osm-label.yml

# 
# The job in this YAML file tries to add 'openservicemesh.io/ignore' label to 'kube-system', 'azure-arc', and 'arc-osm-system' namespaces.
# The job is executed in helm pre-install phase of OSM release lifecycle. 
#
apiVersion: v1
kind: ServiceAccount
metadata:
  name: osm-label-account
  namespace: {{ .Release.Namespace }}
  annotations:
    "helm.sh/hook-weight": "20"
    "helm.sh/hook": pre-install
    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
---
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: osm-label-cluster-role
  annotations:
    "helm.sh/hook-weight": "25"
    "helm.sh/hook": pre-install
    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
rules:
- apiGroups: [""]
  resources: ["namespaces"]
  verbs: ["get", "patch"]
{{- if eq .Values.Azure.Cluster.Distribution "openshift" }}
- apiGroups:
  - security.openshift.io
  resourceNames:
    - anyuid
  resources:
    - securitycontextconstraints
  verbs:
    - use
{{- end }}
---
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: osm-label-role-binding
  namespace: kube-system
  annotations:
    "helm.sh/hook-weight": "30"
    "helm.sh/hook": pre-install
    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
subjects:
- kind: ServiceAccount
  name: osm-label-account
  namespace: {{ .Release.Namespace }}
roleRef:
  kind: ClusterRole
  name: osm-label-cluster-role
  apiGroup: rbac.authorization.k8s.io
---
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: osm-label-role-binding
  namespace: azure-arc
  annotations:
    "helm.sh/hook-weight": "30"
    "helm.sh/hook": pre-install
    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
subjects:
- kind: ServiceAccount
  name: osm-label-account
  namespace: {{ .Release.Namespace }}
roleRef:
  kind: ClusterRole
  name: osm-label-cluster-role
  apiGroup: rbac.authorization.k8s.io
---
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: osm-label-role-binding
  namespace: arc-osm-system
  annotations:
    "helm.sh/hook-weight": "30"
    "helm.sh/hook": pre-install
    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
subjects:
- kind: ServiceAccount
  name: osm-label-account
  namespace: {{ .Release.Namespace }}
roleRef:
  kind: ClusterRole
  name: osm-label-cluster-role
  apiGroup: rbac.authorization.k8s.io
---
apiVersion: batch/v1
kind: Job
metadata:
  name: osm-label
  namespace: {{ .Release.Namespace }}
  annotations:
    "helm.sh/hook-weight": "35"
    "helm.sh/hook": pre-install
    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
    {{- if (ne .Values.Azure.Cluster.Distribution "openshift") }}
    seccomp.security.alpha.kubernetes.io/pod: runtime/default
    {{- end }}
spec:
  template:
    metadata:
      labels:
        app: osm-label
      {{- if (ne .Values.Azure.Cluster.Distribution "openshift") }}
      annotations:
        seccomp.security.alpha.kubernetes.io/pod: runtime/default
      {{- end }}
    spec:
      serviceAccountName: osm-label-account
      automountServiceAccountToken: true
      restartPolicy: Never
      terminationGracePeriodSeconds: 0
      nodeSelector:
        kubernetes.io/arch: amd64
        kubernetes.io/os: linux
      containers:
        - name: osm-label
          image: {{ .Values.alpine.image.name }}:{{ .Values.alpine.image.tag }}
          imagePullPolicy: IfNotPresent
          env: 
            - name: labelnamespaces
              value: {{ .Values.OpenServiceMesh.ignoreNamespaces }}
            - name: osmnamespace
              value: {{ .Release.Namespace }}
          securityContext:
            allowPrivilegeEscalation: false
          command: 
            - "/bin/sh"
            - "-ec"
            - |
              set -o pipefail
              token=$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)
              namespaces=${labelnamespaces}
              for namespace in ${namespaces}
              do
                echo "Retrieving namespace ${namespace} details"
                namespaceDetails=$(curl -s -X GET -k https://kubernetes.default.svc/api/v1/namespaces/${namespace} \
                -H "Authorization: Bearer ${token}" \
                -H "Content-Type: application/json" \
                -H "Accept: application/json")
                kind=$(echo $namespaceDetails | jq .kind)
                if [ "$kind" = "\"Namespace\"" ]
                then
                  cplabel=$(echo $namespaceDetails | jq .metadata.labels.\"openservicemesh.io/ignore\")
                  if [ "$cplabel" = "null" ]
                  then
                    echo "Adding openservicemesh.io/ignore label to ${namespace}"
                    patchstatus=$(curl -s -X PATCH -k https://kubernetes.default.svc/api/v1/namespaces/${namespace} \
                    -d '{ "metadata": { "labels": { "openservicemesh.io/ignore": "true" } } }' \
                    -H "Authorization: Bearer ${token}" \
                    -H "Content-Type: application/strategic-merge-patch+json" \
                    -H "Accept: application/json")
                  else
                    echo "openservicemesh.io/ignore label already exists on namespace ${namespace}"
                  fi
                else
                  echo "Failed to retrieve ${namespace} details"
                fi
              done
              echo "Retrieving namespace ${osmnamespace} details"
              namespaceDetails=$(curl -s -X GET -k https://kubernetes.default.svc/api/v1/namespaces/${osmnamespace} \
              -H "Authorization: Bearer ${token}" \
              -H "Content-Type: application/json" \
              -H "Accept: application/json")
              kind=$(echo $namespaceDetails | jq .kind)
              if [ "$kind" = "\"Namespace\"" ]
              then
                cplabel=$(echo $namespaceDetails | jq .metadata.labels.\"admission.policy.azure.com/ignore\")
                if [ "$cplabel" = "null" ]
                then
                  echo "Adding admission.policy.azure.com/ignore label to ${osmnamespace}"
                  patchstatus=$(curl -s -X PATCH -k https://kubernetes.default.svc/api/v1/namespaces/${osmnamespace} \
                  -d '{ "metadata": { "labels": { "admission.policy.azure.com/ignore": "true" } } }' \
                  -H "Authorization: Bearer ${token}" \
                  -H "Content-Type: application/strategic-merge-patch+json" \
                  -H "Accept: application/json")
                else
                  echo "admission.policy.azure.com/ignore label already exists on namespace ${osmnamespace}"
                fi
              else
                echo "Failed to retrieve ${osmnamespace} details"
              fi  
      securityContext:
        runAsUser: 1000
        runAsGroup: 3000
        fsGroup: 2000
        supplementalGroups: [5555]