Skip to content

Commit cc3f71a

Browse files
cognifloydcognifloyd
committed
Use a job to create the helm hooks pod
1 parent e507c53 commit cc3f71a

File tree

1 file changed

+87
-78
lines changed

1 file changed

+87
-78
lines changed

‎templates/hooks/job_packs-volumes.yaml

Lines changed: 87 additions & 78 deletions
Original file line numberDiff line numberDiff line change
@@ -1,97 +1,106 @@
11
{{- if $.Values.st2.packs.volumes.enabled }}
22
---
3-
apiVersion: v1
4-
kind: Pod
3+
apiVersion: batch/v1
4+
kind: Job
55
metadata:
66
name: {{ $.Release.Name }}-st2canary-packs-volumes-validation
77
labels: {{- include "stackstorm-ha.labels" (list $ "st2canary") | nindent 4 }}
88
annotations:
9-
"helm.sh/hook": pre-install,pre-upgrade,pre-rollback
10-
"helm.sh/hook-weight": -5 # fairly high priority
11-
"helm.sh/hook-delete-policy": hook-succeeded
9+
helm.sh/hook: pre-install, pre-upgrade, pre-rollback
10+
helm.sh/hook-weight: "-5" # fairly high priority
11+
helm.sh/hook-delete-policy: hook-succeeded
1212
{{- if $.Values.st2canary.annotations }}
1313
{{- toYaml $.Values.st2canary.annotations | nindent 4 }}
1414
{{- end }}
1515
spec:
16-
imagePullSecrets:
17-
{{- if $.Values.image.pullSecret }}
18-
- name: {{ $.Values.image.pullSecret }}
19-
{{- end }}
20-
initContainers: []
21-
containers:
22-
- name: st2canary-packs-volumes-validation
23-
image: '{{ template "stackstorm-ha.imageRepository" $ }}/st2actionrunner:{{ tpl $.Values.image.tag $ }}'
24-
#image: busybox:1.28
25-
imagePullPolicy: {{ $.Values.image.pullPolicy }}
26-
{{- with $.Values.securityContext }}
27-
securityContext: {{- toYaml . | nindent 8 }}
16+
template:
17+
metadata:
18+
name: {{ $.Release.Name }}-st2canary-packs-volumes-validation
19+
labels: {{- include "stackstorm-ha.labels" (list $ "st2canary") | nindent 8 }}
20+
annotations:
21+
{{- if $.Values.st2canary.annotations }}
22+
{{- toYaml $.Values.st2canary.annotations | nindent 8 }}
2823
{{- end }}
29-
# TODO: maybe use kubectl to assert the volumes have RWX mode
30-
# If volume is a persistentVolumeClaim, then:
31-
# the PVC must only have ReadWriteMany in spec.accessModes
32-
# If volume is something else, then validating through metadata is iffy.
33-
# azureFile, cephfs, csi, glusterfs, nfs, pvc, quobyte, need at least:
34-
# readOnly: false
35-
# ephemeral volumes could also work, ... but that config is even deeper.
36-
command:
37-
- 'sh'
38-
- '-ec'
39-
- |
40-
echo Testing write permissions for packs volumes.
41-
echo If this passes, the pod will automatically be deleted.
42-
echo If this fails, inspect the pod for errors in kubernetes,
43-
echo and then delete this st2canary pod manually.
44-
echo
45-
echo Testing write permissions on packs volume...
46-
touch /opt/stackstorm/packs/.write-test
47-
rm /opt/stackstorm/packs/.write-test
48-
echo
49-
echo Testing write permissions on virtualenvs volume...
50-
touch /opt/stackstorm/virtualenvs/.write-test
51-
rm /opt/stackstorm/virtualenvs/.write-test
52-
echo
53-
{{- if $.Values.st2.packs.volumes.configs }}
54-
echo Testing write permissions on configs volume...
55-
touch /opt/stackstorm/configs/.write-test
56-
rm /opt/stackstorm/configs/.write-test
57-
echo
58-
{{- end }}
59-
echo DONE
60-
volumeMounts:
24+
spec:
25+
imagePullSecrets:
26+
{{- if $.Values.image.pullSecret }}
27+
- name: {{ $.Values.image.pullSecret }}
28+
{{- end }}
29+
initContainers: []
30+
containers:
31+
- name: st2canary-packs-volumes-validation
32+
image: '{{ template "stackstorm-ha.imageRepository" $ }}/st2actionrunner:{{ tpl $.Values.image.tag $ }}'
33+
#image: busybox:1.28
34+
imagePullPolicy: {{ $.Values.image.pullPolicy }}
35+
{{- with $.Values.securityContext }}
36+
securityContext: {{- toYaml . | nindent 10 }}
37+
{{- end }}
38+
# TODO: maybe use kubectl to assert the volumes have RWX mode
39+
# If volume is a persistentVolumeClaim, then:
40+
# the PVC must only have ReadWriteMany in spec.accessModes
41+
