Revert to kube-system, graceful uninstall

yerzhan7 · yerzhan7 · commit 205639d90ec2 · 2026-02-06T12:50:10.000Z
diff --git a/.github/workflows/e2e-rosa-tests.yaml b/.github/workflows/e2e-rosa-tests.yaml
@@ -139,7 +139,7 @@ jobs:
           ACTION: "install_driver"
           TAG: "untested_${{ inputs.ref }}"
           CSI_DRIVER_IRSA_ROLE_ARN: "arn:aws:iam::${{ steps.aws-creds.outputs.aws-account-id }}:role/s3-csi-${{ inputs.environment }}-driver-irsa"
-          CSI_DRIVER_NAMESPACE: "openshift-cluster-csi-drivers"
+          IS_OPENSHIFT: "true"
         run: |
           tests/e2e-kubernetes/scripts/run.sh
       - name: Run E2E Tests
@@ -155,14 +155,14 @@ jobs:
         run: |
           tests/e2e-kubernetes/scripts/run.sh
       - name: Uninstall the driver
-        # if: always()
+        if: always()
         env:
           ACTION: "uninstall_driver"
-          CSI_DRIVER_NAMESPACE: "openshift-cluster-csi-drivers"
+          IS_OPENSHIFT: "true"
         run: |
           tests/e2e-kubernetes/scripts/run.sh
       - name: Delete ROSA cluster
-        # if: always()
+        if: always()
         env:
           TF_VAR_aws_region: "${{ vars.AWS_REGION }}"
           TF_VAR_cluster_name: "s3-csi-${{ inputs.environment }}"
diff --git a/tests/e2e-kubernetes/rosa/main.tf b/tests/e2e-kubernetes/rosa/main.tf
@@ -87,7 +87,7 @@ resource "aws_iam_role" "csi_driver_irsa" {
         Action = "sts:AssumeRoleWithWebIdentity"
         Condition = {
           StringEquals = {
-            "${replace(module.hcp.oidc_endpoint_url, "https://", "")}:sub" = "system:serviceaccount:openshift-cluster-csi-drivers:s3-csi-driver-sa"
+            "${replace(module.hcp.oidc_endpoint_url, "https://", "")}:sub" = "system:serviceaccount:kube-system:s3-csi-driver-sa"
           }
         }
       }
diff --git a/tests/e2e-kubernetes/scripts/helm.sh b/tests/e2e-kubernetes/scripts/helm.sh
@@ -19,10 +19,19 @@ function helm_uninstall_driver() {
   KUBECTL_BIN=${2}
   RELEASE_NAME=${3}
   KUBECONFIG=${4}
-  NAMESPACE=${5}
+  IS_OPENSHIFT=${5}
+
   if driver_installed ${HELM_BIN} ${RELEASE_NAME} ${KUBECONFIG}; then
-    $HELM_BIN uninstall $RELEASE_NAME --namespace $NAMESPACE --kubeconfig $KUBECONFIG
-    $KUBECTL_BIN wait --for=delete pod --selector="app=s3-csi-node" -n $NAMESPACE --timeout=60s --kubeconfig $KUBECONFIG
+    if [[ "${IS_OPENSHIFT}" == "true" ]]; then
+      echo "OpenShift cluster detected - using graceful Helm uninstall as ClusterRoleBindings cannot be deleted due to admission webhooks."
+      set +e
+      $HELM_BIN uninstall $RELEASE_NAME --namespace kube-system --kubeconfig $KUBECONFIG
+      set -e
+    else
+      $HELM_BIN uninstall $RELEASE_NAME --namespace kube-system --kubeconfig $KUBECONFIG
+    fi
+
+    $KUBECTL_BIN wait --for=delete pod --selector="app=s3-csi-node" -n kube-system --timeout=60s --kubeconfig $KUBECONFIG
   else
     echo "driver does not seem to be installed"
   fi
@@ -38,14 +47,14 @@ function helm_install_driver() {
   TAG=${5}
   KUBECONFIG=${6}
   CSI_DRIVER_IRSA_ROLE_ARN=${7}
-  NAMESPACE=${8}
+  IS_OPENSHIFT=${8}
 
