werf
Hooks cleaned up too early
Before proceeding
- [X] I didn't find a similar issue
Version
werf 2.6.0
How to reproduce
Deploy these resources:
apiVersion: v1
kind: ServiceAccount
metadata:
name: sa
annotations:
"helm.sh/hook": post-install, post-upgrade
"helm.sh/hook-delete-policy": hook-succeeded
...
---
apiVersion: batch/v1
kind: Job
metadata:
name: job
annotations:
"helm.sh/hook": post-install, post-upgrade
"helm.sh/hook-delete-policy": hook-succeeded
...
Result
Service Account will be deleted too early, resulting in error.
Expected result
Service Account deleted along with the Job at the very end, after both are executed.
Additional information
Helm 3 deletes hooks after all the hooks in pre or post stage are deployed. In Nelm we delete hook immediately after it is deployed. This breaks backwards compatibility.
Probably we should have a separate stage to cleanup all hooks at once, which will be executed after all hooks deployed, just like in Helm 3.
As a temporary workaround, remove hook-succeeded from helm.sh/hook-delete-policy annotation (or just overwrite it like this: nelm release install --annotations="helm.sh/hook-delete-policy=before-hook-creation")
ingress-nginx 4.12.1 is also affected.
It has two Jobs requiring extra permissions (ServiceAccount + ClusterRole + ClusterRoleBinding). https://github.com/kubernetes/ingress-nginx/blob/helm-chart-4.12.1/charts/ingress-nginx/templates/admission-webhooks/job-patch/
The workaround from the previous message works fine 🎉.
