Skip to content

Commit 3a87485

Browse files
myasnikovdaniilmyasnikovdaniil
committed
fix(installer): bootstrap cozy-system via --create-namespace + label hook
Removes the chart's `Namespace cozy-system` resource and replaces it with a pre-install/pre-upgrade Job hook (cozy-system-labeler) that patches the required labels onto the namespace after `--create-namespace` creates it. Why: helm v3 has a known chicken-and-egg with charts that ship their own Namespace: - WITH `--create-namespace` on the install command, helm pre-creates the namespace via plain kubectl-create (no helm meta annotations); the chart's own Namespace apply then fails with `already exists`. - WITHOUT `--create-namespace`, helm fails immediately because it cannot write its release-secret to a non-existent namespace. Until now this was hidden by the 3x retry on `Install Cozystack` in `.github/workflows/pull-requests.yaml`: first attempt always fails with the conflict, second attempt sees the existing failed release and takes the upgrade code path which patch-merges instead of strict-create. Reproducible on every cold install. Surfaced cleanly when retries on the install step were dropped. After this change: - install commands use `helm upgrade --install --namespace cozy-system --create-namespace`. Standard pattern, matches kube-prometheus-stack / argo-cd / cert-manager / others. - the pre-install hook (SA + ClusterRole + ClusterRoleBinding + Job) patches `cozystack.io/system=true` and `pod-security.kubernetes.io/enforce=privileged` onto the namespace before main resources apply. - hook-delete-policy=before-hook-creation,hook-succeeded so the RBAC surface only exists during install/upgrade. Verified end-to-end on a kind cluster: cold install in 3.3s, upgrade idempotent, cleanup clean. Image pinned to `alpine/k8s:1.32.0` for the hook (small, public, includes kubectl). Signed-off-by: Myasnikov Daniil <[email protected]>
1 parent 2796819 commit 3a87485

2 files changed

Lines changed: 82 additions & 10 deletions

File tree

‎packages/core/installer/templates/cozy-system-labels.yaml‎

Lines changed: 82 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,82 @@
1+
{{/*
2+
Pre-install/upgrade hook that labels the cozy-system namespace with the
3+
PodSecurity and cozystack identity labels. The chart no longer ships a
4+
Namespace resource (helm v3 cannot adopt a namespace pre-created by
5+
--create-namespace because it lacks helm meta annotations; without
6+
--create-namespace, helm fails to write its release-secret because the
7+
namespace does not exist yet — chicken-and-egg).
8+
Install commands now use --create-namespace to bootstrap the namespace,
9+
and this hook patches the labels the operator depends on (notably
10+
pod-security.kubernetes.io/enforce=privileged for the host-network
11+
operator pod).
12+
*/}}
13+
---
14+
apiVersion: v1
15+
kind: ServiceAccount
16+
metadata:
17+
name: cozy-system-labeler
18+
namespace: cozy-system
19+
annotations:
20+
helm.sh/hook: pre-install,pre-upgrade
21+
helm.sh/hook-weight: "-200"
22+
helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
23+
---
24+
apiVersion: rbac.authorization.k8s.io/v1
25+
kind: ClusterRole
26+
metadata:
27+
name: cozy-system-labeler
28+
annotations:
29+
helm.sh/hook: pre-install,pre-upgrade
30+
helm.sh/hook-weight: "-180"
31+
helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
32+
rules:
33+
- apiGroups: [""]
34+
resources: ["namespaces"]
35+
resourceNames: ["cozy-system"]
36+
verbs: ["get", "patch"]
37+
---
38+
apiVersion: rbac.authorization.k8s.io/v1
39+
kind: ClusterRoleBinding
40+
metadata:
41+
name: cozy-system-labeler
42+
annotations:
43+
helm.sh/hook: pre-install,pre-upgrade
44+
helm.sh/hook-weight: "-160"
45+
helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
46+
subjects:
47+
- kind: ServiceAccount
48+
name: cozy-system-labeler
49+
namespace: cozy-system
50+
roleRef:
51+
kind: ClusterRole
52+
name: cozy-system-labeler
53+
apiGroup: rbac.authorization.k8s.io
54+
---
55+
apiVersion: batch/v1
56+
kind: Job
57+
metadata:
58+
name: cozy-system-labeler
59+
namespace: cozy-system
60+
annotations:
61+
helm.sh/hook: pre-install,pre-upgrade
62+
helm.sh/hook-weight: "-100"
63+
helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
64+
spec:
65+
backoffLimit: 3
66+
ttlSecondsAfterFinished: 60
67+
template:
68+
spec:
69+
serviceAccountName: cozy-system-labeler
70+
restartPolicy: OnFailure
71+
containers:
72+
- name: kubectl
73+
image: alpine/k8s:1.32.0
74+
imagePullPolicy: IfNotPresent
75+
command:
76+
- kubectl
77+
- label
78+
- --overwrite
79+
- namespace
80+
- cozy-system
81+
- cozystack.io/system=true
82+
- pod-security.kubernetes.io/enforce=privileged

‎packages/core/installer/templates/cozystack-operator.yaml‎

Lines changed: 0 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -4,16 +4,6 @@
44
{{- end -}}
55
---
66
apiVersion: v1
7-
kind: Namespace
8-
metadata:
9-
name: cozy-system
10-
labels:
11-
cozystack.io/system: "true"
12-
pod-security.kubernetes.io/enforce: privileged
13-
annotations:
14-
helm.sh/resource-policy: keep
15-
---
16-
apiVersion: v1
177
kind: ServiceAccount
188
metadata:
199
name: cozystack

0 commit comments

Comments
 (0)