Persist RT state volumes in Helm CronJobs

[Copilot]

Helm CronJob pods were missing the RT deployment’s persistent runtime directories, causing maintenance jobs to lose or fail to access GPG, S/MIME, shredder, and cron state.

• CronJob mounts
  • Added mounts for /opt/rt/var/data/gpg
  • Added mounts for /opt/rt/var/data/smime
  • Added mounts for /opt/rt/var/data/RT-Shredder
  • Added mount for /cron
• Volume definitions
  • Reused the chart’s configured PVCs, with emptyDir fallbacks matching the RT deployment.

- {name: rt-gpg, mountPath: /opt/rt/var/data/gpg, readOnly: false}
- {name: rt-smime, mountPath: /opt/rt/var/data/smime, readOnly: true}
- {name: rt-shredder, mountPath: /opt/rt/var/data/RT-Shredder, readOnly: false}
- {name: rt-cron, mountPath: /cron, readOnly: false}

[Copilot]

🟡 Changes recommended

CronJobs inherit readOnlyRootFilesystem: true by default but still lack the Deployment’s writable /tmp (and Mason cache) mounts, which can cause job failures.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

This PR updates the Helm CronJob template so scheduled RT maintenance jobs run with the same persistent runtime directories as the main RT deployment, preventing loss of GPG, S/MIME, shredder, and cron state between runs.

Changes:

• Added CronJob volumeMounts for RT runtime state directories (gpg, smime, RT-Shredder, /cron).
• Added CronJob volumes that reuse the chart’s PVCs when enabled, with emptyDir fallbacks to match the deployment behavior.

File summaries

File	Description
helm/templates/jobs.yaml	Extends CronJob pods with RT state volume mounts and PVC/emptyDir volume definitions to align with the RT deployment’s runtime directories.

Review details

Suppressed comments (1)

helm/templates/jobs.yaml:118

• The CronJob adds mounts for RT state PVCs, but it still lacks the tmp and mason-data volumes that the main deployment relies on when readOnlyRootFilesystem: true is enabled. Defining these volumes here keeps CronJobs consistent with the Deployment and prevents write attempts to the read-only image filesystem.

            - name: rt-cron
              {{- if $.Values.pvc.cron.enabled }}
              persistentVolumeClaim:
                claimName: {{ include "request-tracker.fullname" $ }}-cron
              {{- else }}
              emptyDir: {}
              {{- end }}

• Files reviewed: 1/1 changed files
• Comments generated: 1
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.