Skip to content

Fix reset scripts #835

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Julien-Ben wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Fix reset scripts #835

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
25 changes: 23 additions & 2 deletions scripts/dev/delete_om_projects.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,10 +32,31 @@ delete_project() {

delete_project "${NAMESPACE}"

# Delete resource-specific projects (e.g. mongodb-test-mdb-sh) that the operator
# creates when a MongoDB CR uses a custom project name. Without this, stale
# automation configs persist in Cloud Manager across test runs, causing cert
# hash mismatches that deadlock the agent.
delete_projects_with_prefix() {
local prefix=$1
echo "Listing projects with prefix '${prefix}-' to clean up"
local projects
projects=$(curl -s -u "${OM_USER}:${OM_API_KEY}" --digest \
"${OM_HOST}/api/public/v1.0/groups?itemsPerPage=100" \
| jq -r ".results[]? | select(.name | startswith(\"${prefix}-\")) | .name") || true
if [[ -z "${projects}" ]]; then
echo "No prefixed projects found"
return
fi
for project_name in ${projects}; do
delete_project "${project_name}" || true
done
}

delete_projects_with_prefix "${NAMESPACE}"

if [[ "${WATCH_NAMESPACE:-}" != "" && "${WATCH_NAMESPACE:-}" != "*" ]]; then
for ns in ${WATCH_NAMESPACE/,// }; do
delete_project "${ns}" || true
delete_projects_with_prefix "${ns}" || true
done
fi


8 changes: 7 additions & 1 deletion scripts/dev/prepare-multi-cluster/main.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -86,8 +86,8 @@ func main() {
runParallel(cfg.memberClusters, func(cluster string) {
collectError := collectErrorFor(cluster)
ensureNamespace(ctx, clients[cluster], cluster, cfg.namespace, cfg.taskID, collectError)
labelNamespaceIstio(ctx, clients[cluster], cluster, cfg.namespace, collectError)
if cfg.applyMTLS {
labelNamespaceIstio(ctx, clients[cluster], cluster, cfg.namespace, collectError)
applyPeerAuthentication(ctx, dynamicClients[cluster], cluster, cfg.namespace, collectError)
}
})
Expand Down Expand Up @@ -211,6 +211,12 @@ type config struct {
func loadConfig() config {
localVal := os.Getenv("local") // nolint:forbidigo
noMesh := os.Getenv("MULTI_CLUSTER_NO_MESH") // nolint:forbidigo
// The old bash code defaulted MULTI_CLUSTER_NO_MESH to "true" when unset:
// "${MULTI_CLUSTER_NO_MESH:-"true"}" != "true"
// So mTLS is only applied when MULTI_CLUSTER_NO_MESH is explicitly set to something other than "true".
if noMesh == "" {
noMesh = "true"
}
applyMTLS := localVal == "" && noMesh != "true"

cfg := config{
Expand Down
29 changes: 29 additions & 0 deletions scripts/dev/reset/main.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -160,6 +160,32 @@ func resetContext(ctx context.Context, contextName string, deleteCRD bool, colle
fmt.Printf("Finished resetting context %s\n", contextName)
}

// removeIstioConfig removes Istio sidecar injection label and PeerAuthentication from the namespace.
// This prevents Istio artifacts from a multi-cluster run from leaking into subsequent single-cluster tests.
func removeIstioConfig(ctx context.Context, kubeClient *kubernetes.Clientset, dynamicClient dynamic.Interface, namespace string, collectError func(error, string)) {
// Remove istio-injection label from namespace
ns, err := kubeClient.CoreV1().Namespaces().Get(ctx, namespace, v1.GetOptions{})
if err == nil && ns.Labels["istio-injection"] != "" {
delete(ns.Labels, "istio-injection")
_, err = kubeClient.CoreV1().Namespaces().Update(ctx, ns, v1.UpdateOptions{})
collectError(err, fmt.Sprintf("failed to remove istio-injection label from namespace %s", namespace))
}

// Delete PeerAuthentication resources
peerAuthGVR := schema.GroupVersionResource{
Group: "security.istio.io",
Version: "v1beta1",
Resource: "peerauthentications",
}
err = dynamicClient.Resource(peerAuthGVR).Namespace(namespace).DeleteCollection(ctx, deleteOptionsNoGrace, v1.ListOptions{})
if err != nil && !kerrors.IsNotFound(err) {
// Ignore "the server could not find the requested resource" when Istio CRDs are not installed
if !strings.Contains(err.Error(), "could not find the requested resource") {
collectError(err, fmt.Sprintf("failed to delete PeerAuthentication resources in namespace %s", namespace))
}
}
}

// resetNamespace cleans up the namespace in the given context
func resetNamespace(ctx context.Context, contextName string, namespace string, deleteCRD bool, collectError func(error, string)) {
kubeClient, dynamicClient, err := initKubeClient(contextName)
Expand All @@ -168,6 +194,9 @@ func resetNamespace(ctx context.Context, contextName string, namespace string, d
return
}

// Remove Istio configuration that may have been set by a previous multi-cluster test
removeIstioConfig(ctx, kubeClient, dynamicClient, namespace, collectError)

// Hack: remove the statefulset for backup daemon first - otherwise it may get stuck on removal if AppDB is removed first
stsList, err := kubeClient.AppsV1().StatefulSets(namespace).List(ctx, v1.ListOptions{})
collectError(err, "failed to list statefulsets")
Expand Down
Loading