mirror of
https://github.com/cozystack/cozystack.git
synced 2026-11-08 21:14:56 +09:00
Aleksei Sviridkin
393b50de72
## What this PR does Two fixes to the tenant chart's `pre-delete` cleanup hook (the Job that deletes a tenant's HelmReleases when the tenant is removed). **1. Grant the `watch` verb so the hook stops hanging.** The hook runs `kubectl delete helmreleases ... --wait=true`. Since Kubernetes 1.25 that flag opens a watch on the target resources to block until finalization. The hook's Role granted only `get`, `list`, `delete`, so the watch was rejected with HTTP 403, `kubectl delete` hung indefinitely, the Job never finished, and tenant deletion stalled on the pre-delete hook. Adding `watch` brings the Role in line with the `kubernetes` app chart's cleanup Role, which already grants it for the same `--wait` deletes. **2. Replace the unmaintained image.** The Job ran kubectl from `bitnami/kubectl:latest`. The bitnami Docker Hub catalog has moved to a legacy/sunset state, so that pull is at risk of breaking — which would stop the hook from starting at all — and `:latest` leaves the kubectl version unpinned. It now uses `docker.io/clastix/kubectl:v1.32`, the version-pinned image already used by every other first-party cleanup/delete hook in the repo (kubernetes, keycloak-configure, dashboard, mariadb). That image is Alpine-based and ships only `/bin/sh`, so the hook script (pure POSIX) now invokes `/bin/sh` instead of `/bin/bash`. A helm-unittest suite pins all three invariants (watch verb, image, shell) so none can regress. ### Screenshots N/A — no UI impact. ### Release note ```release-note fix(tenant): grant the watch verb to the cleanup Role and move it to a maintained kubectl image so tenant deletion no longer hangs on the pre-delete hook ``` <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Improvements** * Expanded pre-delete cleanup RBAC permissions to include watching HelmRelease resources. * Hardened the cleanup Job runtime security settings for stronger container confinement. * Pinned the cleanup Job to a specific kubectl image version and switched the command interpreter for safer execution. * **Tests** * Added/extended automated validation for the pre-delete cleanup hook, covering RBAC rules, kubectl image pinning, command usage, and securityContext hardening. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
How to test packages local
cd packages/core/installer
make image-cozystack REGISTRY=YOUR_CUSTOM_REGISTRY
make apply
kubectl delete po -l app=source-controller -n cozy-fluxcd