Skip to content

Commit 1811157

Browse files
aramasearamase
committed
feat: add keep-crd upgrade hook
The crds have been moved from the templates/ to crds/ folder. When helm upgrade is run, helm will delete the crds because they're no longer in the generated template. To prevent deletion, we patch the 2 CRDs with the "helm.sh/resource-policy": "keep". Helm will skip deletion of resources with these annotation. Also, converted the hooks to a job as helm kills the pod before kubectl exec is run. With job, helm waits until the pod is run and reaches completion. Signed-off-by: Anish Ramasekar <anish.ramasekar@gmail.com>
1 parent 544a0f9 commit 1811157

File tree

3 files changed

+109
-24
lines changed

3 files changed

+109
-24
lines changed

‎manifest_staging/charts/secrets-store-csi-driver/templates/crds-upgrade-hook.yaml

Lines changed: 29 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,8 @@ metadata:
55
{{ include "sscd.labels" . | indent 2 }}
66
annotations:
77
helm.sh/hook: pre-install,pre-upgrade
8-
helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
8+
helm.sh/hook-delete-policy: "hook-succeeded,before-hook-creation"
9+
helm.sh/hook-weight: "1"
910
rules:
1011
- apiGroups: ["apiextensions.k8s.io"]
1112
resources: ["customresourcedefinitions"]
@@ -18,7 +19,8 @@ metadata:
1819
{{ include "sscd.labels" . | indent 2 }}
1920
annotations:
2021
helm.sh/hook: pre-install,pre-upgrade
21-
helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
22+
helm.sh/hook-delete-policy: "hook-succeeded,before-hook-creation"
23+
helm.sh/hook-weight: "1"
2224
subjects:
2325
- kind: ServiceAccount
2426
name: {{ template "sscd.fullname" . }}-upgrade-crds
@@ -36,31 +38,34 @@ metadata:
3638
{{ include "sscd.labels" . | indent 2 }}
3739
annotations:
3840
helm.sh/hook: pre-install,pre-upgrade
39-
helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
41+
helm.sh/hook-delete-policy: "hook-succeeded,before-hook-creation"
42+
helm.sh/hook-weight: "1"
4043
---
41-
apiVersion: v1
42-
kind: Pod
44+
apiVersion: batch/v1
45+
kind: Job
4346
metadata:
4447
name: {{ template "sscd.fullname" . }}-upgrade-crds
4548
namespace: {{ .Release.Namespace }}
46-
annotations:
47-
helm.sh/hook: pre-install,pre-upgrade
48-
helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
4949
{{ include "sscd.labels" . | indent 2 }}
50+
annotations:
51+
helm.sh/hook: pre-upgrade
52+
helm.sh/hook-weight: "1"
53+
helm.sh/hook-delete-policy: "hook-succeeded,before-hook-creation"
5054
spec:
51-
serviceAccountName: {{ template "sscd.fullname" . }}-upgrade-crds
52-
restartPolicy: OnFailure
53-
containers:
54-
- name: crds-upgrade
55-
image: "{{ .Values.linux.crds.image.repository }}:{{ .Values.linux.crds.image.tag }}"
56-
args:
57-
- apply
58-
- -f
59-
- crds/
60-
imagePullPolicy: {{ .Values.linux.crds.image.pullPolicy }}
61-
{{- if .Values.imagePullSecrets }}
62-
imagePullSecrets:
63-
{{ toYaml .Values.imagePullSecrets | indent 4 }}
64-
{{- end }}
65-
nodeSelector:
66-
kubernetes.io/os: linux
55+
backoffLimit: 0
56+
template:
57+
metadata:
58+
name: {{ template "sscd.fullname" . }}-upgrade-crds
59+
spec:
60+
serviceAccountName: {{ template "sscd.fullname" . }}-upgrade-crds
61+
restartPolicy: Never
62+
containers:
63+
- name: crds-upgrade
64+
image: "{{ .Values.linux.crds.image.repository }}:{{ .Values.linux.crds.image.tag }}"
65+
args:
66+
- apply
67+
- -f
68+
- crds/
69+
imagePullPolicy: {{ .Values.linux.crds.image.pullPolicy }}
70+
nodeSelector:
71+
kubernetes.io/os: linux

‎manifest_staging/charts/secrets-store-csi-driver/templates/keep-crds-upgrade-hook.yaml

