feat: support policy updates on upgrades (#35)

* feat: support policy updates on upgrades * try rollout restart * update job Release-As: v6.0.4-uds.2
defenseunicorns · Dec 3, 2024 · d64de86 · d64de86
1 parent 133477c
commit d64de86
Show file tree

Hide file tree

Showing 2 changed files with 17 additions and 9 deletions.
diff --git a/chart/templates/job.yaml b/chart/templates/job.yaml
@@ -6,7 +6,7 @@
 apiVersion: batch/v1
 kind: Job
 metadata:
-  name: {{ .name }}-minio-setup
+  name: {{ .name }}-minio-setup-{{ $.Release.Revision }}
   namespace: minio
 spec:
   template:
@@ -17,13 +17,16 @@ spec:
         command: [{{ $.Values.mcShell | quote }}, "-c"]
         args:
           - |
-            mc alias set myminio $MINIO_SERVER $MINIO_ACCESS_KEY $MINIO_SECRET_KEY;
+            # If we cannot connect to the minio cluster kill the Job to force a restart
+            mc alias set myminio $MINIO_SERVER $MINIO_ACCESS_KEY $MINIO_SECRET_KEY || exit 1;
+
             {{- range $bucket := .bucketNames }}
-            mc mb myminio/{{ $bucket }};
+            mc mb --ignore-existing myminio/{{ $bucket }};
             {{- end }}
+
             mc admin policy create myminio {{ .name }}-policy /config/policy.json;
             mc admin user add myminio $USER $USER_SECRET;
-            mc admin policy attach myminio {{ .name }}-policy --user $USER;
+            mc admin policy attach myminio {{ .name }}-policy --user $USER || echo Skipping user attachment;
         env:
         - name: MINIO_SERVER
           value: "http://uds-minio-hl.minio.svc.cluster.local:9000"
@@ -56,11 +59,12 @@ spec:
           mountPath: /tmp
       restartPolicy: OnFailure
       volumes:
-      - name: policy-config
-        configMap:
-          name: {{ .name }}-minio-policy
-      - name: config-volume
-        emptyDir: {}
+        - name: policy-config
+          configMap:
+            name: {{ .name }}-minio-policy
+        - name: config-volume
+          emptyDir: {}
+      restartPolicy: OnFailure
   backoffLimit: 4
 ---
 {{- end }}
diff --git a/common/zarf.yaml b/common/zarf.yaml
@@ -40,6 +40,10 @@ components:
     actions:
       onDeploy:
         after:
+          - cmd: ./zarf tools kubectl -n minio rollout restart statefulset
+            description: Restart Minio StatefulSet so pods cycle on upgrades
+          - cmd: ./zarf tools kubectl -n minio rollout status statefulset
+            description: Wait for Rollout to complete before continuing
           - description: Validate Minio Operator Package
             maxTotalSeconds: 300
             wait: