diff --git a/.changes/unreleased/Fixed-20260816-093535.yaml b/.changes/unreleased/Fixed-20260816-093535.yaml new file mode 100644 index 000000000..623b94dd3 --- /dev/null +++ b/.changes/unreleased/Fixed-20260816-093535.yaml @@ -0,0 +1,6 @@ +kind: Fixed +body: Honor postCleanup.serviceAccountName for the post-delete ServiceAccount and ClusterRoleBinding subject +time: 2026-08-16T09:35:35.907047345+01:00 +custom: + Author: dttung2905 + Issue: "" diff --git a/deployments/kai-scheduler/templates/rbac/post-delete-binding.yaml b/deployments/kai-scheduler/templates/rbac/post-delete-binding.yaml index 8cee894b6..bc0ba45f2 100644 --- a/deployments/kai-scheduler/templates/rbac/post-delete-binding.yaml +++ b/deployments/kai-scheduler/templates/rbac/post-delete-binding.yaml @@ -10,7 +10,7 @@ metadata: {{- include "kai-scheduler.post-delete-hook-annotations" . | nindent 4 }} subjects: - kind: ServiceAccount - name: post-delete-cleanup + name: {{ .Values.postCleanup.serviceAccountName }} namespace: {{ .Release.Namespace }} roleRef: kind: ClusterRole diff --git a/deployments/kai-scheduler/templates/services/post-delete-serviceaccount.yaml b/deployments/kai-scheduler/templates/services/post-delete-serviceaccount.yaml index 0fb7630b6..5c80e25f2 100644 --- a/deployments/kai-scheduler/templates/services/post-delete-serviceaccount.yaml +++ b/deployments/kai-scheduler/templates/services/post-delete-serviceaccount.yaml @@ -4,7 +4,7 @@ apiVersion: v1 kind: ServiceAccount metadata: - name: post-delete-cleanup + name: {{ .Values.postCleanup.serviceAccountName }} namespace: {{ .Release.Namespace }} labels: app: kai-operator diff --git a/deployments/kai-scheduler/tests/post_delete_test.yaml b/deployments/kai-scheduler/tests/post_delete_test.yaml index c9312edfa..472dc52ae 100644 --- a/deployments/kai-scheduler/tests/post_delete_test.yaml +++ b/deployments/kai-scheduler/tests/post_delete_test.yaml @@ -4,8 +4,13 @@ suite: test post-delete cleanup hook templates: - hooks/post/post-delete-job.yaml + - services/post-delete-serviceaccount.yaml + - rbac/post-delete-clusterrole.yaml + - rbac/post-delete-binding.yaml tests: - it: should delete only operator-managed deployments in the release namespace + templates: + - hooks/post/post-delete-job.yaml release: namespace: custom-ns asserts: @@ -17,6 +22,8 @@ tests: pattern: delete deployments? --all - it: should delete kai-config when the config deployer is enabled + templates: + - hooks/post/post-delete-job.yaml set: kaiConfigDeployer.enabled: true asserts: @@ -25,6 +32,8 @@ tests: pattern: kubectl delete Config kai-config --ignore-not-found - it: should preserve kai-config when the config deployer is disabled + templates: + - hooks/post/post-delete-job.yaml set: kaiConfigDeployer.enabled: false asserts: @@ -33,6 +42,8 @@ tests: pattern: kubectl delete Config kai-config - it: should not delete kai-config in GitOps mode (pruned as a tracked release resource) + templates: + - hooks/post/post-delete-job.yaml set: kaiConfigDeployer.enabled: false kaiConfig.render: true @@ -42,6 +53,8 @@ tests: pattern: kubectl delete Config kai-config - it: should carry the ArgoCD PostDelete hook annotations + templates: + - hooks/post/post-delete-job.yaml asserts: - equal: path: metadata.annotations["argocd.argoproj.io/hook"] @@ -51,6 +64,8 @@ tests: value: BeforeHookCreation,HookSucceeded - it: should place the cleanup job in the release namespace + templates: + - hooks/post/post-delete-job.yaml release: namespace: custom-ns asserts: @@ -64,3 +79,57 @@ tests: asserts: - hasDocuments: count: 0 + + - it: should use the default postCleanup.serviceAccountName on the job + templates: + - hooks/post/post-delete-job.yaml + asserts: + - equal: + path: spec.template.spec.serviceAccountName + value: post-delete-cleanup + + - it: should name the ServiceAccount from postCleanup.serviceAccountName + templates: + - services/post-delete-serviceaccount.yaml + set: + postCleanup.serviceAccountName: custom-cleanup-sa + asserts: + - equal: + path: metadata.name + value: custom-cleanup-sa + + - it: should keep ClusterRole name fixed when serviceAccountName changes + templates: + - rbac/post-delete-clusterrole.yaml + set: + postCleanup.serviceAccountName: custom-cleanup-sa + asserts: + - equal: + path: metadata.name + value: post-delete-cleanup + + - it: should bind the custom ServiceAccount while keeping ClusterRoleBinding and roleRef fixed + templates: + - rbac/post-delete-binding.yaml + set: + postCleanup.serviceAccountName: custom-cleanup-sa + asserts: + - equal: + path: metadata.name + value: post-delete-cleanup + - equal: + path: subjects[0].name + value: custom-cleanup-sa + - equal: + path: roleRef.name + value: post-delete-cleanup + + - it: should point the Job at the custom ServiceAccount + templates: + - hooks/post/post-delete-job.yaml + set: + postCleanup.serviceAccountName: custom-cleanup-sa + asserts: + - equal: + path: spec.template.spec.serviceAccountName + value: custom-cleanup-sa diff --git a/deployments/kai-scheduler/values.yaml b/deployments/kai-scheduler/values.yaml index 969fc045f..8e809d3bc 100644 --- a/deployments/kai-scheduler/values.yaml +++ b/deployments/kai-scheduler/values.yaml @@ -302,6 +302,7 @@ postCleanup: name: crd-upgrader pullPolicy: IfNotPresent # tag: "" # Optional: Override global.tag or Chart.AppVersion + # Name of the ServiceAccount used by the post-delete hook Job. serviceAccountName: post-delete-cleanup resources: {}