Lines changed: 74 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,74 @@
1+
apiVersion: rbac.authorization.k8s.io/v1
2+
kind: ClusterRole
3+
metadata:
4+
name: {{ template "sscd.fullname" . }}-keep-crds
5+
{{ include "sscd.labels" . | indent 2 }}
6+
annotations:
7+
helm.sh/hook: pre-upgrade
8+
helm.sh/hook-delete-policy: "hook-succeeded,before-hook-creation"
9+
helm.sh/hook-weight: "2"
10+
rules:
11+
- apiGroups: ["apiextensions.k8s.io"]
12+
resources: ["customresourcedefinitions"]
13+
verbs: ["get", "patch"]
14+
---
15+
apiVersion: rbac.authorization.k8s.io/v1
16+
kind: ClusterRoleBinding
17+
metadata:
18+
name: {{ template "sscd.fullname" . }}-keep-crds
19+
{{ include "sscd.labels" . | indent 2 }}
20+
annotations:
21+
helm.sh/hook: pre-upgrade
22+
helm.sh/hook-delete-policy: "hook-succeeded,before-hook-creation"
23+
helm.sh/hook-weight: "2"
24+
subjects:
25+
- kind: ServiceAccount
26+
name: {{ template "sscd.fullname" . }}-keep-crds
27+
namespace: {{ .Release.Namespace }}
28+
roleRef:
29+
kind: ClusterRole
30+
name: {{ template "sscd.fullname" . }}-keep-crds
31+
apiGroup: rbac.authorization.k8s.io
32+
---
33+
apiVersion: v1
34+
kind: ServiceAccount
35+
metadata:
36+
name: {{ template "sscd.fullname" . }}-keep-crds
37+
namespace: {{ .Release.Namespace }}
38+
{{ include "sscd.labels" . | indent 2 }}
39+
annotations:
40+
helm.sh/hook: pre-upgrade
41+
helm.sh/hook-delete-policy: "hook-succeeded,before-hook-creation"
42+
helm.sh/hook-weight: "2"
43+
---
44+
apiVersion: batch/v1
45+
kind: Job
46+
metadata:
47+
name: {{ template "sscd.fullname" . }}-keep-crds
48+
namespace: {{ .Release.Namespace }}
49+
{{ include "sscd.labels" . | indent 2 }}
50+
annotations:
51+
helm.sh/hook: pre-upgrade
52+
helm.sh/hook-weight: "2"
53+
helm.sh/hook-delete-policy: "hook-succeeded,before-hook-creation"
54+
spec:
55+
backoffLimit: 0
56+
template:
57+
metadata:
58+
name: {{ template "sscd.fullname" . }}-keep-crds
59+
spec:
60+
serviceAccountName: {{ template "sscd.fullname" . }}-keep-crds
61+
restartPolicy: Never
62+
containers:
63+
- name: crds-keep
64+
image: "{{ .Values.linux.crds.image.repository }}:{{ .Values.linux.crds.image.tag }}"
65+
args:
66+
- patch
67+
- crd
68+
- secretproviderclasses.secrets-store.csi.x-k8s.io
69+
- secretproviderclasspodstatuses.secrets-store.csi.x-k8s.io
70+
- -p
71+
- '{"metadata":{"annotations": {"helm.sh/resource-policy": "keep"}}}'
72+
imagePullPolicy: {{ .Values.linux.crds.image.pullPolicy }}
73+
nodeSelector:
74+
kubernetes.io/os: linux

‎test/bats/azure.bats

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -403,6 +403,12 @@ setup() {
403403
run helm upgrade csi-secrets-store "${chart_dir}" --reuse-values --set filteredWatchSecret=false --wait --timeout=5m -v=5 --debug --namespace kube-system
404404
assert_success
405405

406+
cmd="kubectl get crd secretproviderclasses.secrets-store.csi.x-k8s.io -o yaml | grep 'helm.sh/resource-policy: keep'"
407+
wait_for_process $WAIT_TIME $SLEEP_TIME "$cmd"
408+
409+
cmd="kubectl get crd secretproviderclasspodstatuses.secrets-store.csi.x-k8s.io -o yaml | grep 'helm.sh/resource-policy: keep'"
410+
wait_for_process $WAIT_TIME $SLEEP_TIME "$cmd"
411+
406412
kubectl create ns non-filtered-watch
407413
kubectl create secret generic secrets-store-creds --from-literal clientid=${AZURE_CLIENT_ID} --from-literal clientsecret=${AZURE_CLIENT_SECRET} -n non-filtered-watch
408414

0 commit comments

Comments
 (0)