fixing approach

vshn · Jan 18, 2024 · 37b4f81 · 37b4f81
1 parent a53be1c
commit 37b4f81
Show file tree

Hide file tree

Showing 9 changed files with 48 additions and 24 deletions.
diff --git a/class/defaults.yml b/class/defaults.yml
@@ -7,7 +7,7 @@ parameters:
     namespaceAnnotations: {}
 
     charts:
-      stackgres-operator:
+      stackgres_operator:
         source: "https://stackgres.io/downloads/stackgres-k8s/stackgres/helm/"
         version: "1.7.0"
     kubernetesVersion: "${dynamic_facts:kubernetesVersion:major}.${dynamic_facts:kubernetesVersion:minor}"

diff --git a/class/stackgres-operator.yml b/class/stackgres-operator.yml
@@ -2,9 +2,9 @@ parameters:
   kapitan:
     dependencies:
       - type: helm
-        output_path: dependencies/stackgres-operator/helmcharts/stackgres-operator/${stackgres_operator:charts:stackgres-operator:version}
-        source: ${stackgres_operator:charts:stackgres-operator:source}
-        version: ${stackgres_operator:charts:stackgres-operator:version}
+        output_path: dependencies/stackgres-operator/helmcharts/stackgres-operator/${stackgres_operator:charts:stackgres_operator:version}
+        source: ${stackgres_operator:charts:stackgres_operator:source}
+        version: ${stackgres_operator:charts:stackgres_operator:version}
         chart_name: stackgres-operator
     compile:
       - input_paths:
@@ -20,7 +20,7 @@ parameters:
       - output_path: stackgres-operator/01_helmchart
         input_type: helm
         input_paths:
-          - dependencies/stackgres-operator/helmcharts/stackgres-operator/${stackgres_operator:charts:stackgres-operator:version}/
+          - dependencies/stackgres-operator/helmcharts/stackgres-operator/${stackgres_operator:charts:stackgres_operator:version}/
         helm_values: ${stackgres_operator:helmValues}
         helm_params:
           name: stackgres-operator

diff --git a/component/main.jsonnet b/component/main.jsonnet
@@ -59,6 +59,7 @@ local setRestAPIPwJob = kube.Job('stackgres-restapi-set-password') {
     namespace: params.namespace,
   },
   spec+: {
+    ttlSecondsAfterFinished: 5,
     template: {
       metadata: {
         labels: commonLabels,

diff --git a/component/pre.jsonnet b/component/pre.jsonnet
@@ -20,6 +20,7 @@ local job = kube.Job('') {
     },
   },
   spec: {
+    ttlSecondsAfterFinished: 5,
     template: {
       spec: {
         containers: [
@@ -35,6 +36,10 @@ local job = kube.Job('') {
                 name: 'NAMESPACE',
                 value: params.namespace,
               },
+              {
+                name: 'VERSION',
+                value: params.charts.stackgres_operator.version,
+              },
             ],
             image: params.images.registry + '/appuio/oc:v4.14',
             name: 'kubectl',

diff --git a/component/scripts/preCleanCerts.sh b/component/scripts/preCleanCerts.sh
@@ -1,13 +1,14 @@
 #!/bin/bash
 
+
 kubectl delete --ignore-not-found=true clusterrolebindings.rbac.authorization.k8s.io stackgres-operator-init
+# deleting webhook because they use legacy certs
+kubectl delete mutatingwebhookconfigurations.admissionregistration.k8s.io stackgres-operator
 
+kubectl delete validatingwebhookconfigurations.admissionregistration.k8s.io stackgres-operator
 kubectl -n "$NAMESPACE" delete --ignore-not-found=true certs --all
-
 kubectl -n "$NAMESPACE" delete --ignore-not-found=true secrets stackgres-operator-certs stackgres-operator-web-certs
-
 kubectl -n "$NAMESPACE" delete --ignore-not-found=true issuers.cert-manager.io stackgres-operator-ca-issuer stackgres-operator-self-signed-issuer
-
+# at this point we need to reload our deployments 
 kubectl -n "$NAMESPACE" rollout restart deployment stackgres-operator
-
 kubectl -n "$NAMESPACE" rollout restart deployment stackgres-restapi
diff --git a/component/scriptsPermissions.jsonnet b/component/scriptsPermissions.jsonnet
@@ -32,6 +32,11 @@ local clusterRole = kube.ClusterRole(rolename) {
       resources: [ 'clusterrolebindings' ],
       verbs: [ 'delete', 'get', 'list', 'watch' ],
     },
+    {
+      apiGroups: [ 'admissionregistration.k8s.io' ],
+      resources: [ 'mutatingwebhookconfigurations', 'validatingwebhookconfigurations' ],
+      verbs: [ 'delete', 'get', 'list', 'watch' ],
+    },
   ],
 };
 
