Add crd-installer job (#227)

Signed-off-by: Emruz Hossain <[email protected]>
stashed · Feb 7, 2022 · ea1d95f · ea1d95f
1 parent e9b9c1f
commit ea1d95f
Show file tree

Hide file tree

Showing 31 changed files with 362 additions and 27 deletions.
diff --git a/Makefile b/Makefile
@@ -382,7 +382,7 @@ ct: $(BUILD_DIRS)
 	    --env KUBECONFIG=$(subst $(HOME),,$(KUBECONFIG))        \
 	    $(CHART_TEST_IMAGE)                                     \
 	    /bin/sh -c "                                            \
-	        kubectl delete crds --selector=app.kubernetes.io/name=kubevault; \
+	        kubectl delete crds --selector=app.kubernetes.io/name=stash; \
 	        ct $(CT_COMMAND) --debug --validate-maintainers=false $(CT_ARGS) \
 	    "
 

diff --git a/apis/installer/v1alpha1/stash_community_types.go b/apis/installer/v1alpha1/stash_community_types.go
@@ -51,6 +51,7 @@ type StashCommunitySpec struct {
 	ReplicaCount     int32       `json:"replicaCount"`
 	RegistryFQDN     string      `json:"registryFQDN"`
 	Operator         Container   `json:"operator"`
+	CRDInstaller     ImageRef    `json:"crdInstaller"`
 	Pushgateway      Pushgateway `json:"pushgateway"`
 	Cleaner          CleanerRef  `json:"cleaner"`
 	ImagePullPolicy  string      `json:"imagePullPolicy"`

diff --git a/apis/installer/v1alpha1/stash_enterprise_types.go b/apis/installer/v1alpha1/stash_enterprise_types.go
@@ -51,6 +51,7 @@ type StashEnterpriseSpec struct {
 	ReplicaCount     int32       `json:"replicaCount"`
 	RegistryFQDN     string      `json:"registryFQDN"`
 	Operator         Container   `json:"operator"`
+	CRDInstaller     ImageRef    `json:"crdInstaller"`
 	Pushgateway      Pushgateway `json:"pushgateway"`
 	Cleaner          CleanerRef  `json:"cleaner"`
 	ImagePullPolicy  string      `json:"imagePullPolicy"`

diff --git a/apis/installer/v1alpha1/zz_generated.deepcopy.go b/apis/installer/v1alpha1/zz_generated.deepcopy.go
diff --git a/charts/stash-community/README.md b/charts/stash-community/README.md
@@ -52,11 +52,14 @@ The following table lists the configurable parameters of the `stash-community` c
 | license                               | License for the product. Get a license by following the steps from [here](https://stash.run/docs/latest/setup/install/community/#get-a-license). <br> Example: <br> `helm install appscode/stash \` <br> `--set-file license=/path/to/license/file` <br> `or` <br> `helm install appscode/stash \` <br> `--set license=<license file content>` | `""`                                                                  |
 | licenseApiService                     | Name of the ApiService to use by the addon to identify the respective service and certificate for license verification request                                                                                                                                                                                                                 | `v1beta1.admission.stash.appscode.com`                                |
 | registryFQDN                          | Docker registry fqdn used to pull Stash related images. Set this to use docker registry hosted at ${registryFQDN}/${registry}/${image}                                                                                                                                                                                                         | `""`                                                                  |
-| operator.registry                     | Docker registry used to pull operator image                                                                                                                                                                                                                                                                                                    | `appscode`                                                            |
+| operator.registry                     | Docker registry used to pull operator image                                                                                                                                                                                                                                                                                                    | `stashed`                                                             |
 | operator.repository                   | Name of operator container image                                                                                                                                                                                                                                                                                                               | `stash`                                                               |
 | operator.tag                          | Operator container image tag                                                                                                                                                                                                                                                                                                                   | `v0.17.0`                                                             |
 | operator.resources                    | Compute Resources required by the operator container                                                                                                                                                                                                                                                                                           | `{"requests":{"cpu":"100m"}}`                                         |
 | operator.securityContext              | Security options the operator container should run with                                                                                                                                                                                                                                                                                        | `{}`                                                                  |
+| crdInstaller.registry                 | Docker registry of the CRD installer image. By default, it will use the same registry as the operator.                                                                                                                                                                                                                                         | `""`                                                                  |
+| crdInstaller.repository               | Name of CRD crd installer image. Default `stash-crd-installer`                                                                                                                                                                                                                                                                                 | `stash-crd-installer`                                                 |
+| crdInstaller.tag                      | Tag of the CRD installer image. By default, it will use the same tag as the operator.                                                                                                                                                                                                                                                          | `""`                                                                  |
 | pushgateway.registry                  | Docker registry used to pull Prometheus pushgateway image                                                                                                                                                                                                                                                                                      | `prom`                                                                |
 | pushgateway.repository                | Prometheus pushgateway container image                                                                                                                                                                                                                                                                                                         | `pushgateway`                                                         |
 | pushgateway.tag                       | Prometheus pushgateway container image tag                                                                                                                                                                                                                                                                                                     | `v1.4.2`                                                              |

