Skip to content

Commit 5c5e9dc

Browse files
authored
Prevent csv-finalizer Job from being included in operator release yamls (#2063)
Summary: Prevent csv-finalizer Job from being included in operator release yamls #2059 introduced a new Job that fixed helm's uninstall issues caused by OLM's recent csv-finalizer addition. This properly addressed the helm issues in #1917, however, it broke the `px` cli install process since the Job wasn't excluded from the operator release yamls. This results in `px-operator` namespace termination as the cli is trying to deploy the vizier since the Job runs unconditionally. This change also renames the `deleter_role.yaml` file since it seems to be accidentally included in the operator release yamls. Please see testing done for how this was determined to be extraneous. Relevant Issues: #1917 Type of change: /kind bug Test Plan: Verified the following - [x] `helm template` includes the `csv-finalizer` job ``` # Create dummy Chart.yaml to appease helm $ helm template --set deployOLM=true k8s/operator/helm/ | grep 'csv-deleter' # Source: pixie/templates/csv-deleter.yaml name: csv-deleter ``` - [x] `bazel build k8s/operator:operator_templates` no longer includes the `csv-finalizer` job or the `deleter_role.yaml` ``` $ tar -tf bazel-bin/k8s/operator/operator_templates.tar yamls/ yamls/crds/ yamls/crds/olm_crd.yaml yamls/crds/vizier_crd.yaml yamls/templates/ yamls/templates/00_olm.yaml yamls/templates/01_px_olm.yaml yamls/templates/02_catalog.yaml yamls/templates/03_subscription.yaml yamls/templates/04_vizier.yaml ``` - [x] Verified deleter role is excluded from `px deploy`'s extracted yaml. [This](https://github.com/pixie-io/pixie/blob/9effb349be7a42f8b45ca8fce6cbfdac619349ac/src/utils/shared/artifacts/yamls.go#L165-L170) code excludes anything that isn't a "crd" file or is isn't numerically prefixed, which means the deleter role isn't included for `px` cli deploys ``` $ px deploy --operator_version=0.1.7-pre-z1.0 -e . --deploy_key=<deploy_key> $ tree pixie_yamls/ pixie_yamls/ ├── 00_olm_crd.yaml ├── 01_vizier_crd.yaml ├── 02_olm.yaml ├── 03_px_olm.yaml ├── 04_catalog.yaml ├── 05_subscription.yaml └── 06_vizier.yaml 1 directory, 7 files ``` --------- Signed-off-by: Dom Del Nano <ddelnano@gmail.com>
1 parent 9effb34 commit 5c5e9dc

