From 0082c52aecb42847be171b15dd5122c5d0a375ea Mon Sep 17 00:00:00 2001 From: dttung2905 Date: Sun, 16 Aug 2026 09:36:22 +0100 Subject: [PATCH 1/2] Honor postCleanup.serviceAccountName on the post-delete ServiceAccount, ClusterRole, and ClusterRoleBinding Signed-off-by: dttung2905 --- .../unreleased/Fixed-20260816-093535.yaml | 6 ++ .../templates/rbac/post-delete-binding.yaml | 6 +- .../rbac/post-delete-clusterrole.yaml | 2 +- .../services/post-delete-serviceaccount.yaml | 2 +- .../kai-scheduler/tests/post_delete_test.yaml | 69 +++++++++++++++++++ deployments/kai-scheduler/values.yaml | 2 + 6 files changed, 82 insertions(+), 5 deletions(-) create mode 100644 .changes/unreleased/Fixed-20260816-093535.yaml diff --git a/.changes/unreleased/Fixed-20260816-093535.yaml b/.changes/unreleased/Fixed-20260816-093535.yaml new file mode 100644 index 000000000..ac04bb204 --- /dev/null +++ b/.changes/unreleased/Fixed-20260816-093535.yaml @@ -0,0 +1,6 @@ +kind: Fixed +body: Honor postCleanup.serviceAccountName on the post-delete ServiceAccount, ClusterRole, and ClusterRoleBinding +time: 2026-08-16T09:35:35.907047345+01:00 +custom: + Author: dttung2905 + Issue: "" diff --git a/deployments/kai-scheduler/templates/rbac/post-delete-binding.yaml b/deployments/kai-scheduler/templates/rbac/post-delete-binding.yaml index 8cee894b6..6f3dbc4a1 100644 --- a/deployments/kai-scheduler/templates/rbac/post-delete-binding.yaml +++ b/deployments/kai-scheduler/templates/rbac/post-delete-binding.yaml @@ -5,15 +5,15 @@ apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: - name: post-delete-cleanup + name: {{ .Values.postCleanup.serviceAccountName }} annotations: {{- include "kai-scheduler.post-delete-hook-annotations" . | nindent 4 }} subjects: - kind: ServiceAccount - name: post-delete-cleanup + name: {{ .Values.postCleanup.serviceAccountName }} namespace: {{ .Release.Namespace }} roleRef: kind: ClusterRole - name: post-delete-cleanup + name: {{ .Values.postCleanup.serviceAccountName }} apiGroup: rbac.authorization.k8s.io {{- end }} diff --git a/deployments/kai-scheduler/templates/rbac/post-delete-clusterrole.yaml b/deployments/kai-scheduler/templates/rbac/post-delete-clusterrole.yaml index 2ba5a7ae5..2bcf088dd 100644 --- a/deployments/kai-scheduler/templates/rbac/post-delete-clusterrole.yaml +++ b/deployments/kai-scheduler/templates/rbac/post-delete-clusterrole.yaml @@ -5,7 +5,7 @@ apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: - name: post-delete-cleanup + name: {{ .Values.postCleanup.serviceAccountName }} annotations: {{- include "kai-scheduler.post-delete-hook-annotations" . | nindent 4 }} rules: diff --git a/deployments/kai-scheduler/templates/services/post-delete-serviceaccount.yaml b/deployments/kai-scheduler/templates/services/post-delete-serviceaccount.yaml index 0fb7630b6..5c80e25f2 100644 --- a/deployments/kai-scheduler/templates/services/post-delete-serviceaccount.yaml +++ b/deployments/kai-scheduler/templates/services/post-delete-serviceaccount.yaml @@ -4,7 +4,7 @@ apiVersion: v1 kind: ServiceAccount metadata: - name: post-delete-cleanup + name: {{ .Values.postCleanup.serviceAccountName }} namespace: {{ .Release.Namespace }} labels: app: kai-operator diff --git a/deployments/kai-scheduler/tests/post_delete_test.yaml b/deployments/kai-scheduler/tests/post_delete_test.yaml index c9312edfa..2bd8a4102 100644 --- a/deployments/kai-scheduler/tests/post_delete_test.yaml +++ b/deployments/kai-scheduler/tests/post_delete_test.yaml @@ -4,8 +4,13 @@ suite: test post-delete cleanup hook templates: - hooks/post/post-delete-job.yaml + - services/post-delete-serviceaccount.yaml + - rbac/post-delete-clusterrole.yaml + - rbac/post-delete-binding.yaml tests: - it: should delete only operator-managed deployments in the release namespace + templates: + - hooks/post/post-delete-job.yaml