From efd03bc604c7498ec30c0d332056f3c2dcc6c1e4 Mon Sep 17 00:00:00 2001
From: Torsten Rudolf <trudolf@squareup.com>
Date: Fri, 17 Jul 2026 14:16:14 +1000
Subject: [PATCH] feat(chart): add relay.deploymentAnnotations for Reloader
 support
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The relay chart only exposed pod-template annotations (relay.podAnnotations).
Stakater Reloader reads its trigger annotations
(secret.reloader.stakater.com/reload / reloader.stakater.com/auto) from the
Deployment's own metadata.annotations, so there was no way to opt a deployment
into auto-rolling on Secret rotation.

This bites in production: DB/Redis creds come from an ExternalSecret injected
as pod env vars, which freeze at pod start. When RDS rotates the password, ESO
updates the Secret but running pods keep the stale creds and fail DB auth until
a manual rollout — exactly the bb-public relay outage on 2026-07-17.

Add a relay.deploymentAnnotations knob (default {}) rendered onto the relay
Deployment's metadata.annotations. Consumers can then set
secret.reloader.stakater.com/reload: <secret> to auto-roll on rotation
(requires the Reloader controller in-cluster). Bump chart to 0.1.4.

Signed-off-by: Torsten Rudolf <trudolf@squareup.com>
---
 deploy/charts/buzz/Chart.yaml                | 4 +++-
 deploy/charts/buzz/templates/deployment.yaml | 6 ++++++
 deploy/charts/buzz/values.yaml               | 4 ++++
 3 files changed, 13 insertions(+), 1 deletion(-)

diff --git a/deploy/charts/buzz/Chart.yaml b/deploy/charts/buzz/Chart.yaml
index 68743d8505..21fb63b244 100644
--- a/deploy/charts/buzz/Chart.yaml
+++ b/deploy/charts/buzz/Chart.yaml
@@ -7,7 +7,7 @@ description: |
   PostgreSQL and Redis. Configurable for single-node evaluation
   (subcharts on) and HA production (external services, existingSecret).
 type: application
-version: 0.1.3
+version: 0.1.4
 appVersion: "0.1.0"
 home: https://github.com/block/buzz
 sources:
@@ -25,6 +25,8 @@ annotations:
   artifacthub.io/changes: |
     - kind: added
       description: Initial chart for Buzz relay.
+    - kind: added
+      description: relay.deploymentAnnotations knob for Deployment-level annotations (e.g. Stakater Reloader).
   artifacthub.io/license: Apache-2.0
 
 # Optional eval-only subcharts. Production deploys disable both and point
diff --git a/deploy/charts/buzz/templates/deployment.yaml b/deploy/charts/buzz/templates/deployment.yaml
index 10ebd3b7a6..95934d6e44 100644
--- a/deploy/charts/buzz/templates/deployment.yaml
+++ b/deploy/charts/buzz/templates/deployment.yaml
@@ -5,6 +5,12 @@ metadata:
   name: {{ include "buzz.fullname" . }}
   labels:
     {{- include "buzz.labels" . | nindent 4 }}
+  {{- with .Values.relay.deploymentAnnotations }}
+  # Deployment-level annotations, e.g. Stakater Reloader to auto-roll pods
+  # when an external Secret (DB/Redis creds) rotates.
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
 spec:
   replicas: {{ .Values.replicaCount }}
   strategy:
diff --git a/deploy/charts/buzz/values.yaml b/deploy/charts/buzz/values.yaml
index 9edb534f1b..e1d1067f3d 100644
--- a/deploy/charts/buzz/values.yaml
+++ b/deploy/charts/buzz/values.yaml
@@ -133,6 +133,10 @@ relay:
 
   podAnnotations: {}
   podLabels: {}
+  # Annotations on the relay Deployment resource itself (not the pod template).
+  # Set e.g. secret.reloader.stakater.com/reload: <secret-name> to have
+  # Stakater Reloader roll the pods when that Secret rotates.
+  deploymentAnnotations: {}
   nodeSelector: {}
   tolerations: []
   affinity: {}