refactor: switch version probe to shell-free clickhouse local execution for distroless compatibility

Author: ashishch432

internal/controller/clickhouse/sync.go

@@ -399,7 +399,6 @@ func (r *clickhouseReconciler) reconcileExternalSecret(ctx context.Context, log
 
 func (r *clickhouseReconciler) reconcileVersionProbe(ctx context.Context, log ctrlutil.Logger) (chctrl.StepResult, error) {
 	probeResult, err := r.VersionProbe(ctx, log, chctrl.VersionProbeConfig{
-		Binary:            "clickhouse-server",
 		Labels:            r.Cluster.Spec.Labels,
 		Annotations:       r.Cluster.Spec.Annotations,
 		PodTemplate:       r.Cluster.Spec.PodTemplate,

internal/controller/keeper/sync.go

@@ -204,7 +204,6 @@ func (r *keeperReconciler) reconcileClusterRevisions(ctx context.Context, log ct
 	}
 
 	probeResult, err := r.VersionProbe(ctx, log, chctrl.VersionProbeConfig{
-		Binary:            "clickhouse-keeper",
 		Labels:            r.Cluster.Spec.Labels,
 		Annotations:       r.Cluster.Spec.Annotations,
 		PodTemplate:       r.Cluster.Spec.PodTemplate,

internal/controller/versionprobe.go

@@ -26,12 +26,12 @@ const (
 	DefaultProbeCPURequest    = "250m"
 	DefaultProbeMemoryLimit   = "1Gi"
 	DefaultProbeMemoryRequest = "256Mi"
+	versionProbeBinary        = "/usr/bin/clickhouse"
+	versionProbeQuery         = "INSERT INTO FUNCTION file('/dev/termination-log', 'RawBLOB', 'version String') SELECT version()"
 )
 
 // VersionProbeConfig holds parameters for the version probe Job.
 type VersionProbeConfig struct {
-	// Name of the binary to run.
-	Binary string
 	// Labels to apply to the Job, inherited from the cluster spec.
 	Labels map[string]string
 	// Annotations to apply to the Job, inherited from the cluster spec.
@@ -250,7 +250,13 @@ func imageRevision(cfg VersionProbeConfig) (string, error) {
 	return hash, nil
 }
 
+func versionProbeCommand() ([]string, []string) {
+	return []string{versionProbeBinary}, []string{"local", "--query", versionProbeQuery}
+}
+
 func (rm *ResourceManager) buildVersionProbeJob(cfg VersionProbeConfig, revision string) (batchv1.Job, error) {
+	command, args := versionProbeCommand()
+
 	job := batchv1.Job{
 		ObjectMeta: metav1.ObjectMeta{
 			Namespace:   rm.owner.GetNamespace(),
@@ -280,7 +286,8 @@ func (rm *ResourceManager) buildVersionProbeJob(cfg VersionProbeConfig, revision
 							SecurityContext:          DefaultContainerSecurityContext(),
 							TerminationMessagePolicy: corev1.TerminationMessageReadFile,
 							TerminationMessagePath:   corev1.TerminationMessagePathDefault,
-							Command:                  []string{"sh", "-c", fmt.Sprintf("%s --version > %s 2>&1", cfg.Binary, corev1.TerminationMessagePathDefault)},
+							Command:                  command,
+							Args:                     args,
 							Resources: corev1.ResourceRequirements{
 								Requests: corev1.ResourceList{
 									corev1.ResourceCPU:    resource.MustParse(DefaultProbeCPURequest),

internal/controller/versionprobe_test.go

@@ -54,7 +54,8 @@ func baseJob() batchv1.Job {
 						{
 							Name:    v1.VersionProbeContainerName,
 							Image:   "clickhouse/clickhouse-server:latest",
-							Command: []string{"sh", "-c", "clickhouse-server --version"},
+							Command: []string{versionProbeBinary},
+							Args:    []string{"local", "--query", versionProbeQuery},
 							SecurityContext: &corev1.SecurityContext{
 								RunAsNonRoot: new(true),
 							},
@@ -189,7 +190,8 @@ var _ = Describe("patchResource with jobSchema (version probe overrides)", func(
 
 		By("verifying container command is preserved")
 		Expect(container.Image).To(Equal("clickhouse/clickhouse-server:latest"))
-		Expect(container.Command).To(Equal([]string{"sh", "-c", "clickhouse-server --version"}))
+		Expect(container.Command).To(Equal([]string{versionProbeBinary}))
+		Expect(container.Args).To(Equal([]string{"local", "--query", versionProbeQuery}))
 	})
 
 	It("should deep-merge securityContext via SMP", func() {
@@ -311,7 +313,6 @@ func (f *fakeController) GetRecorder() events.EventRecorder { return f.recorder
 // probeCfg returns a VersionProbeConfig with the given image and cache values.
 func probeCfg(image, cachedVersion, cachedRevision string) VersionProbeConfig {
 	return VersionProbeConfig{
-		Binary: "clickhouse-server",
 		ContainerTemplate: v1.ContainerTemplateSpec{
 			Image: v1.ContainerImage{Repository: image, Tag: "latest"},
 		},
@@ -320,6 +321,27 @@ func probeCfg(image, cachedVersion, cachedRevision string) VersionProbeConfig {
 	}
 }
 
+var _ = Describe("buildVersionProbeJob", func() {
+	It("should use a shell-free ClickHouse local command for distroless images", func() {
+		rm, _ := setupProbeTest()
+		cfg := probeCfg("clickhouse/clickhouse-server", "", "")
+
+		revision, err := imageRevision(cfg)
+		Expect(err).NotTo(HaveOccurred())
+
+		job, err := rm.buildVersionProbeJob(cfg, revision)
+		Expect(err).NotTo(HaveOccurred())
+
+		container := job.Spec.Template.Spec.Containers[0]
+
+		Expect(container.Command).To(Equal([]string{versionProbeBinary}))
+		Expect(container.Args).To(Equal([]string{"local", "--query", versionProbeQuery}))
+		Expect(versionProbeQuery).To(ContainSubstring(corev1.TerminationMessagePathDefault))
+		Expect(container.TerminationMessagePath).To(Equal(corev1.TerminationMessagePathDefault))
+		Expect(container.TerminationMessagePolicy).To(Equal(corev1.TerminationMessageReadFile))
+	})
+})
+
 var _ = Describe("VersionProbe caching", func() {
 	It("should return cached version on cache hit without creating a Job", func(ctx context.Context) {
 		rm, log := setupProbeTest()