release: namespace: custom-ns asserts: @@ -17,6 +22,8 @@ tests: pattern: delete deployments? --all - it: should delete kai-config when the config deployer is enabled + templates: + - hooks/post/post-delete-job.yaml set: kaiConfigDeployer.enabled: true asserts: @@ -25,6 +32,8 @@ tests: pattern: kubectl delete Config kai-config --ignore-not-found - it: should preserve kai-config when the config deployer is disabled + templates: + - hooks/post/post-delete-job.yaml set: kaiConfigDeployer.enabled: false asserts: @@ -33,6 +42,8 @@ tests: pattern: kubectl delete Config kai-config - it: should not delete kai-config in GitOps mode (pruned as a tracked release resource) + templates: + - hooks/post/post-delete-job.yaml set: kaiConfigDeployer.enabled: false kaiConfig.render: true @@ -42,6 +53,8 @@ tests: pattern: kubectl delete Config kai-config - it: should carry the ArgoCD PostDelete hook annotations + templates: + - hooks/post/post-delete-job.yaml asserts: - equal: path: metadata.annotations["argocd.argoproj.io/hook"] @@ -51,6 +64,8 @@ tests: value: BeforeHookCreation,HookSucceeded - it: should place the cleanup job in the release namespace + templates: + - hooks/post/post-delete-job.yaml release: namespace: custom-ns asserts: @@ -64,3 +79,57 @@ tests: asserts: - hasDocuments: count: 0 + + - it: should use the default postCleanup.serviceAccountName on the job + templates: + - hooks/post/post-delete-job.yaml + asserts: + - equal: + path: spec.template.spec.serviceAccountName + value: post-delete-cleanup + + - it: should name the ServiceAccount from postCleanup.serviceAccountName + templates: + - services/post-delete-serviceaccount.yaml + set: + postCleanup.serviceAccountName: custom-cleanup-sa + asserts: + - equal: + path: metadata.name + value: custom-cleanup-sa + + - it: should name the ClusterRole from postCleanup.serviceAccountName + templates: + - rbac/post-delete-clusterrole.yaml + set: + postCleanup.serviceAccountName: custom-cleanup-sa + asserts: + - equal: + path: metadata.name + value: custom-cleanup-sa + + - it: should wire ClusterRoleBinding subject and roleRef from postCleanup.serviceAccountName + templates: + - rbac/post-delete-binding.yaml + set: + postCleanup.serviceAccountName: custom-cleanup-sa + asserts: + - equal: + path: metadata.name + value: custom-cleanup-sa + - equal: + path: subjects[0].name + value: custom-cleanup-sa + - equal: + path: roleRef.name + value: custom-cleanup-sa + + - it: should point the Job at the custom ServiceAccount + templates: + - hooks/post/post-delete-job.yaml + set: + postCleanup.serviceAccountName: custom-cleanup-sa + asserts: + - equal: + path: spec.template.spec.serviceAccountName + value: custom-cleanup-sa diff --git a/deployments/kai-scheduler/values.yaml b/deployments/kai-scheduler/values.yaml index 969fc045f..50f60604a 100644 --- a/deployments/kai-scheduler/values.yaml +++ b/deployments/kai-scheduler/values.yaml @@ -302,6 +302,8 @@ postCleanup: name: crd-upgrader pullPolicy: IfNotPresent # tag: "" # Optional: Override global.tag or Chart.AppVersion + # Name of the ServiceAccount, ClusterRole, and ClusterRoleBinding used by the + # post-delete hook Job. Keep these resources in sync by changing this one value. serviceAccountName: post-delete-cleanup resources: {} From 84ccb741b9e496fdc89a0e5bab68bee04affd452 Mon Sep 17 00:00:00 2001 From: dttung2905 Date: Sun, 16 Aug 2026 18:03:06 +0100 Subject: [PATCH 2/2] Fixes from code review Signed-off-by: dttung2905 --- .changes/unreleased/Fixed-20260816-093535.yaml | 2 +- .../templates/rbac/post-delete-binding.yaml | 4 ++-- .../templates/rbac/post-delete-clusterrole.yaml | 2 +- deployments/kai-scheduler/tests/post_delete_test.yaml | 10 +++++----- deployments/kai-scheduler/values.yaml | 3 +-- 5 files changed, 10 insertions(+), 11 deletions(-) diff --git