From 2e65ce108b06bb485e5c3a4b8613a1111c0791ea Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=D0=90=D0=BB=D0=B5=D0=BA=D1=81=D0=B5=D0=B9=20=D0=90=D1=80?=
 =?UTF-8?q?=D1=82=D0=B0=D0=BC=D0=BE=D0=BD=D0=BE=D0=B2?=
 <alexeyartamonov1987@gmail.com>
Date: Mon, 29 Jun 2026 00:37:05 +0300
Subject: [PATCH] fix(clickhouse): guard migration when keeper CRD absent and
 quote hook scalars
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Address CodeRabbit review on #3072:

- Migration 45 now skips the backfill when the
  clickhousekeeperinstallations CRD is not installed. The migration runs
  platform-wide via targetVersion, so on clusters that never deployed
  ClickHouse the kubectl get would otherwise fail under set -euo pipefail
  and abort the whole upgrade.
- Quote the templated name/label/serviceAccountName scalars in the cleanup
  hook so the source parses under YAMLlint; rendered output is unchanged.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Алексей Артамонов <alexeyartamonov1987@gmail.com>
---
 .../templates/hooks/cleanup-pvc.yaml          | 24 +++++++++----------
 1 file changed, 12 insertions(+), 12 deletions(-)

diff --git a/packages/apps/clickhouse/templates/hooks/cleanup-pvc.yaml b/packages/apps/clickhouse/templates/hooks/cleanup-pvc.yaml
index 8b072a250..3e1df0bfc 100644
--- a/packages/apps/clickhouse/templates/hooks/cleanup-pvc.yaml
+++ b/packages/apps/clickhouse/templates/hooks/cleanup-pvc.yaml
@@ -2,9 +2,9 @@
 apiVersion: batch/v1
 kind: Job
 metadata:
-  name: {{ .Release.Name }}-cleanup
+  name: "{{ .Release.Name }}-cleanup"
   labels:
-    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/instance: "{{ .Release.Name }}"
   annotations:
     "helm.sh/hook": post-delete
     "helm.sh/hook-weight": "10"
@@ -13,10 +13,10 @@ spec:
   template:
     metadata:
       labels:
-        app.kubernetes.io/instance: {{ .Release.Name }}
+        app.kubernetes.io/instance: "{{ .Release.Name }}"
         policy.cozystack.io/allow-to-apiserver: "true"
     spec:
-      serviceAccountName: {{ .Release.Name }}-cleanup
+      serviceAccountName: "{{ .Release.Name }}-cleanup"
       restartPolicy: Never
       securityContext:
         runAsNonRoot: true
@@ -63,9 +63,9 @@ spec:
 apiVersion: v1
 kind: ServiceAccount
 metadata:
-  name: {{ .Release.Name }}-cleanup
+  name: "{{ .Release.Name }}-cleanup"
   labels:
-    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/instance: "{{ .Release.Name }}"
   annotations:
     "helm.sh/hook": post-delete
     "helm.sh/hook-weight": "0"
@@ -74,9 +74,9 @@ metadata:
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
 metadata:
-  name: {{ .Release.Name }}-cleanup
+  name: "{{ .Release.Name }}-cleanup"
   labels:
-    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/instance: "{{ .Release.Name }}"
   annotations:
     "helm.sh/hook": post-delete
     "helm.sh/hook-weight": "5"
@@ -89,9 +89,9 @@ rules:
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:
-  name: {{ .Release.Name }}-cleanup
+  name: "{{ .Release.Name }}-cleanup"
   labels:
-    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/instance: "{{ .Release.Name }}"
   annotations:
     "helm.sh/hook": post-delete
     "helm.sh/hook-weight": "5"
@@ -99,7 +99,7 @@ metadata:
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: Role
-  name: {{ .Release.Name }}-cleanup
+  name: "{{ .Release.Name }}-cleanup"
 subjects:
   - kind: ServiceAccount
-    name: {{ .Release.Name }}-cleanup
+    name: "{{ .Release.Name }}-cleanup"