fix(kubernetes-nodes): reap the pre-delete unpin hook Job after it finishes

The unpin Job carried only helm.sh/hook-delete-policy: before-hook-creation,
and its comment claimed a successful run is torn down with the release. Helm
does not track hook resources as release members, so after helm uninstall the
succeeded Job and its pod remained in the tenant namespace indefinitely, one
per deleted pool name per namespace — before-hook-creation only fires on a
next pre-delete of a same-named release, which never comes for a deleted pool.

Add spec.ttlSecondsAfterFinished: 86400 so a finished Job is garbage-collected
(a failed run still keeps its logs for a day), and correct the comment.

Signed-off-by: IvanHunters <xorokhotnikov@gmail.com>

packages/apps/kubernetes-nodes/templates/pre-delete-unpin.yaml

@@ -110,10 +110,17 @@ metadata:
   annotations:
     helm.sh/hook: pre-delete
     helm.sh/hook-weight: "0"
-    # before-hook-creation only (not hook-succeeded) so a failed run keeps its
-    # logs for debugging; a successful run is torn down with the release.
+    # before-hook-creation (not hook-succeeded) so a failed run keeps its logs
+    # for debugging. Helm does not track hook resources as release members, so
+    # after `helm uninstall` a finished hook Job is NOT torn down with the
+    # release and would leak into the tenant namespace, one per deleted pool.
+    # ttlSecondsAfterFinished (below) is what actually reaps it.
     helm.sh/hook-delete-policy: before-hook-creation
 spec:
+  # Garbage-collect the finished Job and its pod: a succeeded run is reaped after
+  # a day, a failed run keeps its logs that long for debugging. Without this the
+  # hook Job leaks per deleted pool per namespace, since Helm never owns it.
+  ttlSecondsAfterFinished: 86400
   activeDeadlineSeconds: 300
   backoffLimit: 3
   template:

packages/apps/kubernetes-nodes/tests/pre_delete_unpin_test.yaml

@@ -37,6 +37,11 @@ tests:
       - equal:
           path: spec.activeDeadlineSeconds
           value: 300
+      # Helm does not own hook resources, so the finished Job must self-reap or it
+      # leaks into the tenant namespace after every pool uninstall.
+      - equal:
+          path: spec.ttlSecondsAfterFinished
+          value: 86400
       - equal:
           path: spec.template.spec.serviceAccountName
           value: kubernetes-nodes-myk8s-md0-unpin