feat(helm): upgrade hook to handle immutable changes with 3.20.0

deploy/charts/x509-certificate-exporter/templates/_capabilities.tpl

@@ -1,5 +1,9 @@
 {{- define "capabilities.kubeVersion" -}}
-{{- default .Capabilities.KubeVersion.Version .Values.kubeVersion -}}
+{{- if .Values.kubeVersion -}}
+{{- .Values.kubeVersion | regexFind "v[0-9]+\\.[0-9]+\\.[0-9]+" -}}
+{{- else -}}
+{{- .Capabilities.KubeVersion.Version | regexFind "v[0-9]+\\.[0-9]+\\.[0-9]+" -}}
+{{- end -}}
 {{- end -}}
 
 {{- define "capabilities.deployment.apiVersion" -}}

deploy/charts/x509-certificate-exporter/templates/_helpers.tpl

@@ -173,3 +173,17 @@ Web configuration Secret name
 {{- define "x509-certificate-exporter.webConfigurationSecretName" -}}
 {{ include "x509-certificate-exporter.fullname" . }}-webconf
 {{- end -}}
+
+{{/*
+kubectl image for hook jobs (digest > explicit tag > auto-detected cluster version)
+*/}}
+{{- define "migration.kubectlImage" -}}
+{{- if .Values.migration.image.digest -}}
+{{ .Values.migration.image.repository }}@{{ .Values.migration.image.digest }}
+{{- else if .Values.migration.image.tag -}}
+{{ .Values.migration.image.repository }}:{{ .Values.migration.image.tag }}
+{{- else -}}
+{{ .Values.migration.image.repository }}:{{ template "capabilities.kubeVersion" . }}
+{{- end -}}
+{{- end -}}
+

deploy/charts/x509-certificate-exporter/templates/migrations/pre-upgrade-3-20-0.yaml

@@ -0,0 +1,123 @@
+{{- $needsMigration := false }}
+{{- if .Release.IsUpgrade }}
+  {{- $ns := include "x509-certificate-exporter.namespace" . }}
+  {{- $existingResource := lookup "apps/v1" "Deployment" $ns (include "x509-certificate-exporter.secretsExporterName" .) }}
+  {{- if not $existingResource }}
+    {{- range $name, $_ := .Values.hostPathsExporter.daemonSets }}
+      {{- if not $existingResource }}
+        {{- $dsName := printf "%s-%s" (include "x509-certificate-exporter.fullname" $) $name }}
+        {{- $existingResource = lookup "apps/v1" "DaemonSet" $ns $dsName }}
+      {{- end }}
+    {{- end }}
+  {{- end }}
+  {{- if $existingResource }}
+    {{- $chartLabel := index $existingResource.metadata.labels "helm.sh/chart" }}
+    {{- if $chartLabel }}
+      {{- $prevVersion := trimPrefix "x509-certificate-exporter-" $chartLabel }}
+      {{- if semverCompare "<3.20.0" $prevVersion }}
+        {{- $needsMigration = true }}
+      {{- end }}
+    {{- end }}
+  {{- end }}
+{{- end }}
+{{- if $needsMigration }}
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ include "x509-certificate-exporter.fullname" . }}-pre-upgrade
+  namespace: {{ include "x509-certificate-exporter.namespace" . }}
+  labels:
+    {{- include "x509-certificate-exporter.labels" . | nindent 4 }}
+  annotations:
+    helm.sh/hook: pre-upgrade
+    helm.sh/hook-weight: "-5"
+    helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: {{ include "x509-certificate-exporter.fullname" . }}-pre-upgrade
+  namespace: {{ include "x509-certificate-exporter.namespace" . }}
+  labels:
+    {{- include "x509-certificate-exporter.labels" . | nindent 4 }}
+  annotations:
+    helm.sh/hook: pre-upgrade
+    helm.sh/hook-weight: "-5"
+    helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
+rules:
+- apiGroups: ["apps"]
+  resources: ["daemonsets", "deployments"]
+  verbs: ["get", "list", "delete"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{ include "x509-certificate-exporter.fullname" . }}-pre-upgrade
+  namespace: {{ include "x509-certificate-exporter.namespace" . }}
+  labels:
+    {{- include "x509-certificate-exporter.labels" . | nindent 4 }}
+  annotations:
+    helm.sh/hook: pre-upgrade
+    helm.sh/hook-weight: "-5"
+    helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: {{ include "x509-certificate-exporter.fullname" . }}-pre-upgrade
+subjects:
+- kind: ServiceAccount
+  name: {{ include "x509-certificate-exporter.fullname" . }}-pre-upgrade
+  namespace: {{ include "x509-certificate-exporter.namespace" . }}
+---
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: {{ include "x509-certificate-exporter.fullname" . }}-pre-upgrade
+  namespace: {{ include "x509-certificate-exporter.namespace" . }}
+  labels:
+    {{- include "x509-certificate-exporter.labels" . | nindent 4 }}
+  annotations:
+    helm.sh/hook: pre-upgrade
+    helm.sh/hook-weight: "0"
+    helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
+spec:
+  template:
+    metadata:
+      {{- with .Values.migration.annotations }}
+      annotations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.migration.extraLabels }}
+      labels:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+    spec:
+      serviceAccountName: {{ include "x509-certificate-exporter.fullname" . }}-pre-upgrade
+      restartPolicy: OnFailure
+      {{- with .Values.migration.podSecurityContext }}
+      securityContext:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      containers:
+      - name: kubectl
+        image: {{ include "migration.kubectlImage" . | quote }}
+        {{- with .Values.migration.securityContext }}
+        securityContext:
+          {{- toYaml . | nindent 10 }}
+        {{- end }}
+        {{- with .Values.migration.resources }}
+        resources:
+          {{- toYaml . | nindent 10 }}
+        {{- end }}
+        command:
+        - kubectl
+        - delete
+        - --ignore-not-found=true
+        - -n
+        - {{ include "x509-certificate-exporter.namespace" . }}
+        - deployment/{{ include "x509-certificate-exporter.secretsExporterName" . }}
+        {{- range $name, $_ := .Values.hostPathsExporter.daemonSets }}
+        - daemonset/{{ printf "%s-%s" (include "x509-certificate-exporter.fullname" $) $name }}
+        {{- end }}
+{{- end }}

