Skip to content

Commit 65acc7b

Browse files
scooby87scooby87
committed
fix(seaweedfs): wait for ingress-nginx only when the tenant deploys it
seaweedfs-system waited for ingress-nginx-system whenever _namespace.ingress named its own namespace. cozystack-basics writes that value for tenant-root regardless of the root Tenant's spec.ingress, so enabling SeaweedFS on a root tenant without ingress left the release waiting for a HelmRelease nothing would create, and the backup bucket with it. The tenant chart creates the `ingress` HelmRelease only for spec.ingress and in the same render as `seaweedfs`, so its presence says whether ingress-nginx will run here, without waiting for the ingress release itself to reconcile first. Signed-off-by: Alexey Artamonov <[email protected]> Assisted-by: LLM
1 parent 4087218 commit 65acc7b

3 files changed

Lines changed: 211 additions & 1 deletion

File tree

‎packages/apps/tenant/tests/ingress_release_gate_test.yaml‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
suite: the ingress HelmRelease exists only for a tenant with spec.ingress
2+
3+
# extra/seaweedfs makes seaweedfs-system wait for ingress-nginx-system only
4+
# when it finds the HelmRelease `ingress` next to it, because tenant-root's
5+
# `_namespace.ingress` is hardcoded and cannot answer that. Pin the name, the
6+
# namespace and the gate that lookup relies on.
7+
8+
templates:
9+
- templates/ingress.yaml
10+
- templates/seaweedfs.yaml
11+
12+
release:
13+
name: tenant-root
14+
namespace: tenant-root
15+
16+
tests:
17+
- it: renders no ingress HelmRelease for a root tenant with seaweedfs and no ingress
18+
set:
19+
ingress: false
20+
seaweedfs: true
21+
asserts:
22+
- template: templates/ingress.yaml
23+
hasDocuments:
24+
count: 0
25+
- template: templates/seaweedfs.yaml
26+
equal:
27+
path: metadata.namespace
28+
value: tenant-root
29+
30+
- it: renders the ingress HelmRelease next to seaweedfs for a root tenant with ingress
31+
set:
32+
ingress: true
33+
seaweedfs: true
34+
asserts:
35+
- template: templates/ingress.yaml
36+
equal:
37+
path: metadata.name
38+
value: ingress
39+
- template: templates/ingress.yaml
40+
equal:
41+
path: metadata.namespace
42+
value: tenant-root
43+
- template: templates/seaweedfs.yaml
44+
equal:
45+
path: metadata.namespace
46+
value: tenant-root

‎packages/extra/seaweedfs/templates/seaweedfs.yaml‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -200,7 +200,12 @@ metadata:
200200
spec:
201201
dependsOn:
202202
- name: {{ .Release.Name }}-db
203-
{{- if eq $ingress .Release.Namespace }}
203+
{{- /* tenant-root's _namespace.ingress is hardcoded by cozystack-basics, so it
204+
does not say whether ingress-nginx-system will ever exist here; the
205+
tenant chart creates the `ingress` HelmRelease in the same render as
206+
this release, and only for spec.ingress. */}}
207+
{{- $localIngress := lookup "helm.toolkit.fluxcd.io/v2" "HelmRelease" .Release.Namespace "ingress" }}
208+
{{- if and (eq $ingress .Release.Namespace) $localIngress }}
204209
# Ensure the ingress-nginx admission webhook is ready before creating Ingress resources.
205210
# Only when this tenant owns its ingress; sub-tenants inherit ingress from a parent
206211
# namespace where ingress-nginx-system already runs, and the dependency would deadlock

