config-syncer job enhancement (#2074)

astronomer · Dec 5, 2023 · 0ea0eb3 · 0ea0eb3
1 parent 976d8ed
commit 0ea0eb3
Show file tree

Hide file tree

Showing 4 changed files with 24 additions and 1 deletion.
diff --git a/charts/astronomer/templates/config-syncer/config-syncer-role.yaml b/charts/astronomer/templates/config-syncer/config-syncer-role.yaml
@@ -5,6 +5,7 @@
 # 1. Do not create any resource if rbacEnabled is disabled
 # 2. Create a Cluster Role if namespacePools is disabled
 # 3. Create roles for each namespaces in the namespacePool (+ astronomer namespace) if enabled.
+{{- if .Values.configSyncer.enabled }}
 {{- $useClusterRoles := and .Values.global.rbacEnabled (not .Values.global.features.namespacePools.enabled)}}
 {{- $namespaces := .Values.global.features.namespacePools.namespaces.names }}
 {{- if $useClusterRoles }}
@@ -41,3 +42,4 @@ rules:
   verbs: ["get", "list"]
 {{ end }}
 {{- end }}
+{{- end }}
diff --git a/charts/astronomer/templates/config-syncer/config-syncer-rolebinding.yaml b/charts/astronomer/templates/config-syncer/config-syncer-rolebinding.yaml
@@ -5,6 +5,7 @@
 # 1. Do not create anything is rbacEnabled is disabled
 # 2. Create ClusterRoleBinding if namespacePools disabled
 # 3. Create RoleBinding for each namespace in the namespacePool (+ astronomer namespace) if enabled
+{{- if .Values.configSyncer.enabled }}
 {{- $useClusterRoles := and .Values.global.rbacEnabled (not .Values.global.features.namespacePools.enabled)}}
 {{- $namespaces := .Values.global.features.namespacePools.namespaces.names }}
 {{- if $useClusterRoles }}
@@ -37,3 +38,4 @@ subjects:
     namespace: {{ $.Release.Namespace }}
 {{ end }}
 {{- end }}
+{{- end }}
diff --git a/charts/astronomer/templates/config-syncer/config-syncer-serviceaccount.yaml b/charts/astronomer/templates/config-syncer/config-syncer-serviceaccount.yaml
@@ -1,7 +1,7 @@
 ################################
 ## Astronomer ServiceAccount
 #################################
-{{- if .Values.global.rbacEnabled }}
+{{- if and .Values.global.rbacEnabled .Values.configSyncer.enabled }}
 kind: ServiceAccount
 apiVersion: v1
 metadata:

diff --git a/tests/chart_tests/test_astronomer_config_syncer.py b/tests/chart_tests/test_astronomer_config_syncer.py
@@ -242,3 +242,22 @@ def test_astronomer_config_syncer_cronjob_default_schedule(
         cron_schedule = doc["spec"]["schedule"].split(" ")
         assert int(cron_schedule[0]) == test_data[1]
         assert int(cron_schedule[1]) == test_data[2]
+
+    def test_astronomer_config_syncer_disabled(self, kube_version):
+        """Test that config syncer is disabled."""
+
+        # First rbacEnabled set to true and namespacePools disabled, should create a ClusterRole and ClusterRoleBinding
+        docs = render_chart(
+            kube_version=kube_version,
+            values={
+                "astronomer": {"configSyncer": {"enabled": False}},
+            },
+            show_only=[
+                "charts/astronomer/templates/config-syncer/config-syncer-cronjob.yaml",
+                "charts/astronomer/templates/config-syncer/config-syncer-role.yaml",
+                "charts/astronomer/templates/config-syncer/config-syncer-rolebinding.yaml",
+                "charts/astronomer/templates/config-syncer/config-syncer-serviceaccount.yaml",
+            ],
+        )
+
+        assert len(docs) == 0