introduce clusterrole for knative-eventing pre-upgrade-hook (#5914)

* introduce rbac clusterrole for knative eventing upgrade hook * rename all resources of the pre-upgrade hook * implement review comments, reformat file
kyma-project · Oct 9, 2019 · a0b995e · a0b995e
1 parent c410568
commit a0b995e
Showing 1 changed file with 106 additions and 70 deletions.
diff --git a/resources/knative-eventing/charts/knative-eventing/templates/pre-upgrade-job.yaml b/resources/knative-eventing/charts/knative-eventing/templates/pre-upgrade-job.yaml
@@ -1,89 +1,125 @@
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ .Release.Name }}-pre-upgrade
+  annotations:
+    "helm.sh/hook": "pre-upgrade"
+    "helm.sh/hook-weight": "-6"
+    "helm.sh/hook-delete-policy": "before-hook-creation"
+  labels:
+    job: {{ .Release.Name }}-pre-upgrade
+rules:
+- apiGroups: ["apps","extensions"]
+  resources: ["deployments/scale", "deployments"]
+  verbs: ["create", "get", "list", "watch", "patch", "update", "delete"]
+- apiGroups: ["eventing.knative.dev"]
+  resources:
+    - subscriptions
+    - channels
+    - clusterchannelprovisioners
+  verbs: ["create", "get", "list", "watch", "patch", "delete"]
+- apiGroups: ["apiextensions.k8s.io"]
+  resources: ["customresourcedefinitions"]
+  verbs: ["create", "get", "list", "watch", "patch", "delete"]
+---
 apiVersion: v1
 kind: ServiceAccount
 metadata:
-    name: pre-upgrade-knative-eventing
-    annotations:
-        "helm.sh/hook-delete-policy": before-hook-creation
-        "helm.sh/hook": pre-upgrade
-        "helm.sh/hook-weight": "-5"
-    labels:
-        job: pre-upgrade-knative-eventing
+  name: {{ .Release.Name }}-pre-upgrade
+  annotations:
+    "helm.sh/hook-delete-policy": before-hook-creation
+    "helm.sh/hook": pre-upgrade
+    "helm.sh/hook-weight": "-5"
+  labels:
+      job: {{ .Release.Name }}-pre-upgrade
 ---
 apiVersion: v1
 data:
-    pre-upgrade.sh: |
-        #!/usr/bin/env bash
-        set -eu
-        echo "*** Pre upgrade job starts ***"
-        kubectl scale -n kyma-system deploy/event-bus-subscription-controller --replicas=0 || true
-        kubectl delete subscriptions.eventing.knative.dev --all -n kyma-system --ignore-not-found
-        kubectl delete channels.eventing.knative.dev --all -n kyma-system --ignore-not-found
-        kubectl delete clusterchannelprovisioners.eventing.knative.dev --all --ignore-not-found
-        kubectl delete crd \
-          subscriptions.eventing.knative.dev \
-          clusterchannelprovisioners.eventing.knative.dev \
-          channels.eventing.knative.dev --ignore-not-found
-        echo "*** Pre upgrade job executed ***"
+  pre-upgrade.sh: |
+    #!/usr/bin/env bash
+    set -eu
+    echo "*** Pre upgrade job starts ***"
+    kubectl scale -n kyma-system deploy/event-bus-subscription-controller --replicas=0 || true
+    if kubectl get crd subscriptions.eventing.knative.dev; then
+      echo "deleting subscriptions"
+      kubectl delete subscriptions.eventing.knative.dev --all -n kyma-system --ignore-not-found
+    fi
+    if kubectl get crd channels.eventing.knative.dev; then
+      echo "deleting channels"
+      kubectl delete channels.eventing.knative.dev --all -n kyma-system --ignore-not-found
+    fi
+    if kubectl get crd clusterchannelprovisioners.eventing.knative.dev; then
+      echo "deleting clusterchannelprovisioners"
+      kubectl delete clusterchannelprovisioners.eventing.knative.dev --all --ignore-not-found
+    fi
+    kubectl delete crd \
+      subscriptions.eventing.knative.dev \
+      clusterchannelprovisioners.eventing.knative.dev \
+      channels.eventing.knative.dev --ignore-not-found