File tree

3 files changed

+53
-51
lines changed

3 files changed

+53
-51
lines changed

k8s/operator/helm/templates/00_olm.yaml

Lines changed: 0 additions & 51 deletions
Original file line numberDiff line numberDiff line change
@@ -228,55 +228,4 @@ metadata:
228228
spec:
229229
targetNamespaces:
230230
- {{ .Values.olmNamespace }}
231-
---
232-
apiVersion: batch/v1
233-
kind: Job
234-
metadata:
235-
name: csv-deleter
236-
namespace: {{ .Values.olmNamespace }}
237-
annotations:
238-
"helm.sh/hook": pre-delete
239-
"helm.sh/hook-delete-policy": hook-succeeded,hook-failed
240-
spec:
241-
template:
242-
spec:
243-
restartPolicy: Never
244-
serviceAccountName: olm-operator-serviceaccount
245-
containers:
246-
- name: trigger-csv-finalizer
247-
image: ghcr.io/pixie-io/pixie-oss-pixie-dev-public-curl:multiarch-7.87.0@sha256:f7f265d5c64eb4463a43a99b6bf773f9e61a50aaa7cefaf564f43e42549a01dd
248-
command:
249-
- /bin/sh
250-
- -c
251-
- |
252-
NAMESPACE="{{ .Values.olmOperatorNamespace }}"
253-
API_SERVER="https://$KUBERNETES_SERVICE_HOST:$KUBERNETES_SERVICE_PORT"
254-
CA_CERT=/var/run/secrets/kubernetes.io/serviceaccount/ca.crt
255-
TOKEN=$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)
256-
257-
DELETE_STATUS=$(curl --cacert $CA_CERT \
258-
-H "Authorization: Bearer $TOKEN" \
259-
-X DELETE -s \
260-
-o /dev/null -w "%{http_code}" \
261-
$API_SERVER/api/v1/namespaces/$NAMESPACE)
262-
263-
if [ "$DELETE_STATUS" -ne 200 ] && [ "$DELETE_STATUS" -ne 202 ]; then
264-
echo "Failed to initiate deletion for namespace $NAMESPACE. HTTP status code: $DELETE_STATUS"
265-
exit 1
266-
fi
267-
268-
echo "Waiting for finalizer in $NAMESPACE to complete..."
269-
while true; do
270-
STATUS=$(curl --cacert $CA_CERT \
271-
-H "Authorization: Bearer $TOKEN" \
272-
-o /dev/null -w "%{http_code}" -s \
273-
$API_SERVER/api/v1/namespaces/$NAMESPACE)
274-
if [ "$STATUS" = "404" ]; then
275-
echo "Namespace $NAMESPACE finalizer completed."
276-
break
277-
else
278-
echo "Finalizer still running in $NAMESPACE. Retrying in 5 seconds..."
279-
sleep 5
280-
fi
281-
done
282231
{{- end}}
Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
{{if .Values.deployOLM}}
2+
---
3+
apiVersion: batch/v1
4+
kind: Job
5+
metadata:
6+
name: csv-deleter
7+
namespace: {{ .Values.olmNamespace }}
8+
annotations:
9+
"helm.sh/hook": pre-delete
10+
"helm.sh/hook-delete-policy": hook-succeeded,hook-failed
11+
spec:
12+
template:
13+
spec:
14+
restartPolicy: Never
15+
serviceAccountName: olm-operator-serviceaccount
16+
containers:
17+
- name: trigger-csv-finalizer
18+
image: ghcr.io/pixie-io/pixie-oss-pixie-dev-public-curl:multiarch-7.87.0@sha256:f7f265d5c64eb4463a43a99b6bf773f9e61a50aaa7cefaf564f43e42549a01dd
19+
command:
20+
- /bin/sh
21+
- -c
22+
- |
23+
NAMESPACE="{{ .Values.olmOperatorNamespace }}"
24+
API_SERVER="https://$KUBERNETES_SERVICE_HOST:$KUBERNETES_SERVICE_PORT"
25+
CA_CERT=/var/run/secrets/kubernetes.io/serviceaccount/ca.crt
26+
TOKEN=$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)
27+
28+
DELETE_STATUS=$(curl --cacert $CA_CERT \
29+
-H "Authorization: Bearer $TOKEN" \
30+
-X DELETE -s \
31+
-o /dev/null -w "%{http_code}" \
32+
$API_SERVER/api/v1/namespaces/$NAMESPACE)
33+
34+
if [ "$DELETE_STATUS" -ne 200 ] && [ "$DELETE_STATUS" -ne 202 ]; then
35+
echo "Failed to initiate deletion for namespace $NAMESPACE. HTTP status code: $DELETE_STATUS"
36+
exit 1
37+
fi
38+
39+
echo "Waiting for finalizer in $NAMESPACE to complete..."
40+
while true; do
41+
STATUS=$(curl --cacert $CA_CERT \
42+
-H "Authorization: Bearer $TOKEN" \
43+
-o /dev/null -w "%{http_code}" -s \
44+
$API_SERVER/api/v1/namespaces/$NAMESPACE)
45+
if [ "$STATUS" = "404" ]; then
46+
echo "Namespace $NAMESPACE finalizer completed."
47+
break
48+
else
49+
echo "Finalizer still running in $NAMESPACE. Retrying in 5 seconds..."
50+
sleep 5
51+
fi
52+
done
53+
{{- end}}
File renamed without changes.

0 commit comments

Comments
 (0)