Skip to content

Commit 2f698ce

Browse files
IvanHuntersIvanHunters
committed
fix(apps/kubernetes): normalize Job also clears stale extraArgs and extraVolumeMounts
Follow-up to the KCP cleanup extension: Kamaji's SSA field manager takes ownership of `spec.apiServer.extraArgs` and `spec.apiServer.extraVolumeMounts` too, not just `spec.deployment.extraVolumes`. The previous normalize patch only replaced extraVolumes; the two remaining fields still carried the `--authentication-config=` flag and the corresponding mount even after mode was toggled to None. Extend the merge patch to REPLACE all three fields at once, sourced from Helm values so user-supplied entries in `controlPlane.apiServer.extra{Args,VolumeMounts,Volumes}` remain intact — only the chart-owned OIDC-only entries drop off. Verified on dev3: with the extended patch, mode=System → mode=None leaves the tenant KCP with `extraArgs: []`, `extraVolumeMounts: []`, and `deployment.extraVolumes` back to just `talos-ca`, `talos-tls-cert` (or those + operator-supplied extras). Signed-off-by: Ivan Okhotnikov <[email protected]>
1 parent 03a8ad0 commit 2f698ce

1 file changed

Lines changed: 10 additions & 2 deletions

File tree

‎packages/apps/kubernetes/templates/oidc-rbac-job.yaml‎

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -180,10 +180,18 @@ spec:
180180
# manager takes ownership of spec.deployment.extraVolumes on
181181
# write-back to the TenantControlPlane. Verified end-to-end
182182
# against a real Kamaji controller.
183-
echo " patching KamajiControlPlane $RELEASE — remove authentication-config volume"
183+
echo " patching KamajiControlPlane $RELEASE — remove OIDC-only entries from extraArgs, extraVolumeMounts, deployment.extraVolumes"
184+
# Patch payload is rendered at helm template time from the same
185+
# source of truth cluster.yaml uses: user-supplied extras stay
186+
# intact, only the chart-owned OIDC-only entries (that Kamaji's
187+
# SSA field-owner refuses to release) are stripped.
184188
kubectl --namespace "$RELEASE_NAMESPACE" patch kamajicontrolplane "$RELEASE" \
185189
--type=merge \
186-
--patch '{"spec":{"deployment":{"extraVolumes":[{"name":"talos-ca","secret":{"secretName":"'"$RELEASE"'-talos-ca"}},{"name":"talos-tls-cert","secret":{"secretName":"'"$RELEASE"'-talos-tls-cert"}}]}}}'
190+
--patch {{ printf "{\"spec\":{\"apiServer\":{\"extraArgs\":%s,\"extraVolumeMounts\":%s},\"deployment\":{\"extraVolumes\":%s}}}"
191+
(default (list) .Values.controlPlane.apiServer.extraArgs | toJson)
192+
(default (list) .Values.controlPlane.apiServer.extraVolumeMounts | toJson)
193+
(concat (list (dict "name" "talos-ca" "secret" (dict "secretName" (printf "%s-talos-ca" .Release.Name))) (dict "name" "talos-tls-cert" "secret" (dict "secretName" (printf "%s-talos-tls-cert" .Release.Name)))) (default (list) .Values.controlPlane.apiServer.extraVolumes) | toJson)
194+
| quote }}
187195
188196
# 2. Chart-owned OIDC Secrets — Helm's SSA-based delete-on-absence
189197
# also fails here (same field-ownership pattern). Explicit

0 commit comments

Comments
 (0)