From ae4e119ce28a642cd33466c51ea43cd1fbec1a44 Mon Sep 17 00:00:00 2001
From: alwinmarkcf <36843382+alwinmarkcf@users.noreply.github.com>
Date: Mon, 14 Jan 2019 15:22:59 +0100
Subject: [PATCH] Stable traefik fix kv upgrade (#9808)

* [stable/traefik] Fixes helm upgrades for kv providers

This will run the storeconfig job also on upgrades but without the `traefikConfiguration.GlobalConfiguration.ACME.OverrideCertificates=true` parameter, so the configuration gets updated but the certs are left alone.

It's still possible to override the certificates by importing an
`acme.json` file and using the `kvprovider.importAcme=true` parameter.

Fixes: #7172

Signed-off-by: Alwin Mark <a.mark@crowdfox.com>

* [stable/traefik] Don't delete storeconfig job

Rather add revision to the job to make it unique, so its possible to get
logs from it, even if it succeeded

Signed-off-by: Alwin Mark <a.mark@crowdfox.com>
---
 stable/traefik/Chart.yaml                     | 2 +-
 stable/traefik/templates/configmap.yaml       | 3 +++
 stable/traefik/templates/storeconfig-job.yaml | 7 +++----
 stable/traefik/values.yaml                    | 6 ++++--
 4 files changed, 11 insertions(+), 7 deletions(-)

diff --git a/stable/traefik/Chart.yaml b/stable/traefik/Chart.yaml
index e8d205cf01..9cc79136ee 100755
--- a/stable/traefik/Chart.yaml
+++ b/stable/traefik/Chart.yaml
@@ -1,6 +1,6 @@
 apiVersion: v1
 name: traefik
-version: 1.57.1
+version: 1.58.0
 appVersion: 1.7.6
 description: A Traefik based Kubernetes ingress controller with Let's Encrypt support
 keywords:
diff --git a/stable/traefik/templates/configmap.yaml b/stable/traefik/templates/configmap.yaml
index 7c1ac6e159..4a8d03bf25 100644
--- a/stable/traefik/templates/configmap.yaml
+++ b/stable/traefik/templates/configmap.yaml
@@ -235,6 +235,9 @@ data:
     {{- if .Values.kvprovider.importAcme }}
     storageFile = "/acme/acme.json"
     {{- end }}
+    {{- if or (.Values.kvprovider.importAcme) (eq .Release.Revision 1) }}
+    OverrideCertificates = true
+    {{- end }}
     {{- else }}
     storage = "/acme/acme.json"
     {{- end }}
diff --git a/stable/traefik/templates/storeconfig-job.yaml b/stable/traefik/templates/storeconfig-job.yaml
index a373726f50..81d282f626 100644
--- a/stable/traefik/templates/storeconfig-job.yaml
+++ b/stable/traefik/templates/storeconfig-job.yaml
@@ -2,17 +2,16 @@
 apiVersion: batch/v1
 kind: Job
 metadata:
-  name: "storeconfig-job"
+  name: "storeconfig-job-{{ .Release.Revision }}"
   annotations:
-    "helm.sh/hook": post-install
-    "helm.sh/hook-delete-policy": hook-succeeded
+    "helm.sh/hook": post-install,post-upgrade
   labels:
     chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
     app: {{ template "traefik.name" . }}
 spec:
   template:
     metadata: 
-      name: "storeconfig-job"
+      name: "storeconfig-job-{{ .Release.Revision }}"
       labels:
         app: {{ template "traefik.name" . }}
         chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
diff --git a/stable/traefik/values.yaml b/stable/traefik/values.yaml
index b79928b699..b7bff68f3e 100755
--- a/stable/traefik/values.yaml
+++ b/stable/traefik/values.yaml
@@ -246,8 +246,10 @@ acme:
       AWS_SECRET_ACCESS_KEY: ""
     vultr:
       VULTR_API_KEY: ""
-  ## Save ACME certs to a persistent volume. WARNING: If you do not do this, you will re-request
-  ## certs every time a pod (re-)starts and you WILL be rate limited!
+  ## Save ACME certs to a persistent volume.
+  ## WARNING: If you do not do this and you did not have configured
+  ## a kvprovider, you will re-request certs every time a pod (re-)starts
+  ## and you WILL be rate limited!
   persistence:
     enabled: true
     annotations: {}