How can I delete PVC related to StatefulSets?

[katsew]

I deploy statefulset via helm, and it has a volumeClaimTemplates.
I check some issue similar to my case, but I couldn't get the answer.

I annotate helm.sh/resource-policy: delete to volumeClaimTemplates, but it does not work.
Is there any way to delete pvc related to statefulsets by helm del (--purge)?
Or do I have to delete pvc manually?

[katsew]

I found the answer.
#3313

Helm does not have any ways to delete pvc related to statefulsets.
But pre-delete hook could be better way to help deleting pvc.

[alphabt]

@katsew Could you share your pre-delete hook? I'm having a hard time figuring out how to delete my PVC. I'm thinking of doing something like

containers:
      - name: post-delete-job
        image: "alpine:3.3"
        command: ["kubectl delete pvc..."]

But it runs inside a container that is not in the same context as helm (or tiller in this case), so I don't think it'll work.

[katsew]

@alphabt

I think you should provide a service account with role binding to delete pvc.

e.g.

---
kind: Pod
spec:
  serviceAccountName: pvc-deleter-sa
  containers:
      - name: post-delete-job
        image: "alpine:3.3"
        command: ["kubectl delete pvc..."]

---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: pvc-deleter-role
rules:
- apiGroups: [""]
  resources: ["persistentvolumeclaims"]
  verbs: ["get", "list", "delete", "deletecollection"]

---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: pvc-deleter

---
kind: RoleBinding
metadata: pvc-deleter-rolebinding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: pvc-deleter-role
subjects:
- kind: ServiceAccount
  name: pvc-deleter-sa

[koxu1996]

I use following yaml:

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: pvc-deleter-role
rules:
- apiGroups: [""]
  resources: ["persistentvolumeclaims"]
  verbs: ["get", "list", "delete", "deletecollection"]
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: pvc-deleter-sa
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: pvc-deleter-rolebinding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: pvc-deleter-role
subjects:
- kind: ServiceAccount
  name: pvc-deleter-sa
---
apiVersion: batch/v1
kind: Job
metadata:
  name: pvc-deleter-job
  annotations:
    "helm.sh/hook": pre-delete
    "helm.sh/hook-weight": "-5"
    "helm.sh/hook-delete-policy": hook-succeeded
spec:
  template:
    spec:
      restartPolicy: OnFailure
      containers:
      - name: post-delete-job
        image: "bitnami/kubectl"
        command: ["kubectl"]
        args:
        - "delete"
        - "pvc"
        - "--all"
      serviceAccountName: pvc-deleter-sa
      securityContext:
        runAsUser: 0

[pmorch]

#3313 explains why helm doesn't delete the PVCs automatically.

I'm not sure this works in all cases, but for the postgreSQL database that I installed it with:

$ helm install mydb bitnami/postgresql

the pvc has this label:

app.kubernetes.io/instance: mydb

So when I delete the release with:

$ helm delete mydb

I can delete the pvc-s afterwards with:

# run with `--dry-run=client` first to see what I'm about to delete
$ kubectl delete pvc --dry-run=client -l app.kubernetes.io/instance=mydb
persistentvolumeclaim "data-mydb-postgresql-0" deleted (dry run)

# ok, looks like I'm deleting the right PVC(s) - lets do it
$ kubectl delete pvc -l app.kubernetes.io/instance=mydb    
persistentvolumeclaim "data-mydb-postgresql-0" deleted

[Eternal21]

I use following yaml:

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: pvc-deleter-role
rules:
- apiGroups: [""]
  resources: ["persistentvolumeclaims"]
  verbs: ["get", "list", "delete", "deletecollection"]
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: pvc-deleter-sa
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: pvc-deleter-rolebinding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: pvc-deleter-role
subjects:
- kind: ServiceAccount
  name: pvc-deleter-sa
---
apiVersion: batch/v1
kind: Job
metadata:
  name: pvc-deleter-job
  annotations:
    "helm.sh/hook": pre-delete
    "helm.sh/hook-weight": "-5"
    "helm.sh/hook-delete-policy": hook-succeeded
spec:
  template:
    spec:
      restartPolicy: OnFailure
      containers:
      - name: post-delete-job
        image: "bitnami/kubectl"
        command: ["kubectl"]
        args:
        - "delete"
        - "pvc"
        - "--all"
      serviceAccountName: pvc-deleter-sa
      securityContext:
        runAsUser: 0

Thank you for this! Worked like a charm on the first try.