diff --git a/charts/stash-community/ci/ci-values.yaml b/charts/stash-community/ci/ci-values.yaml
@@ -1,2 +1,5 @@
 # https://github.com/helm/charts/blob/master/test/README.md#providing-custom-test-values
 license: ""
+crdInstaller:
+  registry: appscodeci
+  tag: latest
diff --git a/charts/stash-community/templates/cleaner/cluster_role.yaml b/charts/stash-community/templates/cleaner/cluster_role.yaml
@@ -0,0 +1,31 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ include "stash-community.fullname" . }}-cleaner
+  labels:
+    {{- include "stash-community.labels" . | nindent 4 }}
+  annotations:
+    "helm.sh/hook": pre-delete
+    "helm.sh/hook-delete-policy": hook-succeeded,hook-failed
+rules:
+  - apiGroups:
+      - admissionregistration.k8s.io
+    resources:
+      - mutatingwebhookconfigurations
+      - validatingwebhookconfigurations
+    verbs: ["delete"]
+  - apiGroups:
+      - apiregistration.k8s.io
+    resources:
+      - apiservices
+    verbs: ["delete"]
+  - apiGroups:
+      - stash.appscode.com
+    resources:
+      - "*"
+    verbs: ["delete"]
+  - apiGroups:
+      - batch
+    resources:
+      - jobs
+    verbs: ["delete"]
diff --git a/charts/stash-community/templates/cleaner/cluster_rolebinding.yaml b/charts/stash-community/templates/cleaner/cluster_rolebinding.yaml
@@ -0,0 +1,17 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ include "stash-community.fullname" . }}-cleaner
+  labels:
+    {{- include "stash-community.labels" . | nindent 4 }}
+  annotations:
+    "helm.sh/hook": pre-delete
+    "helm.sh/hook-delete-policy": hook-succeeded,hook-failed
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ include "stash-community.fullname" . }}-cleaner
+subjects:
+  - kind: ServiceAccount
+    name: {{ include "stash-community.serviceAccountName" . }}-cleaner
+    namespace: {{ .Release.Namespace }}
diff --git a/...ts/stash-community/templates/cleaner.yaml → ...tash-community/templates/cleaner/job.yaml b/...ts/stash-community/templates/cleaner.yaml → ...tash-community/templates/cleaner/job.yaml
@@ -15,22 +15,15 @@ spec:
   template:
     spec:
       {{- include "appscode.imagePullSecrets" . | nindent 6 }}
-      serviceAccountName: {{ include "stash-community.serviceAccountName" . }}
+      serviceAccountName: {{ include "stash-community.serviceAccountName" . }}-cleaner
       containers:
       - name: busybox
         image: {{ include "cleaner.registry" . }}/{{ .Values.cleaner.repository }}:{{ .Values.cleaner.tag }}
         command:
           - sh
           - -c
           - "sleep 2; \
-           kubectl delete validatingwebhookconfigurations admission.stash.appscode.com || true;      \
-           kubectl delete mutatingwebhookconfiguration admission.stash.appscode.com || true;         \
-           kubectl delete validatingwebhookconfigurations admission.stash.appscode.com || true;      \
-           kubectl delete mutatingwebhookconfiguration admission.stash.appscode.com || true;         \
-           kubectl delete apiservice v1alpha1.admission.stash.appscode.com || true;                  \
-           kubectl delete apiservice v1alpha1.repositories.stash.appscode.com || true;               \
-           kubectl delete apiservice v1alpha1.stash.appscode.com || true;                            \
-           kubectl delete apiservice v1beta1.admission.stash.appscode.com || true;                   \
+           kubectl delete job {{ include "stash-community.fullname" . }}-crd-installer -n {{ .Release.Namespace }} || true; \
            kubectl delete functions.stash.appscode.com update-status pvc-backup pvc-restore || true; \
            kubectl delete tasks.stash.appscode.com pvc-backup pvc-restore || true;"
         imagePullPolicy: {{ .Values.imagePullPolicy }}

