salt: own ingress resources when upgrading from 129

Author: eg-ayoub

buildchain/buildchain/salt_tree.py

@@ -442,6 +442,7 @@ def task(self) -> types.TaskDict:
     Path("salt/metalk8s/addons/nginx-ingress/deployed/namespace.sls"),
     Path("salt/metalk8s/addons/nginx-ingress/deployed/tls-secret.sls"),
     Path("salt/metalk8s/addons/nginx-ingress/deployed/service-configuration.sls"),
+    Path("salt/metalk8s/addons/nginx-ingress/deployed/update-metadata.sls"),
     Path("salt/metalk8s/addons/nginx-ingress/deployed/config-map.sls"),
     Path("salt/metalk8s/addons/nginx-ingress/config/ingress-controller.yaml.j2"),
     Path("salt/metalk8s/addons/nginx-ingress/deployed/dashboards.sls"),
@@ -464,6 +465,9 @@ def task(self) -> types.TaskDict:
         "ingress-controller.yaml.j2",
     ),
     Path("salt/metalk8s/addons/nginx-ingress-control-plane/deployed/tls-secret.sls"),
+    Path(
+        "salt/metalk8s/addons/nginx-ingress-control-plane/deployed/update-metadata.sls"
+    ),
     Path("salt/metalk8s/backup/certs/ca.sls"),
     Path("salt/metalk8s/backup/certs/server.sls"),
     Path("salt/metalk8s/backup/configured.sls"),

salt/metalk8s/addons/nginx-ingress-control-plane/deployed/init.sls

@@ -2,6 +2,7 @@ include:
   - metalk8s.addons.nginx-operator.deployed
   - metalk8s.addons.nginx-ingress.deployed.namespace
   - .tls-secret
+  - .update-metadata
   - .chart
   - .service-configuration
   - .config-map

salt/metalk8s/addons/nginx-ingress-control-plane/deployed/update-metadata.sls

@@ -0,0 +1,44 @@
+# this state needs to be removed in MetalK8S 131.0
+{%- set namespace_exists = salt.metalk8s_kubernetes.object_exists(
+      kind="DaemonSet", apiVersion="v1", name="ingress-nginx-control-plane", namespace="ingress-nginx-control-plane") %}
+{%- if namespace_exists %}
+
+include:
+  - .chart
+
+{%- set ingress_nginx_cp_objects = [
+      { "kind": "ServiceAccount" },
+      { "kind": "ClusterRole", "apiVersion": "rbac.authorization.k8s.io/v1" },
+      { "kind": "ClusterRoleBinding", "apiVersion": "rbac.authorization.k8s.io/v1" },
+      { "kind": "Role", "apiVersion": "rbac.authorization.k8s.io/v1" },
+      { "kind": "RoleBinding", "apiVersion": "rbac.authorization.k8s.io/v1" },
+      { "kind": "Service", "name": "ingress-nginx-control-plane-controller-metrics" },
+      { "kind": "Service", "name": "ingress-nginx-control-plane-controller" },
+      { "kind": "DaemonSet", "name": "ingress-nginx-control-plane-controller" },
+      { "kind": "IngressClass", "apiVersion": "networking.k8s.io/v1", "name": "nginx-control-plane" },
+      { "kind": "ServiceMonitor", "apiVersion": "monitoring.coreos.com/v1", "name": "ingress-nginx-control-plane-controller" },
+    ] %}
+
+{%- for obj in ingress_nginx_cp_objects %}
+
+{%- do obj.setdefault("name", "ingress-nginx-control-plane") %}
+{%- do obj.setdefault("apiVersion", "v1") %}
+
+Update metadata for {{ obj["kind"] }}:{{ obj["name"] }}
+  metalk8s_kubernetes.object_updated:
+    - name: {{ obj["name"] }}
+    - kind: {{ obj["kind"] }}
+    - apiVersion: {{ obj["apiVersion"] }}
+    - namespace: metalk8s-ingress
+    - patch:
+        metadata:
+          labels:
+            app.kubernetes.io/managed-by: Helm
+          annotations:
+            meta.helm.sh/release-name: ingress-nginx-control-plane
+            meta.helm.sh/release-namespace: metalk8s-ingress
+    - require_in:
+      - sls: metalk8s.addons.nginx-ingress-control-plane.deployed.chart
+
+{%- endfor %}
+{%- endif %}

salt/metalk8s/addons/nginx-ingress/deployed/init.sls

@@ -2,6 +2,7 @@ include:
   - metalk8s.addons.nginx-operator.deployed
   - .namespace
   - .tls-secret
+  - .update-metadata
   - .chart
   - metalk8s.addons.prometheus-operator.deployed.namespace
   - .dashboards

salt/metalk8s/addons/nginx-ingress/deployed/update-metadata.sls

@@ -0,0 +1,44 @@
+# this state needs to be removed in MetalK8S 131.0
+{%- set namespace_exists = salt.metalk8s_kubernetes.object_exists(
+      kind="DaemonSet", apiVersion="v1", name="ingress-nginx", namespace="metalk8s-ingress") %}
+{%- if namespace_exists %}
+
+include:
+  - .chart
+
+{%- set ingress_nginx_objects = [
+      { "kind": "ServiceAccount" },
+      { "kind": "ClusterRole", "apiVersion": "rbac.authorization.k8s.io/v1" },
+      { "kind": "ClusterRoleBinding", "apiVersion": "rbac.authorization.k8s.io/v1" },
+      { "kind": "Role", "apiVersion": "rbac.authorization.k8s.io/v1" },
+      { "kind": "RoleBinding", "apiVersion": "rbac.authorization.k8s.io/v1" },
+      { "kind": "Service", "name": "ingress-nginx-controller-metrics" },
+      { "kind": "Service", "name": "ingress-nginx-controller" },
+      { "kind": "DaemonSet", "name": "ingress-nginx-controller" },
+      { "kind": "IngressClass", "apiVersion": "networking.k8s.io/v1", "name": "nginx" },
+      { "kind": "ServiceMonitor", "apiVersion": "monitoring.coreos.com/v1", "name": "ingress-nginx-controller" },
+    ] %}
+
+{%- for obj in ingress_nginx_objects %}
+
+{%- do obj.setdefault("name", "ingress-nginx") %}
+{%- do obj.setdefault("apiVersion", "v1") %}
+
+Update metadata for {{ obj["kind"] }}:{{ obj["name"] }}
+  metalk8s_kubernetes.object_updated:
+    - name: {{ obj["name"] }}
+    - kind: {{ obj["kind"] }}
+    - apiVersion: {{ obj["apiVersion"] }}
+    - namespace: metalk8s-ingress
+    - patch:
+        metadata:
+          labels:
+            app.kubernetes.io/managed-by: Helm
+          annotations:
+            meta.helm.sh/release-name: ingress-nginx
+            meta.helm.sh/release-namespace: metalk8s-ingress
+    - require_in:
+      - sls: metalk8s.addons.nginx-ingress.deployed.chart
+
+{%- endfor %}
+{%- endif %}