fix(etcd): remove destructive post-upgrade cert-regeneration hook

The etcd chart shipped a `post-upgrade` Helm hook that `kubectl delete`d the
etcd TLS chain (`etcd-{ca,peer-ca,client,peer,server}-tls`) and then deleted
etcd pods on every chart upgrade, gated by a semver compare of an
`etcd-deployed-version` ConfigMap against `2.6.1`.

The hook was added as a one-shot migration for the chart `2.6.0 -> 2.6.1`
transition. Since commit f871fbdb ("Remove versions_map logic") all chart
versions are stamped as `0.0.0+<git-hash>`, which per semver is always
`< 2.6.1`. The gate therefore always resolves to "update certs", firing the
destructive hook on every etcd upgrade. On clusters running Kamaji-managed
tenant control planes this wipes the etcd CA, cert-manager re-issues it, and
tenant kube-apiservers hit `x509: certificate signed by unknown authority`
against `etcd.<ns>.svc:2379` until each tenant DataStore is manually
re-reconciled.

Commit 47d81f70 ("Disabled private key rotation in CA certs") already fixed
the underlying `rotationPolicy: Always` issue the migration was papering
over, so the hook has no remaining use. Remove the hook Job, its RBAC, the
version ConfigMap it read, and add a helm-unittest suite under
`packages/extra/etcd/tests/` that guards against re-introducing the hook
or the version ConfigMap.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
(cherry picked from commit c1508940bd)
(cherry picked from commit cbc1606c41)

packages/extra/etcd/Makefile

@@ -5,3 +5,6 @@ include ../../../hack/package.mk
 generate:
 	cozyvalues-gen -v values.yaml -s values.schema.json -r README.md
 	../../../hack/update-crd.sh
+
+test:
+	helm unittest .

packages/extra/etcd/templates/hook/job.yaml

@@ -1,39 +0,0 @@
-{{- $shouldUpdateCerts := true }}
-{{- $configMap := lookup "v1" "ConfigMap" .Release.Namespace "etcd-deployed-version" }}
-{{- if $configMap }}
-  {{- $deployedVersion := index $configMap "data" "version" }}
-  {{- if $deployedVersion | semverCompare ">= 2.6.1" }}
-    {{- $shouldUpdateCerts = false }}
-  {{- end }}
-{{- end }}
-
-{{- if $shouldUpdateCerts }}
----
-apiVersion: batch/v1
-kind: Job
-metadata:
-  name: etcd-hook
-  annotations:
-    helm.sh/hook: post-upgrade
-    helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
-spec:
-  template:
-    metadata:
-      labels:
-        policy.cozystack.io/allow-to-apiserver: "true"
-    spec:
-      serviceAccountName: etcd-hook
-      containers:
-        - name: kubectl
-          image: docker.io/alpine/k8s:1.33.4
-          command:
-          - sh
-          args:
-            - -exc
-            - |-
-              kubectl --namespace={{ .Release.Namespace }} delete secrets etcd-ca-tls etcd-peer-ca-tls 
-              sleep 10
-              kubectl --namespace={{ .Release.Namespace }} delete secrets etcd-client-tls etcd-peer-tls etcd-server-tls
-              kubectl --namespace={{ .Release.Namespace }} delete pods --selector=app.kubernetes.io/instance=etcd,app.kubernetes.io/managed-by=etcd-operator,app.kubernetes.io/name=etcd,cozystack.io/service=etcd
-      restartPolicy: Never
-{{- end }}

packages/extra/etcd/templates/hook/role.yaml

@@ -1,26 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  annotations:
-    helm.sh/hook: post-upgrade
-    helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
-  name: etcd-hook
-rules:
-- apiGroups:
-  - ""
-  resources:
-  - secrets
-  - pods
-  verbs:
-  - get
-  - list
-  - watch
-  - delete
-- apiGroups:
-  - ""
-  resources:
-  - configmaps
-  verbs:
-  - get
-  - list
-  - watch

packages/extra/etcd/templates/hook/rolebinding.yaml

@@ -1,15 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: etcd-hook
-  annotations:
-    helm.sh/hook: post-upgrade
-    helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: etcd-hook
-subjects:
-  - kind: ServiceAccount
-    name: etcd-hook
-    namespace: {{ .Release.Namespace | quote }}

packages/extra/etcd/templates/hook/serviceaccount.yaml

@@ -1,7 +0,0 @@
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: etcd-hook
-  annotations:
-    helm.sh/hook: post-upgrade
-    helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded

packages/extra/etcd/templates/version.yaml

@@ -1,6 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: etcd-deployed-version
-data:
-  version: {{ .Chart.Version }}

packages/extra/etcd/tests/no-post-upgrade-hook_test.yaml

@@ -0,0 +1,34 @@
+suite: etcd chart does not ship a destructive post-upgrade cert-regeneration hook
+
+release:
+  name: etcd
+  namespace: tenant-root
+
+templates:
+  - templates/check-release-name.yaml
+  - templates/dashboard-resourcemap.yaml
+  - templates/datastore.yaml
+  - templates/etcd-defrag.yaml
+  - templates/hook/job.yaml
+  - templates/podscrape.yaml
+  - templates/prometheus-rules.yaml
+  - templates/version.yaml
+
+tests:
+  - it: renders no Job named etcd-hook
+    documentSelector:
+      path: metadata.name
+      value: etcd-hook
+      skipEmptyTemplates: true
+    asserts:
+      - hasDocuments:
+          count: 0
+
+  - it: renders no ConfigMap named etcd-deployed-version
+    documentSelector:
+      path: metadata.name
+      value: etcd-deployed-version
+      skipEmptyTemplates: true
+    asserts:
+      - hasDocuments:
+          count: 0