   helm_uninstall_driver \
     "$HELM_BIN" \
     "$KUBECTL_BIN" \
     "$RELEASE_NAME" \
     "$KUBECONFIG" \
-    "$NAMESPACE"
+    "$IS_OPENSHIFT"
 
   if [[ -n "${CSI_DRIVER_IRSA_ROLE_ARN}" ]]; then
     echo "Configuring IRSA for CSI driver with role: ${CSI_DRIVER_IRSA_ROLE_ARN}"
@@ -55,7 +64,7 @@ function helm_install_driver() {
     IRSA_FLAG=""
   fi
 
-  $HELM_BIN upgrade --install $RELEASE_NAME --namespace $NAMESPACE ./charts/aws-mountpoint-s3-csi-driver --values \
+  $HELM_BIN upgrade --install $RELEASE_NAME --namespace kube-system ./charts/aws-mountpoint-s3-csi-driver --values \
     ./charts/aws-mountpoint-s3-csi-driver/values.yaml \
     --set image.repository=${REPOSITORY} \
     --set image.tag=${TAG} \
@@ -64,24 +73,22 @@ function helm_install_driver() {
     --set experimental.reserveHeadroomForMountpointPods=true \
     ${IRSA_FLAG} \
     --kubeconfig ${KUBECONFIG}
-  $KUBECTL_BIN rollout status daemonset s3-csi-node -n $NAMESPACE --timeout=60s --kubeconfig $KUBECONFIG
+  $KUBECTL_BIN rollout status daemonset s3-csi-node -n kube-system --timeout=60s --kubeconfig $KUBECONFIG
   $KUBECTL_BIN get pods -A --kubeconfig $KUBECONFIG
-  echo "s3-csi-node-image: $($KUBECTL_BIN get daemonset s3-csi-node -n $NAMESPACE -o jsonpath="{$.spec.template.spec.containers[:1].image}" --kubeconfig $KUBECONFIG)"
+  echo "s3-csi-node-image: $($KUBECTL_BIN get daemonset s3-csi-node -n kube-system -o jsonpath="{$.spec.template.spec.containers[:1].image}" --kubeconfig $KUBECONFIG)"
 
   helm_validate_driver \
     "$HELM_BIN" \
     "$KUBECTL_BIN" \
     "$RELEASE_NAME" \
-    "$KUBECONFIG" \
-    "$NAMESPACE"
+    "$KUBECONFIG"
 }
 
 function helm_validate_driver() {
   HELM_BIN=${1}
   KUBECTL_BIN=${2}
   RELEASE_NAME=${3}
   KUBECONFIG=${4}
-  NAMESPACE=${5}
 
   if ! driver_installed ${HELM_BIN} ${RELEASE_NAME} ${KUBECONFIG}; then
     echo "Driver $RELEASE_NAME must be installed"
@@ -91,7 +98,7 @@ function helm_validate_driver() {
   echo "Validating $RELEASE_NAME on the server side..."
 
   # Get all installed manifests and validate them on the server side
-  $HELM_BIN get manifest --namespace $NAMESPACE --kubeconfig ${KUBECONFIG} $RELEASE_NAME | \
+  $HELM_BIN get manifest --namespace kube-system --kubeconfig ${KUBECONFIG} $RELEASE_NAME | \
     $KUBECTL_BIN replace --kubeconfig $KUBECONFIG --dry-run=server --validate=strict --warnings-as-errors -f -
 }
 
diff --git a/tests/e2e-kubernetes/scripts/run.sh b/tests/e2e-kubernetes/scripts/run.sh
@@ -32,6 +32,7 @@ IMDS_AVAILABLE=${IMDS_AVAILABLE:-true}
 ARCH=${ARCH:-x86}
 AMI_FAMILY=${AMI_FAMILY:-AmazonLinux2}
 SELINUX_MODE=${SELINUX_MODE:-}
+IS_OPENSHIFT=${IS_OPENSHIFT:-false}
 