# If volume is something else, then validating through metadata is iffy.
42+
# azureFile, cephfs, csi, glusterfs, nfs, pvc, quobyte, need at least:
43+
# readOnly: false
44+
# ephemeral volumes could also work, ... but that config is even deeper.
45+
command:
46+
- 'sh'
47+
- '-ec'
48+
- |
49+
echo Testing write permissions for packs volumes.
50+
echo If this passes, the pod will automatically be deleted.
51+
echo If this fails, inspect the pod for errors in kubernetes,
52+
echo and then delete this st2canary pod manually.
53+
echo
54+
echo Testing write permissions on packs volume...
55+
touch /opt/stackstorm/packs/.write-test
56+
rm /opt/stackstorm/packs/.write-test
57+
echo
58+
echo Testing write permissions on virtualenvs volume...
59+
touch /opt/stackstorm/virtualenvs/.write-test
60+
rm /opt/stackstorm/virtualenvs/.write-test
61+
echo
62+
{{- if $.Values.st2.packs.volumes.configs }}
63+
echo Testing write permissions on configs volume...
64+
touch /opt/stackstorm/configs/.write-test
65+
rm /opt/stackstorm/configs/.write-test
66+
echo
67+
{{- end }}
68+
echo DONE
69+
volumeMounts:
6170
{{- include "stackstorm-ha.packs-volume-mounts" $ | nindent 8 }}
6271
{{/* do not include the pack-configs-volume-mount helper here */}}
6372
- name: st2-pack-configs-vol
6473
mountPath: /opt/stackstorm/configs/
6574
readOnly: false
66-
resources:
67-
{{- toYaml $.Values.st2canary.resources | nindent 8 }}
68-
volumes:
69-
{{- include "stackstorm-ha.packs-volumes" $ | nindent 4 }}
70-
{{- if $.Values.st2.packs.volumes.configs }}
71-
{{/* do not include the pack-configs-volume helper here */}}
72-
- name: st2-pack-configs-vol
73-
{{- toYaml $.Values.st2.packs.volumes.configs | nindent 6 }}
75+
resources:
76+
{{- toYaml $.Values.st2canary.resources | nindent 10 }}
77+
volumes:
78+
{{- include "stackstorm-ha.packs-volumes" $ | nindent 8 }}
79+
{{- if $.Values.st2.packs.volumes.configs }}
80+
{{/* do not include the pack-configs-volume helper here */}}
81+
- name: st2-pack-configs-vol
82+
{{- toYaml $.Values.st2.packs.volumes.configs | nindent 10 }}
83+
{{- end }}
84+
{{- range $.Values.st2canary.extra_volumes }}
85+
- name: {{ required "Each volume must have a 'name' in st2canary.extra_volumes" .name }}
86+
{{- tpl (required "Each volume must have a 'volume' definition in st2canary.extra_volumes" .volume | toYaml) $ | nindent 10 }}
87+
{{- end }}
88+
{{- if $.Values.dnsPolicy }}
89+
dnsPolicy: {{ $.Values.dnsPolicy }}
90+
{{- end }}
91+
{{- with $.Values.dnsConfig }}
92+
dnsConfig: {{- toYaml . | nindent 8 }}
93+
{{- end }}
94+
{{- with $.Values.podSecurityContext }}
95+
securityContext: {{- toYaml . | nindent 8 }}
96+
{{- end }}
97+
{{- with $.Values.st2canary.nodeSelector }}
98+
nodeSelector: {{- toYaml . | nindent 8 }}
99+
{{- end }}
100+
{{- with $.Values.st2canary.affinity }}
101+
affinity: {{- toYaml . | nindent 8 }}
74102
{{- end }}
75-
{{- range $.Values.st2canary.extra_volumes }}
76-
- name: {{ required "Each volume must have a 'name' in st2canary.extra_volumes" .name }}
77-
{{- tpl (required "Each volume must have a 'volume' definition in st2canary.extra_volumes" .volume | toYaml) $ | nindent 6 }}
103+
{{- with $.Values.st2canary.tolerations }}
104+
tolerations: {{- toYaml . | nindent 8 }}
78105
{{- end }}
79-
{{- if $.Values.dnsPolicy }}
80-
dnsPolicy: {{ $.Values.dnsPolicy }}
81-
{{- end }}
82-
{{- with $.Values.dnsConfig }}
83-
dnsConfig: {{- toYaml . | nindent 4 }}
84-
{{- end }}
85-
{{- with $.Values.podSecurityContext }}
86-
securityContext: {{- toYaml . | nindent 4 }}
87-
{{- end }}
88-
{{- with $.Values.st2canary.nodeSelector }}
89-
nodeSelector: {{- toYaml . | nindent 4 }}
90-
{{- end }}
91-
{{- with $.Values.st2canary.affinity }}
92-
affinity: {{- toYaml . | nindent 4 }}
93-
{{- end }}
94-
{{- with $.Values.st2canary.tolerations }}
95-
tolerations: {{- toYaml . | nindent 4 }}
96-
{{- end }}
97106
{{- end }}

0 commit comments

Comments
 (0)