}
+logs
+{{- end -}}
+{{- end -}}
+
 {{/*
 Init container that creates and chowns the persistence subPath directories, so
 a fresh subPath (otherwise created root-owned by the kubelet) is writable by
@@ -130,13 +149,17 @@ unless a subPath is set. Takes a dict with "root" (the chart context) and
     # run as root to set ownership
     runAsNonRoot: false
     runAsUser: 0
+  {{- with $p.subPathPermissions.resources }}
+  resources:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
   volumeMounts:
     {{- if $p.worker.subPath }}
     - name: sites-dir
       mountPath: /mnt/sites
     {{- end }}
     {{- if $withLogs }}
-    - name: logs
+    - name: {{ include "erpnext.logsVolumeName" $root }}
       mountPath: /mnt/logs
     {{- end }}
 {{- end }}

erpnext/templates/deployment-gunicorn.yaml

@@ -58,7 +58,7 @@ spec:
             {{- if .Values.persistence.worker.subPath }}
             subPath: {{ .Values.persistence.worker.subPath | quote }}
             {{- end }}
-          - name: logs
+          - name: {{ include "erpnext.logsVolumeName" $ }}
             mountPath: /home/frappe/frappe-bench/logs
             {{- if .Values.persistence.logs.subPath }}
             subPath: {{ .Values.persistence.logs.subPath | quote }}
@@ -89,6 +89,7 @@ spec:
           {{- else }}
           emptyDir: {}
           {{- end }}
+        {{- if eq (include "erpnext.logsVolumeName" $) "logs" }}
         - name: logs
           {{- if .Values.persistence.logs.enabled }}
           persistentVolumeClaim:
@@ -101,6 +102,7 @@ spec:
           {{- else }}
           emptyDir: {}
           {{- end }}
+        {{- end }}
       {{- with .Values.worker.gunicorn.nodeSelector }}
       nodeSelector:
         {{- toYaml . | nindent 8 }}

erpnext/templates/deployment-scheduler.yaml

@@ -71,7 +71,7 @@ spec:
             {{- if .Values.persistence.worker.subPath }}
             subPath: {{ .Values.persistence.worker.subPath | quote }}
             {{- end }}
-          - name: logs
+          - name: {{ include "erpnext.logsVolumeName" $ }}
             mountPath: /home/frappe/frappe-bench/logs
             {{- if .Values.persistence.logs.subPath }}
             subPath: {{ .Values.persistence.logs.subPath | quote }}
@@ -92,6 +92,7 @@ spec:
           {{- else }}
           emptyDir: {}
           {{- end }}
+        {{- if eq (include "erpnext.logsVolumeName" $) "logs" }}
         - name: logs
           {{- if .Values.persistence.logs.enabled }}
           persistentVolumeClaim:
@@ -104,6 +105,7 @@ spec:
           {{- else }}
           emptyDir: {}
           {{- end }}
+        {{- end }}
       {{- with .Values.worker.scheduler.nodeSelector }}
       nodeSelector:
         {{- toYaml . | nindent 8 }}

erpnext/templates/deployment-socketio.yaml

@@ -58,7 +58,7 @@ spec:
             {{- if .Values.persistence.worker.subPath }}
             subPath: {{ .Values.persistence.worker.subPath | quote }}
             {{- end }}
-          - name: logs
+          - name: {{ include "erpnext.logsVolumeName" $ }}
             mountPath: /home/frappe/frappe-bench/logs
             {{- if .Values.persistence.logs.subPath }}
             subPath: {{ .Values.persistence.logs.subPath | quote }}
@@ -90,6 +90,7 @@ spec:
           {{- else }}
           emptyDir: {}
           {{- end }}
+        {{- if eq (include "erpnext.logsVolumeName" $) "logs" }}
         - name: logs
           {{- if .Values.persistence.logs.enabled }}
           persistentVolumeClaim:
@@ -102,6 +103,7 @@ spec:
           {{- else }}
           emptyDir: {}
           {{- end }}
+        {{- end }}
       {{- with .Values.socketio.nodeSelector }}
       nodeSelector:
         {{- toYaml . | nindent 8 }}