diff --git a/charts/stash-community/templates/cleaner/serviceaccount.yaml b/charts/stash-community/templates/cleaner/serviceaccount.yaml
@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ include "stash-community.serviceAccountName" . }}-cleaner
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "stash-community.labels" . | nindent 4 }}
+  annotations:
+    "helm.sh/hook": pre-delete
+    "helm.sh/hook-delete-policy": hook-succeeded,hook-failed
diff --git a/charts/stash-community/templates/crd-installer/cluster_role.yaml b/charts/stash-community/templates/crd-installer/cluster_role.yaml
@@ -0,0 +1,20 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ include "stash-community.fullname" . }}-crd-installer
+  labels:
+    {{- include "stash-community.labels" . | nindent 4 }}
+  annotations:
+    "helm.sh/hook": pre-install,pre-upgrade,pre-rollback
+    "helm.sh/hook-delete-policy": before-hook-creation,hook-failed
+rules:
+  - apiGroups:
+      - apiextensions.k8s.io
+    resources:
+      - customresourcedefinitions
+    verbs: ["*"]
+  - apiGroups:
+      - stash.appscode.com
+    resources:
+      - "*"
+    verbs: ["*"]
diff --git a/charts/stash-community/templates/crd-installer/cluster_rolebinding.yaml b/charts/stash-community/templates/crd-installer/cluster_rolebinding.yaml
@@ -0,0 +1,17 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ include "stash-community.fullname" . }}-crd-installer
+  labels:
+    {{- include "stash-community.labels" . | nindent 4 }}
+  annotations:
+    "helm.sh/hook": pre-install,pre-upgrade,pre-rollback
+    "helm.sh/hook-delete-policy": before-hook-creation,hook-failed
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ include "stash-community.fullname" . }}-crd-installer
+subjects:
+  - kind: ServiceAccount
+    name: {{ include "stash-community.serviceAccountName" . }}-crd-installer
+    namespace: {{ .Release.Namespace }}
diff --git a/charts/stash-community/templates/crd-installer/job.yaml b/charts/stash-community/templates/crd-installer/job.yaml
@@ -0,0 +1,24 @@
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: {{ include "stash-community.fullname" . }}-crd-installer
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "stash-community.labels" . | nindent 4 }}
+  annotations:
+    "helm.sh/hook": pre-install,pre-upgrade,pre-rollback
+    "helm.sh/hook-delete-policy": before-hook-creation,hook-failed
+spec:
+  backoffLimit: 3
+  activeDeadlineSeconds: 300
+  ttlSecondsAfterFinished: 10
+  template:
+    spec:
+      serviceAccountName: {{ include "stash-community.serviceAccountName" . }}-crd-installer
+      containers:
+        - name: installer
+          image: "{{ .Values.crdInstaller.registry | default (include "operator.registry" .) }}/{{.Values.crdInstaller.repository}}:{{.Values.crdInstaller.tag | default .Values.operator.tag }}"
+          args:
+            - --enterprise=false
+          imagePullPolicy: {{ .Values.imagePullPolicy }}
+      restartPolicy: Never
diff --git a/charts/stash-community/templates/crd-installer/serviceaccount.yaml b/charts/stash-community/templates/crd-installer/serviceaccount.yaml
@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ include "stash-community.serviceAccountName" . }}-crd-installer
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "stash-community.labels" . | nindent 4 }}
+  annotations:
+    "helm.sh/hook": pre-install,pre-upgrade,pre-rollback
+    "helm.sh/hook-delete-policy": before-hook-creation,hook-failed
diff --git a/charts/stash-community/values.openapiv3_schema.yaml b/charts/stash-community/values.openapiv3_schema.yaml
@@ -811,6 +811,19 @@ properties:
     - skip
     - tag
     type: object
+  crdInstaller:
+    properties:
+      registry:
+        type: string
+      repository:
+        type: string
+      tag:
+        type: string
+    required:
+    - registry
+    - repository
+    - tag
+    type: object
   criticalAddon:
     type: boolean
   fullnameOverride:
@@ -1423,6 +1436,7 @@ properties:
 required:
 - apiserver
 - cleaner
+- crdInstaller
 - imagePullPolicy
 - monitoring
 - operator

diff --git a/charts/stash-community/values.yaml b/charts/stash-community/values.yaml
@@ -24,7 +24,7 @@ licenseApiService: v1beta1.admission.stash.appscode.com
 registryFQDN: ""
 operator:
   # Docker registry used to pull operator image
-  registry: appscode
+  registry: stashed
   # Name of operator container image
   repository: stash
   # Operator container image tag
@@ -41,6 +41,15 @@ operator:
   # readOnlyRootFilesystem: true
   # runAsNonRoot: true
   # runAsUser: 1000
+
+crdInstaller:
+  # Docker registry of the CRD installer image. By default, it will use the same registry as the operator.
+  registry: ""
+  # Name of CRD crd installer image. Default `stash-crd-installer`
+  repository: stash-crd-installer
+  # Tag of the CRD installer image. By default, it will use the same tag as the operator.
+  tag: ""
+
 pushgateway:
   # Docker registry used to pull Prometheus pushgateway image
   registry: prom