deploy/charts/x509-certificate-exporter/values.yaml

@@ -36,7 +36,42 @@ image:
   # -- x509-certificate-exporter image pull policy
   pullPolicy: IfNotPresent
 
-# -- Enable additional metrics to report per-certificate errors ; helps with identifying read errors origin not having to look at exporter logs, at the expense of additional storage on Prometheus
+migration:
+  image:
+    # -- kubectl image repository for Helm hook Jobs
+    repository: registry.k8s.io/kubectl
+    # -- kubectl image tag. If set, takes precedence over auto-detected cluster version.
+    tag: ""
+    # -- kubectl image digest. If set, takes precedence over tag and auto-detected cluster version.
+    digest: ""
+  # -- Annotations added to Helm hook Pods
+  annotations: {}
+  # -- Additional labels added to Helm hook Pods
+  extraLabels: {}
+  # -- ResourceRequirements for containers of Helm hooks
+  # @default -- see `values.yaml`
+  resources:
+    limits:
+      cpu: 1
+      memory: 150Mi
+    requests:
+      cpu: 20m
+      memory: 20Mi
+  # -- PodSecurityContext for Pods of Helm hooks
+  # @default -- see `values.yaml`
+  podSecurityContext:
+    runAsNonRoot: true
+  # -- SecurityContext for containers of Helm hooks
+  # @default -- see `values.yaml`
+  securityContext:
+    runAsUser: 65534
+    runAsGroup: 65534
+    readOnlyRootFilesystem: true
+    capabilities:
+      drop:
+      - ALL
+
+# -- Enable additional metrics to report per-certificate errors ; helps with identifying the origin of read errors without having to look at exporter logs, at the expense of additional storage on Prometheus
 exposePerCertificateErrorMetrics: false
 
 # -- Enable additional metrics with relative durations instead of absolute timestamps ; not recommended with Prometheus