Add postdeleteHook to rancher chart

2024-12-19 15:23:07 +09:00
parent b43b008550
commit cd96e4d7bd
4 changed files with 88 additions and 0 deletions
@@ -0,0 +1,41 @@
+{{- if .Values.preinstallHook }}
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: {{ template "rancher.fullname" . }}-cleanup-tls-ca-job
+  namespace: {{ .Release.Namespace }}
+  labels: {{ include "rancher.labels" . | nindent 4 }}
+  annotations:
+    "helm.sh/hook": post-delete
+    "helm.sh/hook-weight": "3"
+    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
+spec:
+  backoffLimit: 3
+  template:
+    metadata:
+      name: {{ template "rancher.fullname" . }}-cleanup-tls-ca
+      labels: {{ include "rancher.labels" . | nindent 8 }}
+    spec:
+      serviceAccountName: {{ template "rancher.fullname" . }}-cleanup-tls-ca-sa
+      restartPolicy: OnFailure
+      containers:
+        - name: {{ template "rancher.name" . }}-cleanup-tls-ca
+          image: "{{ include "system_default_registry" . }}{{ .Values.postDelete.image.repository }}:{{ .Values.postDelete.image.tag }}"
+          imagePullPolicy: IfNotPresent
+          securityContext:
+            runAsUser: 0
+          command:
+            - /bin/sh
+            - -c
+            - |
+              #!/bin/bash
+              kd () {
+                if [ $(kubectl get $@ --ignore-not-found | wc -l) -eq 2 ];then
+                  echo [INFO] delete $@
+                  kubectl delete $@
+                fi
+              }
+              kd secret tls-ca -n {{ .Release.Namespace }}
+              kd certificate {{ .Values.ingress.tls.secretName }} -n {{ .Release.Namespace }}
+              kd secret {{ .Values.ingress.tls.secretName }} -n {{ .Release.Namespace }}
+{{- end }}
@@ -0,0 +1,18 @@
+{{- if .Values.preinstallHook }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: {{ template "rancher.fullname" . }}-cleanup-tls-ca-role
+  labels: {{ include "rancher.labels" . | nindent 4 }}
+  annotations:
+    "helm.sh/hook": post-delete
+    "helm.sh/hook-weight": "1"
+    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded,hook-failed
+rules:
+  - apiGroups: [""]
+    resources: ["secrets"]
+    verbs: ["get", "list", "delete"]
+  - apiGroups: ["cert-manager.io"]
+    resources: ["certificates"]
+    verbs: ["get", "list", "delete"]
+{{- end }} 
@@ -0,0 +1,18 @@
+{{- if .Values.preinstallHook }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{ template "rancher.fullname" . }}-cleanup-tls-ca-rolebinding
+  labels: {{ include "rancher.labels" . | nindent 4 }}
+  annotations:
+    "helm.sh/hook": post-delete
+    "helm.sh/hook-weight": "2"
+    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded,hook-failed
+subjects:
+  - kind: ServiceAccount
+    name: {{ template "rancher.fullname" . }}-cleanup-tls-ca-sa
+    namespace: {{ .Release.Namespace }}
+roleRef:
+  kind: Role
+  name: {{ template "rancher.fullname" . }}-cleanup-tls-ca-role
+{{- end }} 
@@ -0,0 +1,11 @@
+{{- if .Values.preinstallHook }}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ template "rancher.fullname" . }}-cleanup-tls-ca-sa
+  labels: {{ include "rancher.labels" . | nindent 4 }}
+  annotations:
+    "helm.sh/hook": post-delete
+    "helm.sh/hook-weight": "1"
+    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded,hook-failed
+{{- end }}