+    echo "*** Pre upgrade job executed ***"
 kind: ConfigMap
 metadata:
-    annotations:
-        "helm.sh/hook-delete-policy": before-hook-creation
-        "helm.sh/hook": pre-upgrade
-        "helm.sh/hook-weight": "-5"
-    labels:
-        job: pre-upgrade-knative-eventing
-    name: pre-upgrade-knative-eventing
+  annotations:
+    "helm.sh/hook-delete-policy": before-hook-creation
+    "helm.sh/hook": pre-upgrade
+    "helm.sh/hook-weight": "-5"
+  labels:
+    job: {{ .Release.Name }}-pre-upgrade
+  name: {{ .Release.Name }}-pre-upgrade
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
-    name: pre-upgrade
-    annotations:
-        "helm.sh/hook-delete-policy": before-hook-creation
-        "helm.sh/hook": pre-upgrade
-        "helm.sh/hook-weight": "-4"
+  name: {{ .Release.Name }}-pre-upgrade
+  annotations:
+    "helm.sh/hook-delete-policy": before-hook-creation
+    "helm.sh/hook": pre-upgrade
+    "helm.sh/hook-weight": "-4"
+  labels:
+    job: {{ .Release.Name }}-pre-upgrade
 roleRef:
-    apiGroup: rbac.authorization.k8s.io
-    kind: ClusterRole
-    name: kyma-admin
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ .Release.Name }}-pre-upgrade
 subjects:
-    - kind: ServiceAccount
-      name: pre-upgrade-knative-eventing
-      namespace: {{ .Release.Namespace }}
+  - kind: ServiceAccount
+    name: {{ .Release.Name }}-pre-upgrade
+    namespace: {{ .Release.Namespace }}
 ---
 apiVersion: batch/v1
 kind: Job
 metadata:
-    annotations:
-        "helm.sh/hook-delete-policy": before-hook-creation
-        "helm.sh/hook": pre-upgrade
-        "helm.sh/hook-weight": "-3"
-    labels:
-        job: pre-upgrade-knative-eventing
-    name: pre-upgrade-knative-eventing
+  annotations:
+    "helm.sh/hook-delete-policy": before-hook-creation
+    "helm.sh/hook": pre-upgrade
+    "helm.sh/hook-weight": "-3"
+  labels:
+    job: {{ .Release.Name }}-pre-upgrade
+  name: {{ .Release.Name }}-pre-upgrade
 spec:
-    completions: 1
-    parallelism: 1
-    template:
-        metadata:
-            annotations:
-                sidecar.istio.io/inject: "false"
-            labels:
-                job: pre-upgrade-knative-eventing
-        spec:
-            restartPolicy: OnFailure
-            containers:
-                - command: ["sh", "/scripts/pre-upgrade.sh"]
-                  image: docker.io/istio/kubectl:1.1.6
-                  imagePullPolicy: IfNotPresent
-                  name: pre-upgrade-knative-eventing
-                  volumeMounts:
-                      - mountPath: /scripts
-                        name: scripts
-                        readOnly: true
-            serviceAccountName: pre-upgrade-knative-eventing
-            volumes:
-                - configMap:
-                      defaultMode: 420
-                      name: pre-upgrade-knative-eventing
-                  name: scripts
+  completions: 1
+  parallelism: 1
+  template:
+    metadata:
+      annotations:
+        sidecar.istio.io/inject: "false"
+      labels:
+        job: {{ .Release.Name }}-pre-upgrade
+    spec:
+        restartPolicy: OnFailure
+        containers:
+          - command: ["sh", "/scripts/pre-upgrade.sh"]
+            image: docker.io/istio/kubectl:1.1.6
+            imagePullPolicy: IfNotPresent
+            name: {{ .Release.Name }}-pre-upgrade
+            volumeMounts:
+              - mountPath: /scripts
+                name: scripts
+                readOnly: true
+        serviceAccountName: {{ .Release.Name }}-pre-upgrade
+        volumes:
+          - configMap:
+              defaultMode: 420
+              name: {{ .Release.Name }}-pre-upgrade
+            name: scripts