Add pre-delete hook to strip GatewayClass finalizer on uninstall

Signed-off-by: Md. Istiak <mdistiak@appscode.com>

Author: Istiak2019331114

charts/service-gateway/templates/_helpers.tpl

@@ -81,3 +81,36 @@ Returns if ubi images are to be used
 {{- define "operator.ubi" -}}
 {{ ternary "-ubi" "" (list "operator" "all" | has (default (dig "ubi" "" (default dict .Values.distro)) .Values.global.distro.ubi)) }}
 {{- end }}
+
+{{/*
+Create the name of the service account to use
+*/}}
+{{- define "appscode.serviceAccountName" -}}
+{{- if .Values.global.serviceAccount.create }}
+{{- default (include "service-gateway.fullname" .) .Values.global.serviceAccount.name }}
+{{- else if .Values.serviceAccount }}
+{{- default "default" .Values.serviceAccount.name }}
+{{- else }}
+{{- "default" }}
+{{- end }}
+{{- end }}
+
+{{/*
+Returns the registry used for kubectl docker image
+*/}}
+{{- define "kubectl.registry" -}}
+{{- list .Values.global.registryFQDN (default .Values.kubectl.registry .Values.global.registry) | compact | join "/" }}
+{{- end }}
+
+{{/*
+Returns the appscode image pull secrets
+*/}}
+{{- define "appscode.imagePullSecrets" -}}
+{{- with .Values.global.imagePullSecrets -}}
+imagePullSecrets:
+{{- toYaml . | nindent 2 }}
+{{- else -}}
+imagePullSecrets:
+{{- toYaml $.Values.imagePullSecrets | nindent 2 }}
+{{- end }}
+{{- end }}

charts/service-gateway/templates/cleaner/job.yaml

@@ -0,0 +1,43 @@
+{{- if .Values.cleaner.enabled -}}
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: {{ include "service-gateway.fullname" . }}-gwclass-cleaner
+  namespace: {{ .Release.Namespace }}
+  annotations:
+    "helm.sh/hook-weight": "0"
+    "helm.sh/hook": pre-delete
+    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
+spec:
+  backoffLimit: 3
+  template:
+    spec:
+      {{- include "appscode.imagePullSecrets" . | nindent 6 }}
+      serviceAccountName: {{ include "service-gateway.fullname" . }}-gwclass-cleaner
+      automountServiceAccountToken: true
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 65534
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+        - name: kubectl
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop: ["ALL"]
+            privileged: false
+            readOnlyRootFilesystem: true
+            runAsNonRoot: true
+            runAsUser: 65534
+            seccompProfile:
+              type: RuntimeDefault
+          image: "{{ include "kubectl.registry" . }}/{{ .Values.kubectl.repository }}:{{ .Values.kubectl.tag }}"
+          imagePullPolicy: {{ .Values.kubectl.pullPolicy }}
+          command:
+          - /bin/sh
+          - -c
+          - |
+            kubectl patch gatewayclass {{ include "tenant.name" . }} --type=merge -p '{"metadata":{"finalizers":null}}' || true
+      restartPolicy: Never
+{{- end }}

charts/service-gateway/templates/cleaner/rbac.yaml

@@ -0,0 +1,34 @@
+{{- if .Values.cleaner.enabled -}}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ include "service-gateway.fullname" . }}-gwclass-cleaner-{{ .Release.Namespace }}
+  annotations:
+    "helm.sh/hook-weight": "0"
+    "helm.sh/hook": pre-delete
+    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
+rules:
+- apiGroups:
+  - gateway.networking.k8s.io
+  resources:
+  - gatewayclasses
+  verbs: ["get", "patch"]
+---
+
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ include "service-gateway.fullname" . }}-gwclass-cleaner-{{ .Release.Namespace }}
+  annotations:
+    "helm.sh/hook-weight": "0"
+    "helm.sh/hook": pre-delete
+    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ include "service-gateway.fullname" . }}-gwclass-cleaner-{{ .Release.Namespace }}
+subjects:
+- kind: ServiceAccount
+  name: {{ include "service-gateway.fullname" . }}-gwclass-cleaner
+  namespace: {{ .Release.Namespace }}
+{{- end }}

charts/service-gateway/templates/cleaner/serviceaccount.yaml

@@ -0,0 +1,11 @@
+{{- if and .Values.cleaner.enabled .Values.global.serviceAccount.create -}}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ include "service-gateway.fullname" . }}-gwclass-cleaner
+  namespace: {{ .Release.Namespace }}
+  annotations:
+    "helm.sh/hook-weight": "0"
+    "helm.sh/hook": pre-delete
+    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
+{{- end }}

charts/service-gateway/values.yaml

@@ -14,6 +14,31 @@ global:
     # Set operator or all to use ubi images
     ubi: ""
 
+  # Docker registry used to pull app related images
+  registry: ""
+
+  # Docker registry fqdn used to pull app related images.
+  # Set this to use docker registry hosted at ${registryFQDN}/${registry}/${image}
+  registryFQDN: ghcr.io
+
+  # Specify an array of imagePullSecrets.
+  # Secrets must be manually created in the namespace.
+  #
+  # Example:
+  # helm template charts/service-gateway \
+  #   --set global.imagePullSecrets[0].name=sec0 \
+  #   --set global.imagePullSecrets[1].name=sec1
+  imagePullSecrets: []
+
+  serviceAccount:
+    # Specifies whether a service account should be created
+    create: true
+    # Annotations to add to the service account
+    annotations: {}
+    # The name of the service account to use.
+    # If not set and create is true, a name is generated using the fullname template
+    name: ""
+
 clusterMetadata:
   uid: tbd
   name: tbd
@@ -144,3 +169,19 @@ vaultServer:
   name: "vault"
   # Vault server namespace that exist on cluster
   namespace: "ace"
+
+# Docker registry containing kubectl image
+kubectl:
+  # Docker registry used to pull app container image
+  registry: appscode
+  # App container image
+  repository: kubectl-nonroot
+  # Overrides the image tag whose default is the chart appVersion.
+  tag: "1.34"
+  pullPolicy: IfNotPresent
+
+# Pre-delete hook that strips the GatewayClass finalizer so the chart uninstalls cleanly.
+# Disabled by default. Enable when the envoy-gateway controller is deployed as a sub-chart
+# and shuts down before it can remove the finalizer.
+cleaner:
+  enabled: false