iilc
13b9fae61c
Bug en chart 0.2.x: AddonClaim era Helm hook pre-install,pre-upgrade weight -10 SIN hook-delete-policy. El default Helm 3 es before-hook-creation → borra el claim en cada upgrade → finalizer cleanup-logical rotaba credenciales + atoraba release en pending-upgrade. Cambios: - helm/APP_NAME/templates/addonclaim.yaml eliminado. - manifests/addonclaim.yaml creado con placeholders sed. - scripts/pre-helm-detach.sh idempotente para migracion v1.0.0 → 1.1.0. - .gitea/workflows/APP_NAME-build.yaml: 2 nuevos steps detach + apply AddonClaim entre kubeconfig y helm upgrade. - Chart.yaml bump 0.2.0 → 0.3.0. - README reescrito (3 pasos workflow + tabla hooks sin AddonClaim + seccion Por que FUERA del chart + opt-out actualizado). - Comentarios stale del AddonClaim como hook -10 limpiados en networkpolicy.yaml, role-db-secret-reader.yaml, job-alembic-upgrade.yaml. ADR-066 del IDP documenta la decision arquitectural completa.
35 lines
1.4 KiB
YAML
35 lines
1.4 KiB
YAML
# AddonClaim — vive FUERA del chart Helm (ADR-066).
|
|
#
|
|
# El workflow del tenant sustituye los placeholders con `sed` y aplica con
|
|
# `kubectl apply -f -` ANTES de `helm upgrade --install`. helm nunca lo
|
|
# trackea — al `helm uninstall` no lo borra; al `helm upgrade --install`
|
|
# repetido no lo toca. Idempotente.
|
|
#
|
|
# Lifecycle gobernado por addon-provisioner (CRD idp.coralware.cloud/v1alpha1):
|
|
# - reconcilia cada RECONCILE_INTERVAL (default 300s) por TenantProfile.
|
|
# - crea BD logica + user + GRANT via Job DDL efimero en cluster tenant.
|
|
# - publica Secret `${RELEASE_NAME}-db-creds` en ns `apps`.
|
|
# - agrega finalizer `addon-provisioner.idp.coralware.cloud/cleanup-logical`.
|
|
#
|
|
# Cleanup explicito post `helm uninstall`:
|
|
# kubectl delete addonclaim ${RELEASE_NAME}-db -n apps
|
|
# (con deletionPolicy: Retain — default — preserva la BD; Event
|
|
# OrphanLogicalDatabase. Cambiar a Delete previo para DROP DATABASE.)
|
|
apiVersion: idp.coralware.cloud/v1alpha1
|
|
kind: AddonClaim
|
|
metadata:
|
|
name: ${RELEASE_NAME}-db
|
|
namespace: apps
|
|
labels:
|
|
app.kubernetes.io/name: ${RELEASE_NAME}
|
|
app.kubernetes.io/part-of: ${RELEASE_NAME}
|
|
idp.coralware.cloud/golden-path: web-backend
|
|
idp.coralware.cloud/golden-path-lang: python
|
|
spec:
|
|
addonType: mariadb
|
|
databaseName: ${DATABASE_NAME}
|
|
user:
|
|
permissions: rw
|
|
secretName: ${RELEASE_NAME}-db-creds
|
|
deletionPolicy: Retain
|