‎packages/extra/seaweedfs/tests/ingress_dependency_test.yaml‎

Lines changed: 159 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,159 @@
1+
suite: seaweedfs-system waits for ingress-nginx only when the tenant deploys it
2+
3+
# cozystack-basics writes `_namespace.ingress: tenant-root` whatever the root
4+
# Tenant says, so for tenant-root the value does not tell whether
5+
# ingress-nginx-system exists. The HelmRelease `ingress`, which the tenant
6+
# chart creates in the same render as `seaweedfs` and only for spec.ingress,
7+
# does.
8+
9+
templates:
10+
- templates/seaweedfs.yaml
11+
12+
release:
13+
name: seaweedfs
14+
namespace: tenant-root
15+
16+
set: &values
17+
topology: Simple
18+
replicationFactor: 2
19+
_namespace:
20+
host: example.org
21+
ingress: tenant-root
22+
_cluster:
23+
issuer-name: letsencrypt-prod
24+
solver: http01
25+
26+
documentSelector: &systemHR
27+
path: metadata.name
28+
value: seaweedfs-system
29+
30+
tests:
31+
- it: depends on ingress-nginx-system when the tenant deploys its ingress
32+
set: *values
33+
documentSelector: *systemHR
34+
kubernetesProvider:
35+
scheme: &scheme
36+
"v1/Namespace":
37+
gvr:
38+
group: ""
39+
version: "v1"
40+
resource: "namespaces"
41+
namespaced: false
42+
"v1/PersistentVolumeClaim":
43+
gvr:
44+
group: ""
45+
version: "v1"
46+
resource: "persistentvolumeclaims"
47+
namespaced: true
48+
"apps/v1/StatefulSet":
49+
gvr:
50+
group: "apps"
51+
version: "v1"
52+
resource: "statefulsets"
53+
namespaced: true
54+
"helm.toolkit.fluxcd.io/v2/HelmRelease":
55+
gvr:
56+
group: "helm.toolkit.fluxcd.io"
57+
version: "v2"
58+
resource: "helmreleases"
59+
namespaced: true
60+
objects:
61+
- &rootNS
62+
kind: Namespace
63+
apiVersion: v1
64+
metadata:
65+
name: tenant-root
66+
- &unrelatedPVC
67+
kind: PersistentVolumeClaim
68+
apiVersion: v1
69+
metadata:
70+
name: unrelated-app-data-0
71+
namespace: tenant-root
72+
- &unrelatedSTS
73+
kind: StatefulSet
74+
apiVersion: apps/v1
75+
metadata:
76+
name: unrelated-app
77+
namespace: tenant-root
78+
- &ingressHR
79+
kind: HelmRelease
80+
apiVersion: helm.toolkit.fluxcd.io/v2
81+
metadata:
82+
name: ingress
83+
namespace: tenant-root
84+
asserts:
85+
- equal:
86+
path: spec.dependsOn
87+
value:
88+
- name: seaweedfs-db
89+
- name: ingress-nginx-system
90+
namespace: tenant-root
91+
92+
- it: does not depend on ingress-nginx-system when the root tenant runs no ingress
93+
set: *values
94+
documentSelector: *systemHR
95+
kubernetesProvider:
96+
scheme: *scheme
97+
objects:
98+
- *rootNS
99+
- *unrelatedPVC
100+
- *unrelatedSTS
101+
asserts:
102+
- equal:
103+
path: spec.dependsOn
104+
value:
105+
- name: seaweedfs-db
106+
107+
- it: ignores an ingress HelmRelease in another namespace
108+
set: *values
109+
documentSelector: *systemHR
110+
kubernetesProvider:
111+
scheme: *scheme
112+
objects:
113+
- *rootNS
114+
- *unrelatedPVC
115+
- *unrelatedSTS
116+
- kind: HelmRelease
117+
apiVersion: helm.toolkit.fluxcd.io/v2
118+
metadata:
119+
name: ingress
120+
namespace: tenant-other
121+
asserts:
122+
- equal:
123+
path: spec.dependsOn
124+
value:
125+
- name: seaweedfs-db
126+
127+
- it: does not depend on it while the values still name a parent tenant's ingress
128+
set: *values
129+
release:
130+
namespace: tenant-child
131+
documentSelector: *systemHR
132+
kubernetesProvider:
133+
scheme: *scheme
134+
objects:
135+
- kind: Namespace
136+
apiVersion: v1
137+
metadata:
138+
name: tenant-child
139+
- *unrelatedPVC
140+
- *unrelatedSTS
141+
- kind: HelmRelease
142+
apiVersion: helm.toolkit.fluxcd.io/v2
143+
metadata:
144+
name: ingress
145+
namespace: tenant-child
146+
asserts:
147+
- equal:
148+
path: spec.dependsOn
149+
value:
150+
- name: seaweedfs-db
151+
152+
- it: renders without the dependency on a client-side render
153+
set: *values
154+
documentSelector: *systemHR
155+
asserts:
156+
- equal:
157+
path: spec.dependsOn
158+
value:
159+
- name: seaweedfs-db

0 commit comments

Comments
 (0)