From 6fe7f4a26da26629ce6fe83dee646d7000fee3d5 Mon Sep 17 00:00:00 2001 From: Thibault VINCENT Date: Fri, 27 Mar 2026 15:28:28 +0100 Subject: [PATCH] feat(helm): upgrade hook to handle immutable changes with 3.20.0 --- .../templates/_capabilities.tpl | 6 +- .../templates/_helpers.tpl | 14 ++ .../migrations/pre-upgrade-3-20-0.yaml | 123 ++++++++++++++++++ .../x509-certificate-exporter/values.yaml | 37 +++++- 4 files changed, 178 insertions(+), 2 deletions(-) create mode 100644 deploy/charts/x509-certificate-exporter/templates/migrations/pre-upgrade-3-20-0.yaml diff --git a/deploy/charts/x509-certificate-exporter/templates/_capabilities.tpl b/deploy/charts/x509-certificate-exporter/templates/_capabilities.tpl index be43d10..3aac98f 100644 --- a/deploy/charts/x509-certificate-exporter/templates/_capabilities.tpl +++ b/deploy/charts/x509-certificate-exporter/templates/_capabilities.tpl @@ -1,5 +1,9 @@ {{- define "capabilities.kubeVersion" -}} -{{- default .Capabilities.KubeVersion.Version .Values.kubeVersion -}} +{{- if .Values.kubeVersion -}} +{{- .Values.kubeVersion | regexFind "v[0-9]+\\.[0-9]+\\.[0-9]+" -}} +{{- else -}} +{{- .Capabilities.KubeVersion.Version | regexFind "v[0-9]+\\.[0-9]+\\.[0-9]+" -}} +{{- end -}} {{- end -}} {{- define "capabilities.deployment.apiVersion" -}} diff --git a/deploy/charts/x509-certificate-exporter/templates/_helpers.tpl b/deploy/charts/x509-certificate-exporter/templates/_helpers.tpl index f4363c4..b7d79b4 100644 --- a/deploy/charts/x509-certificate-exporter/templates/_helpers.tpl +++ b/deploy/charts/x509-certificate-exporter/templates/_helpers.tpl @@ -173,3 +173,17 @@ Web configuration Secret name {{- define "x509-certificate-exporter.webConfigurationSecretName" -}} {{ include "x509-certificate-exporter.fullname" . }}-webconf {{- end -}} + +{{/* +kubectl image for hook jobs (digest > explicit tag > auto-detected cluster version) +*/}} +{{- define "migration.kubectlImage" -}} +{{- if .Values.migration.image.digest -}} +{{ .Values.migration.image.repository }}@{{ .Values.migration.image.digest }} +{{- else if .Values.migration.image.tag -}} +{{ .Values.migration.image.repository }}:{{ .Values.migration.image.tag }} +{{- else -}} +{{ .Values.migration.image.repository }}:{{ template "capabilities.kubeVersion" . }} +{{- end -}} +{{- end -}} + diff --git a/deploy/charts/x509-certificate-exporter/templates/migrations/pre-upgrade-3-20-0.yaml b/deploy/charts/x509-certificate-exporter/templates/migrations/pre-upgrade-3-20-0.yaml new file mode 100644 index 0000000..6700e03 --- /dev/null +++ b/deploy/charts/x509-certificate-exporter/templates/migrations/pre-upgrade-3-20-0.yaml @@ -0,0 +1,123 @@ +{{- $needsMigration := false }} +{{- if .Release.IsUpgrade }} + {{- $ns := include "x509-certificate-exporter.namespace" . }} + {{- $existingResource := lookup "apps/v1" "Deployment" $ns (include "x509-certificate-exporter.secretsExporterName" .) }} + {{- if not $existingResource }} + {{- range $name, $_ := .Values.hostPathsExporter.daemonSets }} + {{- if not $existingResource }} + {{- $dsName := printf "%s-%s" (include "x509-certificate-exporter.fullname" $) $name }} + {{- $existingResource = lookup "apps/v1" "DaemonSet" $ns $dsName }} + {{- end }} + {{- end }} + {{- end }} + {{- if $existingResource }} + {{- $chartLabel := index $existingResource.metadata.labels "helm.sh/chart" }} + {{- if $chartLabel }} + {{- $prevVersion := trimPrefix "x509-certificate-exporter-" $chartLabel }} + {{- if semverCompare "<3.20.0" $prevVersion }} + {{- $needsMigration = true }} + {{- end }} + {{- end }} + {{- end }} +{{- end }} +{{- if $needsMigration }} +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ include "x509-certificate-exporter.fullname" . }}-pre-upgrade + namespace: {{ include "x509-certificate-exporter.namespace" . }} + labels: + {{- include "x509-certificate-exporter.labels" . | nindent 4 }} + annotations: + helm.sh/hook: pre-upgrade + helm.sh/hook-weight: "-5" + helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: {{ include "x509-certificate-exporter.fullname" . }}-pre-upgrade + namespace: {{ include "x509-certificate-exporter.namespace" . }} + labels: + {{- include "x509-certificate-exporter.labels" . | nindent 4 }} + annotations: + helm.sh/hook: pre-upgrade + helm.sh/hook-weight: "-5" + helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded +rules: +- apiGroups: ["apps"] + resources: ["daemonsets", "deployments"] + verbs: ["get", "list", "delete"] +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: {{ include "x509-certificate-exporter.fullname" . }}-pre-upgrade + namespace: {{ include "x509-certificate-exporter.namespace" . }} + labels: + {{- include "x509-certificate-exporter.labels" . | nindent 4 }} + annotations: + helm.sh/hook: pre-upgrade + helm.sh/hook-weight: "-5" + helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: {{ include "x509-certificate-exporter.fullname" . }}-pre-upgrade +subjects: +- kind: ServiceAccount + name: {{ include "x509-certificate-exporter.fullname" . }}-pre-upgrade + namespace: {{ include "x509-certificate-exporter.namespace" . }} +--- +apiVersion: batch/v1 +kind: Job +metadata: + name: {{ include "x509-certificate-exporter.fullname" . }}-pre-upgrade + namespace: {{ include "x509-certificate-exporter.namespace" . }} + labels: + {{- include "x509-certificate-exporter.labels" . | nindent 4 }} + annotations: + helm.sh/hook: pre-upgrade + helm.sh/hook-weight: "0" + helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded +spec: + template: + metadata: + {{- with .Values.migration.annotations }} + annotations: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.migration.extraLabels }} + labels: + {{- toYaml . | nindent 8 }} + {{- end }} + spec: + serviceAccountName: {{ include "x509-certificate-exporter.fullname" . }}-pre-upgrade + restartPolicy: OnFailure + {{- with .Values.migration.podSecurityContext }} + securityContext: + {{- toYaml . | nindent 8 }} + {{- end }} + containers: + - name: kubectl + image: {{ include "migration.kubectlImage" . | quote }} + {{- with .Values.migration.securityContext }} + securityContext: + {{- toYaml . | nindent 10 }} + {{- end }} + {{- with .Values.migration.resources }} + resources: + {{- toYaml . | nindent 10 }} + {{- end }} + command: + - kubectl + - delete + - --ignore-not-found=true + - -n + - {{ include "x509-certificate-exporter.namespace" . }} + - deployment/{{ include "x509-certificate-exporter.secretsExporterName" . }} + {{- range $name, $_ := .Values.hostPathsExporter.daemonSets }} + - daemonset/{{ printf "%s-%s" (include "x509-certificate-exporter.fullname" $) $name }} + {{- end }} +{{- end }} diff --git a/deploy/charts/x509-certificate-exporter/values.yaml b/deploy/charts/x509-certificate-exporter/values.yaml index ed6ee15..59b49f5 100644 --- a/deploy/charts/x509-certificate-exporter/values.yaml +++ b/deploy/charts/x509-certificate-exporter/values.yaml @@ -36,7 +36,42 @@ image: # -- x509-certificate-exporter image pull policy pullPolicy: IfNotPresent -# -- Enable additional metrics to report per-certificate errors ; helps with identifying read errors origin not having to look at exporter logs, at the expense of additional storage on Prometheus +migration: + image: + # -- kubectl image repository for Helm hook Jobs + repository: registry.k8s.io/kubectl + # -- kubectl image tag. If set, takes precedence over auto-detected cluster version. + tag: "" + # -- kubectl image digest. If set, takes precedence over tag and auto-detected cluster version. + digest: "" + # -- Annotations added to Helm hook Pods + annotations: {} + # -- Additional labels added to Helm hook Pods + extraLabels: {} + # -- ResourceRequirements for containers of Helm hooks + # @default -- see `values.yaml` + resources: + limits: + cpu: 1 + memory: 150Mi + requests: + cpu: 20m + memory: 20Mi + # -- PodSecurityContext for Pods of Helm hooks + # @default -- see `values.yaml` + podSecurityContext: + runAsNonRoot: true + # -- SecurityContext for containers of Helm hooks + # @default -- see `values.yaml` + securityContext: + runAsUser: 65534 + runAsGroup: 65534 + readOnlyRootFilesystem: true + capabilities: + drop: + - ALL + +# -- Enable additional metrics to report per-certificate errors ; helps with identifying the origin of read errors without having to look at exporter logs, at the expense of additional storage on Prometheus exposePerCertificateErrorMetrics: false # -- Enable additional metrics with relative durations instead of absolute timestamps ; not recommended with Prometheus