From a1ee339b5a5ee4adaf6ada15bee99ce15a02682d Mon Sep 17 00:00:00 2001 From: IvanHunters Date: Wed, 22 Jul 2026 18:30:52 +0300 Subject: [PATCH] fix(kubernetes-nodes): reap the pre-delete unpin hook Job after it finishes MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The unpin Job carried only helm.sh/hook-delete-policy: before-hook-creation, and its comment claimed a successful run is torn down with the release. Helm does not track hook resources as release members, so after helm uninstall the succeeded Job and its pod remained in the tenant namespace indefinitely, one per deleted pool name per namespace — before-hook-creation only fires on a next pre-delete of a same-named release, which never comes for a deleted pool. Add spec.ttlSecondsAfterFinished: 86400 so a finished Job is garbage-collected (a failed run still keeps its logs for a day), and correct the comment. Signed-off-by: IvanHunters --- .../kubernetes-nodes/templates/pre-delete-unpin.yaml | 11 +++++++++-- .../kubernetes-nodes/tests/pre_delete_unpin_test.yaml | 5 +++++ 2 files changed, 14 insertions(+), 2 deletions(-) diff --git a/packages/apps/kubernetes-nodes/templates/pre-delete-unpin.yaml b/packages/apps/kubernetes-nodes/templates/pre-delete-unpin.yaml index d430bb510..8bc623962 100644 --- a/packages/apps/kubernetes-nodes/templates/pre-delete-unpin.yaml +++ b/packages/apps/kubernetes-nodes/templates/pre-delete-unpin.yaml @@ -110,10 +110,17 @@ metadata: annotations: helm.sh/hook: pre-delete helm.sh/hook-weight: "0" - # before-hook-creation only (not hook-succeeded) so a failed run keeps its - # logs for debugging; a successful run is torn down with the release. + # before-hook-creation (not hook-succeeded) so a failed run keeps its logs + # for debugging. Helm does not track hook resources as release members, so + # after `helm uninstall` a finished hook Job is NOT torn down with the + # release and would leak into the tenant namespace, one per deleted pool. + # ttlSecondsAfterFinished (below) is what actually reaps it. helm.sh/hook-delete-policy: before-hook-creation spec: + # Garbage-collect the finished Job and its pod: a succeeded run is reaped after + # a day, a failed run keeps its logs that long for debugging. Without this the + # hook Job leaks per deleted pool per namespace, since Helm never owns it. + ttlSecondsAfterFinished: 86400 activeDeadlineSeconds: 300 backoffLimit: 3 template: diff --git a/packages/apps/kubernetes-nodes/tests/pre_delete_unpin_test.yaml b/packages/apps/kubernetes-nodes/tests/pre_delete_unpin_test.yaml index b4e271779..097c035cf 100644 --- a/packages/apps/kubernetes-nodes/tests/pre_delete_unpin_test.yaml +++ b/packages/apps/kubernetes-nodes/tests/pre_delete_unpin_test.yaml @@ -37,6 +37,11 @@ tests: - equal: path: spec.activeDeadlineSeconds value: 300 + # Helm does not own hook resources, so the finished Job must self-reap or it + # leaks into the tenant namespace after every pool uninstall. + - equal: + path: spec.ttlSecondsAfterFinished + value: 86400 - equal: path: spec.template.spec.serviceAccountName value: kubernetes-nodes-myk8s-md0-unpin