Initial chart deployment fails: Error from server (NotFound): jobs.batch "openfga-migrate" not found

[malud]

So basically our setup is ArgoCD which polls the gitops repo to apply this helm chart. However, the openfga pod fails with Back-off restarting failed container wait-for-migration in pod openfga.
This happens due to the missing job.

This resource doesn’t get created automatically — I have to log in to our cluster and apply the job resource manually in order for the migrate init container to succeed, which in turn allows the FGA pod to run.

The job resource is the only one with a hook and weight annotation:

helm.sh/hook-weight: "-5"

Could this be the issue?

[jonasmock]

@malud Any recommendations how to fix it? Does it work with older verisons. I try to setup openfga via Helm chart in our Kubernetes.

[marlenekoh]

adding helm annotations to the service account and migrate job to create them during pre-install fixed it for me

# in values.yaml

serviceAccount:
  create: true

migrate:
  annotations:
    helm.sh/hook: "pre-install, post-upgrade, post-rollback, post-delete" # not post-install
    helm.sh/hook-weight: "-5"

[malud]

@jonasmock as mentioned, local template processing and kubectl apply to create the job resource but @marlenekoh has a great workaround here, thanks.

[mkyc]

Related to #107.

This is related how ArgoCD interprets some of Helm hooks. I did local helm install first and then after chart is applied once all works well via ArgoCD.

[RhynoVDS]

This did not work for me. What worked for me was to remove the annotations on migrate and set serviceAccount hooks as follows.

serviceAccount:
  # Specifies whether a service account should be created
  create: true
  # Annotations to add to the service account
  annotations:
    helm.sh/hook: "pre-install"
    helm.sh/hook-weight: "-6"

migrate:
  annotations:

With this setting, the openFGA service pods wait for the migrate pod to finish running. After the migrate pod finishes the service pods start successfully.

[xshadowlegendx]

try using migration type initContainer instead of job, it should fix the openfga-migrate not found issue, my environment is using ArgoCD

---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization

helmCharts:
- name: openfga
  releaseName: openfga
  repo: https://openfga.github.io/helm-charts
  version: 0.2.38
  valuesInline:
    datastore:
      engine: postgres
      existingSecret: openfga-pg-app
      migrationType: initContainer # <-- change here, based on here https://github.com/openfga/helm-charts/blob/main/charts/openfga/templates/deployment.yaml#L55
      secretKeys:
        uriKey: uri
        passwordKey: password
        usernameKey: username

    serviceAccount:
      annotations:
        argocd.argoproj.io/hook: PreSync
        argocd.argoproj.io/sync-wave: "-2"

[djds]

Is there a reason that migrationType: job is the default?

[jdiegosierra]

Could you implement this by following the same approach as Apache Airflow?

https://airflow.apache.org/docs/helm-chart/stable/index.html#installing-the-chart-with-argo-cd-flux-rancher-or-terraform