@@ -49,7 +54,7 @@ local role = kube.Role(rolename) {
     },
     {
       apiGroups: [ 'apps' ],
-      resources: [ 'deployments', "replicasets", "pods" ],
+      resources: [ 'deployments', 'replicasets', 'pods' ],
       verbs: [ 'get', 'list', 'watch', 'create', 'update', 'patch', 'delete' ],
     },
     {

diff --git a/tests/golden/defaults/stackgres-operator/stackgres-operator/01_clusterRole.yaml b/tests/golden/defaults/stackgres-operator/stackgres-operator/01_clusterRole.yaml
@@ -16,3 +16,13 @@ rules:
       - get
       - list
       - watch
+  - apiGroups:
+      - admissionregistration.k8s.io
+    resources:
+      - mutatingwebhookconfigurations
+      - validatingwebhookconfigurations
+    verbs:
+      - delete
+      - get
+      - list
+      - watch
diff --git a/tests/golden/defaults/stackgres-operator/stackgres-operator/02_CleanCertsJobName.yaml b/tests/golden/defaults/stackgres-operator/stackgres-operator/02_CleanCertsJobName.yaml
@@ -12,24 +12,25 @@ spec:
           command:
             - /bin/bash
             - -cex
-            - |
-              #!/bin/bash
-
-              kubectl delete --ignore-not-found=true clusterrolebindings.rbac.authorization.k8s.io stackgres-operator-init
-
-              kubectl -n "$NAMESPACE" delete --ignore-not-found=true certs --all
-
-              kubectl -n "$NAMESPACE" delete --ignore-not-found=true secrets stackgres-operator-certs stackgres-operator-web-certs
-
-              kubectl -n "$NAMESPACE" delete --ignore-not-found=true issuers.cert-manager.io stackgres-operator-ca-issuer stackgres-operator-self-signed-issuer
-
-              kubectl -n "$NAMESPACE" rollout restart deployment stackgres-operator
-
-              kubectl -n "$NAMESPACE" rollout restart deployment stackgres-restapi
+            - "#!/bin/bash\n\n\nkubectl delete --ignore-not-found=true clusterrolebindings.rbac.authorization.k8s.io\
+              \ stackgres-operator-init\n# deleting webhook because they use legacy\
+              \ certs\nkubectl delete mutatingwebhookconfigurations.admissionregistration.k8s.io\
+              \ stackgres-operator\n\nkubectl delete validatingwebhookconfigurations.admissionregistration.k8s.io\
+              \ stackgres-operator\nkubectl -n \"$NAMESPACE\" delete --ignore-not-found=true\
+              \ certs --all\nkubectl -n \"$NAMESPACE\" delete --ignore-not-found=true\
+              \ secrets stackgres-operator-certs stackgres-operator-web-certs\nkubectl\
+              \ -n \"$NAMESPACE\" delete --ignore-not-found=true issuers.cert-manager.io\
+              \ stackgres-operator-ca-issuer stackgres-operator-self-signed-issuer\n\
+              # at this point we need to reload our deployments \nkubectl -n \"$NAMESPACE\"\
+              \ rollout restart deployment stackgres-operator\nkubectl -n \"$NAMESPACE\"\
+              \ rollout restart deployment stackgres-restapi\n"
           env:
             - name: NAMESPACE
               value: syn-stackgres-operator
+            - name: VERSION
+              value: 1.7.0
           image: quay.io/appuio/oc:v4.14
           name: kubectl
       restartPolicy: OnFailure
       serviceAccountName: stackgres-init-additional-permissions
+  ttlSecondsAfterFinished: 5
diff --git a/tests/golden/defaults/stackgres-operator/stackgres-operator/02_set_restAPI_password_job.yaml b/tests/golden/defaults/stackgres-operator/stackgres-operator/02_set_restAPI_password_job.yaml
@@ -56,3 +56,4 @@ spec:
           volumeMounts: []
       restartPolicy: OnFailure
       serviceAccountName: stackgres-operator-init
+  ttlSecondsAfterFinished: 5