smruthi2187andGitHub
2e37611da8
It is mandatory (from this release onwards) for function to refer to secrets, config-maps and packages in its own namespace to ensure isolation of users sharing the same cluster. This change runs a pre-upgrade job to verify function references for all functions created prior to this release and fails the upgrade by printing a list of functions that violate this restriction.
33 lines
1.2 KiB
YAML
33 lines
1.2 KiB
YAML
apiVersion: batch/v1
|
|
kind: Job
|
|
metadata:
|
|
name: {{ template "fullname" . }}-{{ .Chart.Version }}-{{ randNumeric 3 }}
|
|
labels:
|
|
# The "release" convention makes it easy to tie a release to all of the
|
|
# Kubernetes resources that were created as part of that release.
|
|
release: "{{ .Release.Name }}"
|
|
# This makes it easy to audit chart usage.
|
|
chart: {{ .Chart.Name }}-{{ .Chart.Version }}
|
|
app: {{ template "name" . }}
|
|
annotations:
|
|
# This is what defines this resource as a hook. Without this line, the
|
|
# job is considered part of the release.
|
|
"helm.sh/hook": pre-upgrade
|
|
"helm.sh/hook-delete-policy": hook-succeeded
|
|
spec:
|
|
backoffLimit: 0
|
|
template:
|
|
metadata:
|
|
name: {{ template "fullname" . }}
|
|
labels:
|
|
release: "{{ .Release.Name }}"
|
|
app: {{ template "name" . }}
|
|
spec:
|
|
restartPolicy: Never
|
|
containers:
|
|
- name: pre-upgrade-job
|
|
image: {{ .Values.preUpgradeChecksImage }}:{{ .Values.imageTag }}
|
|
imagePullPolicy: {{ .Values.pullPolicy }}
|
|
command: [ "/pre-upgrade-checks" ]
|
|
args: ["--fn-pod-namespace", "{{ .Values.functionNamespace }}", "--envbuilder-namespace", "{{ .Values.builderNamespace }}"]
|
|
serviceAccount: fission-svc |