From cd96e4d7bd83e1859e74b304fe9d51efbefdb09e Mon Sep 17 00:00:00 2001
From: wbsong111 <wbsong@paasup.io>
Date: Thu, 19 Dec 2024 15:23:07 +0900
Subject: [PATCH] Add postdeleteHook to rancher chart

---
 .../postdeleteHook/cleanup-tls-ca-job.yaml    | 41 +++++++++++++++++++
 .../templates/postdeleteHook/role.yaml        | 18 ++++++++
 .../templates/postdeleteHook/rolebinding.yaml | 18 ++++++++
 .../postdeleteHook/serviceaccount.yaml        | 11 +++++
 4 files changed, 88 insertions(+)
 create mode 100644 charts/rancher/templates/postdeleteHook/cleanup-tls-ca-job.yaml
 create mode 100644 charts/rancher/templates/postdeleteHook/role.yaml
 create mode 100644 charts/rancher/templates/postdeleteHook/rolebinding.yaml
 create mode 100644 charts/rancher/templates/postdeleteHook/serviceaccount.yaml

diff --git a/charts/rancher/templates/postdeleteHook/cleanup-tls-ca-job.yaml b/charts/rancher/templates/postdeleteHook/cleanup-tls-ca-job.yaml
new file mode 100644
index 0000000..1d4cd48
--- /dev/null
+++ b/charts/rancher/templates/postdeleteHook/cleanup-tls-ca-job.yaml
@@ -0,0 +1,41 @@
+{{- if .Values.preinstallHook }}
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: {{ template "rancher.fullname" . }}-cleanup-tls-ca-job
+  namespace: {{ .Release.Namespace }}
+  labels: {{ include "rancher.labels" . | nindent 4 }}
+  annotations:
+    "helm.sh/hook": post-delete
+    "helm.sh/hook-weight": "3"
+    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
+spec:
+  backoffLimit: 3
+  template:
+    metadata:
+      name: {{ template "rancher.fullname" . }}-cleanup-tls-ca
+      labels: {{ include "rancher.labels" . | nindent 8 }}
+    spec:
+      serviceAccountName: {{ template "rancher.fullname" . }}-cleanup-tls-ca-sa
+      restartPolicy: OnFailure
+      containers:
+        - name: {{ template "rancher.name" . }}-cleanup-tls-ca
+          image: "{{ include "system_default_registry" . }}{{ .Values.postDelete.image.repository }}:{{ .Values.postDelete.image.tag }}"
+          imagePullPolicy: IfNotPresent
+          securityContext:
+            runAsUser: 0
+          command:
+            - /bin/sh
+            - -c
+            - |
+              #!/bin/bash
+              kd () {
+                if [ $(kubectl get $@ --ignore-not-found | wc -l) -eq 2 ];then
+                  echo [INFO] delete $@
+                  kubectl delete $@
+                fi
+              }
+              kd secret tls-ca -n {{ .Release.Namespace }}
+              kd certificate {{ .Values.ingress.tls.secretName }} -n {{ .Release.Namespace }}
+              kd secret {{ .Values.ingress.tls.secretName }} -n {{ .Release.Namespace }}
+{{- end }}
\ No newline at end of file
diff --git a/charts/rancher/templates/postdeleteHook/role.yaml b/charts/rancher/templates/postdeleteHook/role.yaml
new file mode 100644
index 0000000..ba59f56
--- /dev/null
+++ b/charts/rancher/templates/postdeleteHook/role.yaml
@@ -0,0 +1,18 @@
+{{- if .Values.preinstallHook }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: {{ template "rancher.fullname" . }}-cleanup-tls-ca-role
+  labels: {{ include "rancher.labels" . | nindent 4 }}
+  annotations:
+    "helm.sh/hook": post-delete
+    "helm.sh/hook-weight": "1"
+    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded,hook-failed
+rules:
+  - apiGroups: [""]
+    resources: ["secrets"]
+    verbs: ["get", "list", "delete"]
+  - apiGroups: ["cert-manager.io"]
+    resources: ["certificates"]
+    verbs: ["get", "list", "delete"]
+{{- end }} 
diff --git a/charts/rancher/templates/postdeleteHook/rolebinding.yaml b/charts/rancher/templates/postdeleteHook/rolebinding.yaml
new file mode 100644
index 0000000..f2eee73
--- /dev/null
+++ b/charts/rancher/templates/postdeleteHook/rolebinding.yaml
@@ -0,0 +1,18 @@
+{{- if .Values.preinstallHook }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{ template "rancher.fullname" . }}-cleanup-tls-ca-rolebinding
+  labels: {{ include "rancher.labels" . | nindent 4 }}
+  annotations:
+    "helm.sh/hook": post-delete
+    "helm.sh/hook-weight": "2"
+    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded,hook-failed
+subjects:
+  - kind: ServiceAccount
+    name: {{ template "rancher.fullname" . }}-cleanup-tls-ca-sa
+    namespace: {{ .Release.Namespace }}
+roleRef:
+  kind: Role
+  name: {{ template "rancher.fullname" . }}-cleanup-tls-ca-role
+{{- end }} 
diff --git a/charts/rancher/templates/postdeleteHook/serviceaccount.yaml b/charts/rancher/templates/postdeleteHook/serviceaccount.yaml
new file mode 100644
index 0000000..2742073
--- /dev/null
+++ b/charts/rancher/templates/postdeleteHook/serviceaccount.yaml
@@ -0,0 +1,11 @@
+{{- if .Values.preinstallHook }}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ template "rancher.fullname" . }}-cleanup-tls-ca-sa
+  labels: {{ include "rancher.labels" . | nindent 4 }}
+  annotations:
+    "helm.sh/hook": post-delete
+    "helm.sh/hook-weight": "1"
+    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded,hook-failed
+{{- end }}