fix(chart): repair hooks, ingress and migrate job on live cluster
- configmap-env / secret-env: mark as pre-install,pre-upgrade hooks with weight -10 so the ConfigMap and Secret exist before the workloads that consume them, instead of racing the first apply. - migrate-job: drop the serviceAccountName reference; the job never needed API access and the referenced account was not created in this namespace, which made the pre-upgrade hook fail. - ingress: remove the configuration-snippet annotation; the cluster's ingress-nginx admission webhook rejects snippet annotations. - webhook ingress: emit the annotations block unconditionally and add the cert-manager cluster-issuer annotation, so hooks.gitdata.ai gets a certificate like the other hosts.
ZhenYi committed
Modified chart/templates/configmap-env.yaml chart/templates/configmap-env.yaml +3 −0 View chart/templates/configmap-env.yaml
@@ -4,5 +4,8 @@
44 name: {{ printf "%s-env" (include "gitdata.fullname" .) }}
55 labels:
66 {{- include "gitdata.labels" . | nindent 4 }}
7 annotations:
8 "helm.sh/hook": pre-install,pre-upgrade
9 "helm.sh/hook-weight": "-10"
710data:
811 RUST_LOG: "info"
Modified chart/templates/ingress.yaml chart/templates/ingress.yaml +1 −1 View chart/templates/ingress.yaml
@@ -7,7 +7,7 @@
77 "nginx.ingress.kubernetes.io/proxy-read-timeout" (printf "%v" .Values.ingress.proxyReadTimeout)
88 "nginx.ingress.kubernetes.io/proxy-send-timeout" (printf "%v" .Values.ingress.proxySendTimeout)
99 "nginx.ingress.kubernetes.io/proxy-connect-timeout" (printf "%v" .Values.ingress.proxyConnectTimeout)
10 "nginx.ingress.kubernetes.io/configuration-snippet" "proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection \"upgrade\";" }}
10 }}
1111{{- $annotations := merge (deepCopy .Values.ingress.annotations) (mustFromJson (toJson $nginxDefaults)) }}
1212{{- if and .Values.ingress.tls.enabled .Values.ingress.tls.clusterIssuer }}
1313{{- $_ := set $annotations "cert-manager.io/cluster-issuer" .Values.ingress.tls.clusterIssuer }}
Modified chart/templates/migrate-job.yaml chart/templates/migrate-job.yaml +0 −1 View chart/templates/migrate-job.yaml
@@ -20,7 +20,6 @@
2020 app.kubernetes.io/component: migrate
2121 spec:
2222 restartPolicy: Never
23 serviceAccountName: {{ include "gitdata.serviceAccountName" . }}
2423 {{- include "gitdata.imagePullSecrets" . | nindent 6 }}
2524 securityContext:
2625 {{- toYaml .Values.podSecurityContext | nindent 8 }}
Modified chart/templates/secret-env.yaml chart/templates/secret-env.yaml +3 −0 View chart/templates/secret-env.yaml
@@ -5,6 +5,9 @@
55 name: {{ include "gitdata.secretName" . }}
66 labels:
77 {{- include "gitdata.labels" . | nindent 4 }}
8 annotations:
9 "helm.sh/hook": pre-install,pre-upgrade
10 "helm.sh/hook-weight": "-10"
811type: Opaque
912stringData:
1013 {{- range $k, $v := .Values.secret.env }}
Modified chart/templates/webhook.yaml chart/templates/webhook.yaml +5 −2 View chart/templates/webhook.yaml
@@ -103,10 +103,13 @@
103103 labels:
104104 {{- include "gitdata.labels" . | nindent 4 }}
105105 app.kubernetes.io/component: webhook
106 {{- with .Values.webhook.ingress.annotations }}
107106 annotations:
107 {{- with .Values.webhook.ingress.annotations }}
108108 {{- toYaml . | nindent 4 }}
109 {{- end }}
109 {{- end }}
110 {{- if and .Values.webhook.ingress.tls.enabled .Values.webhook.ingress.tls.clusterIssuer }}
111 cert-manager.io/cluster-issuer: {{ .Values.webhook.ingress.tls.clusterIssuer }}
112 {{- end }}
110113spec:
111114 {{- with .Values.webhook.ingress.className }}
112115 ingressClassName: {{ . }}