 # eksctl: mustn't include patch version (e.g. 1.19)
 # 'K8S_VERSION' variable must be a full version (e.g. 1.19.1)
@@ -64,7 +65,6 @@ CLUSTER_FILE=${TEST_DIR}/${CLUSTER_NAME}.${CLUSTER_TYPE}.yaml
 
 SSH_KEY=${SSH_KEY:-""}
 HELM_RELEASE_NAME=mountpoint-s3-csi-driver
-CSI_DRIVER_NAMESPACE=${CSI_DRIVER_NAMESPACE:-kube-system}
 
 EKSCTL_PATCH_FILE=${EKSCTL_PATCH_FILE:-${BASE_DIR}/eksctl-patch.json}
 EKSCTL_PATCH_SELINUX_ENFORCING_FILE=${EKSCTL_PATCH_SELINUX_ENFORCING_FILE:-${BASE_DIR}/eksctl-patch-selinux-enforcing.json}
@@ -87,7 +87,7 @@ function kubectl_install() {
 }
 
 function print_cluster_info() {
-  $KUBECTL_BIN logs -l app=s3-csi-node -n ${CSI_DRIVER_NAMESPACE} --kubeconfig ${KUBECONFIG}
+  $KUBECTL_BIN logs -l app=s3-csi-node -n kube-system --kubeconfig ${KUBECONFIG}
   $KUBECTL_BIN version --kubeconfig ${KUBECONFIG}
   $KUBECTL_BIN get nodes -o wide --kubeconfig ${KUBECONFIG}
 }
@@ -153,7 +153,7 @@ function e2e_cleanup() {
 }
 
 function print_cluster_info() {
-  $KUBECTL_BIN logs -l app=s3-csi-node -n ${CSI_DRIVER_NAMESPACE} --kubeconfig ${KUBECONFIG}
+  $KUBECTL_BIN logs -l app=s3-csi-node -n kube-system --kubeconfig ${KUBECONFIG}
   $KUBECTL_BIN version --kubeconfig ${KUBECONFIG}
   $KUBECTL_BIN get nodes -o wide --kubeconfig ${KUBECONFIG}
 }
@@ -173,7 +173,7 @@ elif [[ "${ACTION}" == "install_driver" ]]; then
     "${TAG}" \
     "${KUBECONFIG}" \
     "${CSI_DRIVER_IRSA_ROLE_ARN}" \
-    "${CSI_DRIVER_NAMESPACE}"
+    "${IS_OPENSHIFT}"
 elif [[ "${ACTION}" == "run_tests" ]]; then
   set +e
   pushd tests/e2e-kubernetes
@@ -203,7 +203,7 @@ elif [[ "${ACTION}" == "uninstall_driver" ]]; then
     "$KUBECTL_BIN" \
     "$HELM_RELEASE_NAME" \
     "${KUBECONFIG}" \
-    "${CSI_DRIVER_NAMESPACE}"
+    "${IS_OPENSHIFT}"
 elif [[ "${ACTION}" == "delete_cluster" ]]; then
   delete_cluster
 elif [[ "${ACTION}" == "e2e_cleanup" ]]; then

Original file line number	Diff line number	Diff line change
`@@ -87,7 +87,7 @@ resource "aws_iam_role" "csi_driver_irsa" {`
`87`	`87`	`Action = "sts:AssumeRoleWithWebIdentity"`
`88`	`88`	`Condition = {`
`89`	`89`	`StringEquals = {`
`90`		`- "${replace(module.hcp.oidc_endpoint_url, "https://", "")}:sub" = "system:serviceaccount:openshift-cluster-csi-drivers:s3-csi-driver-sa"`
	`90`	`+ "${replace(module.hcp.oidc_endpoint_url, "https://", "")}:sub" = "system:serviceaccount:kube-system:s3-csi-driver-sa"`
`91`	`91`	`}`
`92`	`92`	`}`
`93`	`93`	`}`