feat: Add pre-upgrade jobs to run helm-mapkubeapis

services/gatekeeper/3.12.0/kustomization.yaml

@@ -4,3 +4,4 @@ resources:
   - release.yaml
   - constraints.yaml
   - constrainttemplates.yaml
+  - pre-upgrade.yaml

services/gatekeeper/3.12.0/pre-upgrade.yaml

@@ -0,0 +1,22 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1beta2
+kind: Kustomization
+metadata:
+  name: gatekeeper-pre-upgrade
+  namespace: ${releaseNamespace}
+spec:
+  force: true
+  prune: true
+  wait: true
+  interval: 6h
+  retryInterval: 1m
+  path: ./services/gatekeeper/3.12.0/pre-upgrade
+  sourceRef:
+    kind: GitRepository
+    name: management
+    namespace: kommander-flux
+  timeout: 1m
+  # passing releaseNamespace to 2nd level configuration files for ability to configure namespace correctly in attached clusters
+  # Using `substituteFrom` with `substitution-vars` creates 2nd level resources in `kommander` namespace instead of workspace ns
+  postBuild:
+    substitute:
+      releaseNamespace: ${releaseNamespace}

services/gatekeeper/3.12.0/pre-upgrade/kustomization.yaml

@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - pre-upgrade.yaml

services/gatekeeper/3.12.0/pre-upgrade/pre-upgrade.yaml

@@ -0,0 +1,60 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: gatekeeper-pre-upgrade
+  namespace: ${releaseNamespace}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: gatekeeper-pre-upgrade
+  namespace: ${releaseNamespace}
+rules:
+  - apiGroups: [""]
+    resources: ["secrets"]
+    verbs: ["get", "watch", "list", "update", "patch", "create"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: gatekeeper-pre-upgrade
+  namespace: ${releaseNamespace}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: gatekeeper-pre-upgrade
+subjects:
+  - kind: ServiceAccount
+    name: gatekeeper-pre-upgrade
+    namespace: ${releaseNamespace}
+---
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: gatekeeper-pre-upgrade
+  namespace: ${releaseNamespace}
+spec:
+  ttlSecondsAfterFinished: 100
+  template:
+    metadata:
+      name: gatekeeper-pre-upgrade
+    spec:
+      serviceAccountName: gatekeeper-pre-upgrade
+      restartPolicy: OnFailure
+      priorityClassName: system-cluster-critical
+      containers:
+        - name: kubetools
+          image: "mesosphere/kommander2-kubetools:${kommanderChartVersion:=v2.6.0-dev}"
+          command:
+            - sh
+            - "-c"
+            - |-
+              /bin/bash <<'EOF'
+              set -o nounset
+              set -o errexit
+              set -o pipefail
+
+              # TODO: wait for HelmRelease to not be in-progress?
+
+              helm mapkubeapis kommander-gatekeeper --namespace ${releaseNamespace}
+              EOF

services/kubecost/0.35.1/kustomization.yaml

@@ -1,4 +1,5 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
+  - pre-upgrade.yaml
   - kubecost.yaml

services/kubecost/0.35.1/pre-upgrade.yaml

@@ -0,0 +1,22 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1beta2
+kind: Kustomization
+metadata:
+  name: kubecost-pre-upgrade
+  namespace: ${releaseNamespace}
+spec:
+  force: true
+  prune: true
+  wait: true
+  interval: 6h
+  retryInterval: 1m
+  path: ./services/kubecost/0.35.1/pre-upgrade
+  sourceRef:
+    kind: GitRepository
+    name: management
+    namespace: kommander-flux
+  timeout: 1m
+  # passing releaseNamespace to 2nd level configuration files for ability to configure namespace correctly in attached clusters
+  # Using `substituteFrom` with `substitution-vars` creates 2nd level resources in `kommander` namespace instead of workspace ns
+  postBuild:
+    substitute:
+      releaseNamespace: ${releaseNamespace}

services/kubecost/0.35.1/pre-upgrade/kustomization.yaml

@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - pre-upgrade.yaml

services/kubecost/0.35.1/pre-upgrade/pre-upgrade.yaml

@@ -0,0 +1,60 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: kubecost-pre-upgrade
+  namespace: ${releaseNamespace}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: kubecost-pre-upgrade
+  namespace: ${releaseNamespace}
+rules:
+  - apiGroups: [""]
+    resources: ["secrets"]
+    verbs: ["get", "watch", "list", "update", "patch", "create"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: kubecost-pre-upgrade
+  namespace: ${releaseNamespace}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: kubecost-pre-upgrade
+subjects:
+  - kind: ServiceAccount
+    name: kubecost-pre-upgrade
+    namespace: ${releaseNamespace}
+---
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: kubecost-pre-upgrade
+  namespace: ${releaseNamespace}
+spec:
+  ttlSecondsAfterFinished: 100
+  template:
+    metadata:
+      name: kubecost-pre-upgrade
+    spec:
+      serviceAccountName: kubecost-pre-upgrade
+      restartPolicy: OnFailure
+      priorityClassName: dkp-high-priority
+      containers:
+        - name: kubetools
+          image: "mesosphere/kommander2-kubetools:${kommanderChartVersion:=v2.6.0-dev}"
+          command:
+            - sh
+            - "-c"
+            - |-
+              /bin/bash <<'EOF'
+              set -o nounset
+              set -o errexit
+              set -o pipefail
+
+              # TODO: wait for HelmRelease to not be in-progress?
+
+              helm mapkubeapis kubecost --namespace ${releaseNamespace}
+              EOF

services/logging-operator/4.2.3/kustomization.yaml

@@ -4,3 +4,4 @@ resources:
   - grafana-dashboards
   - logging-operator.yaml
   - logging-operator-logging.yaml
+  - pre-upgrade.yaml

services/logging-operator/4.2.3/pre-upgrade.yaml

@@ -0,0 +1,22 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1beta2
+kind: Kustomization
+metadata:
+  name: logging-operator-pre-upgrade
+  namespace: ${releaseNamespace}
+spec:
+  force: true
+  prune: true
+  wait: true
+  interval: 6h
+  retryInterval: 1m
+  path: ./services/logging-operator/4.2.3/pre-upgrade
+  sourceRef:
+    kind: GitRepository
+    name: management
+    namespace: kommander-flux
+  timeout: 1m
+  # passing releaseNamespace to 2nd level configuration files for ability to configure namespace correctly in attached clusters
+  # Using `substituteFrom` with `substitution-vars` creates 2nd level resources in `kommander` namespace instead of workspace ns
+  postBuild:
+    substitute:
+      releaseNamespace: ${releaseNamespace}

services/logging-operator/4.2.3/pre-upgrade/kustomization.yaml

@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - pre-upgrade.yaml

services/logging-operator/4.2.3/pre-upgrade/pre-upgrade.yaml

@@ -0,0 +1,60 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: logging-operator-pre-upgrade
+  namespace: ${releaseNamespace}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: logging-operator-pre-upgrade
+  namespace: ${releaseNamespace}
+rules:
+  - apiGroups: [""]
+    resources: ["secrets"]
+    verbs: ["get", "watch", "list", "update", "patch", "create"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: logging-operator-pre-upgrade
+  namespace: ${releaseNamespace}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: logging-operator-pre-upgrade
+subjects:
+  - kind: ServiceAccount
+    name: logging-operator-pre-upgrade
+    namespace: ${releaseNamespace}
+---
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: logging-operator-pre-upgrade
+  namespace: ${releaseNamespace}
+spec:
+  ttlSecondsAfterFinished: 100
+  template:
+    metadata:
+      name: logging-operator-pre-upgrade
+    spec:
+      serviceAccountName: logging-operator-pre-upgrade
+      restartPolicy: OnFailure
+      priorityClassName: dkp-critical-priority
+      containers:
+        - name: kubetools
+          image: "mesosphere/kommander2-kubetools:${kommanderChartVersion:=v2.6.0-dev}"
+          command:
+            - sh
+            - "-c"
+            - |-
+              /bin/bash <<'EOF'
+              set -o nounset
+              set -o errexit
+              set -o pipefail
+
+              # TODO: wait for HelmRelease to not be in-progress?
+
+              helm mapkubeapis logging-operator --namespace ${releaseNamespace}
+              EOF