erpnext/templates/deployment-worker-default.yaml

@@ -75,7 +75,7 @@ spec:
             {{- if .Values.persistence.worker.subPath }}
             subPath: {{ .Values.persistence.worker.subPath | quote }}
             {{- end }}
-          - name: logs
+          - name: {{ include "erpnext.logsVolumeName" $ }}
             mountPath: /home/frappe/frappe-bench/logs
             {{- if .Values.persistence.logs.subPath }}
             subPath: {{ .Values.persistence.logs.subPath | quote }}
@@ -96,6 +96,7 @@ spec:
           {{- else }}
           emptyDir: {}
           {{- end }}
+        {{- if eq (include "erpnext.logsVolumeName" $) "logs" }}
         - name: logs
           {{- if .Values.persistence.logs.enabled }}
           persistentVolumeClaim:
@@ -108,6 +109,7 @@ spec:
           {{- else }}
           emptyDir: {}
           {{- end }}
+        {{- end }}
       {{- with .Values.worker.default.nodeSelector }}
       nodeSelector:
         {{- toYaml . | nindent 8 }}

erpnext/templates/deployment-worker-long.yaml

@@ -75,7 +75,7 @@ spec:
             {{- if .Values.persistence.worker.subPath }}
             subPath: {{ .Values.persistence.worker.subPath | quote }}
             {{- end }}
-          - name: logs
+          - name: {{ include "erpnext.logsVolumeName" $ }}
             mountPath: /home/frappe/frappe-bench/logs
             {{- if .Values.persistence.logs.subPath }}
             subPath: {{ .Values.persistence.logs.subPath | quote }}
@@ -96,6 +96,7 @@ spec:
           {{- else }}
           emptyDir: {}
           {{- end }}
+        {{- if eq (include "erpnext.logsVolumeName" $) "logs" }}
         - name: logs
           {{- if .Values.persistence.logs.enabled }}
           persistentVolumeClaim:
@@ -108,6 +109,7 @@ spec:
           {{- else }}
           emptyDir: {}
           {{- end }}
+        {{- end }}
       {{- with .Values.worker.long.nodeSelector }}
       nodeSelector:
         {{- toYaml . | nindent 8 }}

erpnext/templates/deployment-worker-short.yaml

@@ -75,7 +75,7 @@ spec:
             {{- if .Values.persistence.worker.subPath }}
             subPath: {{ .Values.persistence.worker.subPath | quote }}
             {{- end }}
-          - name: logs
+          - name: {{ include "erpnext.logsVolumeName" $ }}
             mountPath: /home/frappe/frappe-bench/logs
             {{- if .Values.persistence.logs.subPath }}
             subPath: {{ .Values.persistence.logs.subPath | quote }}
@@ -96,6 +96,7 @@ spec:
           {{- else }}
           emptyDir: {}
           {{- end }}
+        {{- if eq (include "erpnext.logsVolumeName" $) "logs" }}
         - name: logs
           {{- if .Values.persistence.logs.enabled }}
           persistentVolumeClaim:
@@ -108,6 +109,7 @@ spec:
           {{- else }}
           emptyDir: {}
           {{- end }}
+        {{- end }}
       {{- with .Values.worker.short.nodeSelector }}
       nodeSelector:
         {{- toYaml . | nindent 8 }}

erpnext/templates/job-backup-multiple-sites.yaml

@@ -40,7 +40,7 @@ spec:
             {{- if .Values.persistence.worker.subPath }}
             subPath: {{ .Values.persistence.worker.subPath | quote }}
             {{- end }}
-          - name: logs
+          - name: {{ include "erpnext.logsVolumeName" $ }}
             mountPath: /home/frappe/frappe-bench/logs
             {{- if .Values.persistence.logs.subPath }}
             subPath: {{ .Values.persistence.logs.subPath | quote }}
@@ -59,6 +59,7 @@ spec:
           {{- else }}
           emptyDir: {}
           {{- end }}
+        {{- if eq (include "erpnext.logsVolumeName" $) "logs" }}
         - name: logs
           {{- if .Values.persistence.logs.enabled }}
           persistentVolumeClaim:
@@ -71,6 +72,7 @@ spec:
           {{- else }}
           emptyDir: {}
           {{- end }}
+        {{- end }}
       {{- with .Values.jobs.backupMultipleSites.nodeSelector }}
       nodeSelector:
         {{- toYaml . | nindent 8 }}