a/.changes/unreleased/Fixed-20260816-093535.yaml b/.changes/unreleased/Fixed-20260816-093535.yaml index ac04bb204..623b94dd3 100644 --- a/.changes/unreleased/Fixed-20260816-093535.yaml +++ b/.changes/unreleased/Fixed-20260816-093535.yaml @@ -1,5 +1,5 @@ kind: Fixed -body: Honor postCleanup.serviceAccountName on the post-delete ServiceAccount, ClusterRole, and ClusterRoleBinding +body: Honor postCleanup.serviceAccountName for the post-delete ServiceAccount and ClusterRoleBinding subject time: 2026-08-16T09:35:35.907047345+01:00 custom: Author: dttung2905 diff --git a/deployments/kai-scheduler/templates/rbac/post-delete-binding.yaml b/deployments/kai-scheduler/templates/rbac/post-delete-binding.yaml index 6f3dbc4a1..bc0ba45f2 100644 --- a/deployments/kai-scheduler/templates/rbac/post-delete-binding.yaml +++ b/deployments/kai-scheduler/templates/rbac/post-delete-binding.yaml @@ -5,7 +5,7 @@ apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: - name: {{ .Values.postCleanup.serviceAccountName }} + name: post-delete-cleanup annotations: {{- include "kai-scheduler.post-delete-hook-annotations" . | nindent 4 }} subjects: @@ -14,6 +14,6 @@ subjects: namespace: {{ .Release.Namespace }} roleRef: kind: ClusterRole - name: {{ .Values.postCleanup.serviceAccountName }} + name: post-delete-cleanup apiGroup: rbac.authorization.k8s.io {{- end }} diff --git a/deployments/kai-scheduler/templates/rbac/post-delete-clusterrole.yaml b/deployments/kai-scheduler/templates/rbac/post-delete-clusterrole.yaml index 2bcf088dd..2ba5a7ae5 100644 --- a/deployments/kai-scheduler/templates/rbac/post-delete-clusterrole.yaml +++ b/deployments/kai-scheduler/templates/rbac/post-delete-clusterrole.yaml @@ -5,7 +5,7 @@ apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: - name: {{ .Values.postCleanup.serviceAccountName }} + name: post-delete-cleanup annotations: {{- include "kai-scheduler.post-delete-hook-annotations" . | nindent 4 }} rules: diff --git a/deployments/kai-scheduler/tests/post_delete_test.yaml b/deployments/kai-scheduler/tests/post_delete_test.yaml index 2bd8a4102..472dc52ae 100644 --- a/deployments/kai-scheduler/tests/post_delete_test.yaml +++ b/deployments/kai-scheduler/tests/post_delete_test.yaml @@ -98,7 +98,7 @@ tests: path: metadata.name value: custom-cleanup-sa - - it: should name the ClusterRole from postCleanup.serviceAccountName + - it: should keep ClusterRole name fixed when serviceAccountName changes templates: - rbac/post-delete-clusterrole.yaml set: @@ -106,9 +106,9 @@ tests: asserts: - equal: path: metadata.name - value: custom-cleanup-sa + value: post-delete-cleanup - - it: should wire ClusterRoleBinding subject and roleRef from postCleanup.serviceAccountName + - it: should bind the custom ServiceAccount while keeping ClusterRoleBinding and roleRef fixed templates: - rbac/post-delete-binding.yaml set: @@ -116,13 +116,13 @@ tests: asserts: - equal: path: metadata.name - value: custom-cleanup-sa + value: post-delete-cleanup - equal: path: subjects[0].name value: custom-cleanup-sa - equal: path: roleRef.name - value: custom-cleanup-sa + value: post-delete-cleanup - it: should point the Job at the custom ServiceAccount templates: diff --git a/deployments/kai-scheduler/values.yaml b/deployments/kai-scheduler/values.yaml index 50f60604a..8e809d3bc 100644 --- a/deployments/kai-scheduler/values.yaml +++ b/deployments/kai-scheduler/values.yaml @@ -302,8 +302,7 @@ postCleanup: name: crd-upgrader pullPolicy: IfNotPresent # tag: "" # Optional: Override global.tag or Chart.AppVersion - # Name of the ServiceAccount, ClusterRole, and ClusterRoleBinding used by the - # post-delete hook Job. Keep these resources in sync by changing this one value. + # Name of the ServiceAccount used by the post-delete hook Job. serviceAccountName: post-delete-cleanup resources: {}