post-install-upgrade-job.yaml

{{/*
Licensed to the Apache Software Foundation (ASF) under one or more
contributor license agreements.  See the NOTICE file distributed with
this work for additional information regarding copyright ownership.
The ASF licenses this file to You under the Apache License, Version 2.0
(the "License"); you may not use this file except in compliance with
the License.  You may obtain a copy of the License at

   http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/}}
{{- if .Values.post_install_job.enabled }}
{{- $values := .Values }}
{{- $sasl := $values.auth.sasl }}
---
apiVersion: batch/v1
kind: Job
metadata:
  name: {{ template "redpanda.fullname" . }}-configuration
  namespace: {{ .Release.Namespace | quote }}
  labels:
{{- with include "full.labels" . }}
  {{- . | nindent 4 }}
{{- end }}
{{- with .Values.post_install_job.labels }}
  {{- toYaml . | nindent 4 }}
{{- end }}
  annotations:
    # This is what defines this resource as a hook. Without this line, the
    # job is considered part of the release.
    "helm.sh/hook": post-install,post-upgrade
    "helm.sh/hook-delete-policy": before-hook-creation
    "helm.sh/hook-weight": "-10"
{{- with .Values.post_install_job.annotations }}
  {{- toYaml . | nindent 4 }}
{{- end }}
spec:
  template:
    metadata:
      generateName: "{{ .Release.Name }}-post-"
      labels:
        app.kubernetes.io/name: {{ template "redpanda.name" . }}
        app.kubernetes.io/instance: {{ .Release.Name | quote }}
        app.kubernetes.io/component: {{ (include "redpanda.name" .) | trunc 50  }}-post-install
{{- with .Values.commonLabels }}
  {{- toYaml . | nindent 8 }}
{{- end }}
    spec:
    {{- with .Values.nodeSelector }}
      nodeSelector: {{- toYaml . | nindent 8 }}
    {{- end }}
    {{- with .Values.tolerations }}
      tolerations: {{- toYaml . | nindent 8 }}
    {{- end }}
      restartPolicy: Never
      securityContext: {{ include "pod-security-context" . | nindent 8 }}
      containers:
      - name: {{ template "redpanda.name" . }}-post-install
        image: {{ .Values.image.repository }}:{{ template "redpanda.tag" . }}
        {{- if not (empty .Values.license_secret_ref) }}
        env:
          - name: REDPANDA_LICENSE
            valueFrom:
              secretKeyRef:
                name: {{ .Values.license_secret_ref.secret_name }}
                key: {{ .Values.license_secret_ref.secret_key }}
        {{- end }}
        command: ["bash","-c"]
        args:
          - |
            set -e
        {{- if and $sasl.enabled (not (empty $sasl.secretRef ))  }}
            USERS_FILE=$(find /etc/secrets/users/* -print)
            while read p; do
              IFS=":" read -r USER_NAME PASSWORD MECHANISM <<< $p
              # Do not process empty lines
              if [ -z "$USER_NAME" ]; then
                continue
              fi
              echo "Creating user ${USER_NAME}..."
              MECHANISM=${MECHANISM:-{{- include "sasl-mechanism" . }}}
              creation_result=$(rpk acl user create ${USER_NAME} --password=${PASSWORD} --mechanism ${MECHANISM} {{ template "rpk-flags-no-sasl" $ }} 2>&1) && creation_result_exit_code=$? || creation_result_exit_code=$?  # On a non-success exit code
              if [[ $creation_result_exit_code -ne 0 ]]; then
              # Check if the stderr contains "User already exists"
                if [[ $creation_result == *"User already exists"* ]]; then
                  # TODO: change user password instead in the future when api enables this.
                  echo "the user ${USER_NAME} already exists, skipping creation."
                else
                  # Another error occurred, so output the original message and exit code
                  echo "error creating user ${USER_NAME}: ${creation_result}"
                  exit $creation_result_exit_code
                fi
              # On a success, the user was created so output that
              else
                echo "Created user ${USER_NAME}."
              fi
            done < $USERS_FILE
        {{- end }}

        {{- if (include "redpanda-atleast-22-2-0" . | fromJson).bool }}
          {{- if not (empty .Values.license_secret_ref) }}
            rpk cluster license set "$REDPANDA_LICENSE" {{ template "rpk-flags-no-sasl" $ }}
          {{- else if not (empty .Values.license_key) }}
            rpk cluster license set {{ .Values.license_key | quote }} {{ template "rpk-flags-no-sasl" $ }}
          {{- end }}
        {{- end }}
        {{- with .Values.post_install_job.resources }}
        resources:
          {{- toYaml . | nindent 10 }}
        {{- end }}
        securityContext: {{ include "container-security-context" . | nindent 10 }}
        volumeMounts:
          - name: {{ template "redpanda.fullname" . }}
            mountPath: /tmp/base-config
          - name: config
            mountPath: /etc/redpanda
        {{- if (include "tls-enabled" . | fromJson).bool }}
          {{- range $name, $cert := .Values.tls.certs }}
          - name: redpanda-{{ $name }}-cert
            mountPath: {{ printf "/etc/tls/certs/%s" $name }}
          {{- end }}
        {{- end }}
          {{- if and $sasl.enabled (not (empty $sasl.secretRef )) }}
          - name: {{ $sasl.secretRef }}
            mountPath: "/etc/secrets/users"
            readOnly: true
          {{- end}}
      volumes:
        - name: {{ template "redpanda.fullname" . }}
          configMap:
            name: {{ template "redpanda.fullname" . }}
        - name: config
          emptyDir: {}
      {{- if (include "tls-enabled" . | fromJson).bool }}
        {{- range $name, $cert := .Values.tls.certs }}
        - name: redpanda-{{ $name }}-cert
          secret:
            defaultMode: 420
            items:
            - key: tls.key
              path: tls.key
            - key: tls.crt
              path: tls.crt
          {{- if $cert.caEnabled }}
            - key: ca.crt
              path: ca.crt
          {{- end }}
            secretName: {{ template "redpanda.fullname" $ }}-{{ $name }}-cert
        {{- end }}
      {{- end -}}
      {{- if and $sasl.enabled (not (empty $sasl.secretRef )) }}
        - name: {{ $sasl.secretRef }}
          secret:
            secretName: {{ $sasl.secretRef }}
            optional: false
      {{- end }}
      serviceAccountName: {{ include "redpanda.serviceAccountName" . }}
{{- end -}}