erpnext/templates/job-backup.yaml

@@ -41,7 +41,7 @@ spec:
             {{- if .Values.persistence.worker.subPath }}
             subPath: {{ .Values.persistence.worker.subPath | quote }}
             {{- end }}
-          - name: logs
+          - name: {{ include "erpnext.logsVolumeName" $ }}
             mountPath: /home/frappe/frappe-bench/logs
             {{- if .Values.persistence.logs.subPath }}
             subPath: {{ .Values.persistence.logs.subPath | quote }}
@@ -60,6 +60,7 @@ spec:
           {{- else }}
           emptyDir: {}
           {{- end }}
+        {{- if eq (include "erpnext.logsVolumeName" $) "logs" }}
         - name: logs
           {{- if .Values.persistence.logs.enabled }}
           persistentVolumeClaim:
@@ -72,6 +73,7 @@ spec:
           {{- else }}
           emptyDir: {}
           {{- end }}
+        {{- end }}
       {{- with .Values.jobs.backup.nodeSelector }}
       nodeSelector:
         {{- toYaml . | nindent 8 }}

erpnext/templates/job-configure-bench.yaml

@@ -37,7 +37,7 @@ spec:
             {{- if .Values.persistence.worker.subPath }}
             subPath: {{ .Values.persistence.worker.subPath | quote }}
             {{- end }}
-          - name: logs
+          - name: {{ include "erpnext.logsVolumeName" $ }}
             mountPath: /home/frappe/frappe-bench/logs
             {{- if .Values.persistence.logs.subPath }}
             subPath: {{ .Values.persistence.logs.subPath | quote }}
@@ -133,7 +133,7 @@ spec:
             {{- if .Values.persistence.worker.subPath }}
             subPath: {{ .Values.persistence.worker.subPath | quote }}
             {{- end }}
-          - name: logs
+          - name: {{ include "erpnext.logsVolumeName" $ }}
             mountPath: /home/frappe/frappe-bench/logs
             {{- if .Values.persistence.logs.subPath }}
             subPath: {{ .Values.persistence.logs.subPath | quote }}
@@ -152,6 +152,7 @@ spec:
           {{- else }}
           emptyDir: {}
           {{- end }}
+        {{- if eq (include "erpnext.logsVolumeName" $) "logs" }}
         - name: logs
           {{- if .Values.persistence.logs.enabled }}
           persistentVolumeClaim:
@@ -164,6 +165,7 @@ spec:
           {{- else }}
           emptyDir: {}
           {{- end }}
+        {{- end }}
       {{- with .Values.jobs.configure.nodeSelector }}
       nodeSelector:
         {{- toYaml . | nindent 8 }}

erpnext/templates/job-create-multiple-sites.yaml

@@ -202,7 +202,7 @@ spec:
             {{- if .Values.persistence.worker.subPath }}
             subPath: {{ .Values.persistence.worker.subPath | quote }}
             {{- end }}
-          - name: logs
+          - name: {{ include "erpnext.logsVolumeName" $ }}
             mountPath: /home/frappe/frappe-bench/logs
             {{- if .Values.persistence.logs.subPath }}
             subPath: {{ .Values.persistence.logs.subPath | quote }}
@@ -221,6 +221,7 @@ spec:
           {{- else }}
           emptyDir: {}
           {{- end }}
+        {{- if eq (include "erpnext.logsVolumeName" $) "logs" }}
         - name: logs
           {{- if .Values.persistence.logs.enabled }}
           persistentVolumeClaim:
@@ -233,6 +234,7 @@ spec:
           {{- else }}
           emptyDir: {}
           {{- end }}
+        {{- end }}
       {{- with .Values.jobs.createMultipleSites.nodeSelector }}
       nodeSelector:
         {{- toYaml . | nindent 8 }}