NVIDIA / nodewright / 31759335068

79%

Build Type

push

github

Committed by web-flow

Commit Message

fix(chart): template hardcoded skyhook-operator resource names (#463)

The manager and leader-election RBAC, the metrics reader ClusterRole, both
Services, and both webhook configurations were still named skyhook-operator-*,
along with the app.kubernetes.io/created-by and part-of labels. They now
template off chart.fullname the way the Deployment already did, and
operator/config/ is mirrored (namePrefix: nodewright-), so kustomize and Helm
render identical names. Closes #440.

Renaming the webhook Service and the two webhook configurations turned out not
to be a chart-only change. Three things had to move with it:

The operator finds its webhook configurations by the
nodewright.nvidia.com/webhook-config label instead of by name. A name-based
lookup makes a rename a hard error on the running old leader: it never goes
Ready, so the rolling update never terminates it, so it never releases the
webhook bootstrap lease, and helm upgrade wedges on "Pending termination". The
now-vestigial webhookValidatingWebhookConfiguration /
webhookMutatingWebhookConfiguration builders and webhookClient are removed with
the constants; the chart has owned creation of these objects for several
releases and the operator only ever patched their caBundle.

The webhook serving certificate is reminted when the Service is renamed.
Secret/webhook-cert is operator-owned, so it survives the upgrade, and the
operator only reminted on expiry or a cert-on-disk mismatch. A renamed Service
therefore left a year-valid cert carrying the old SAN and admission failed
closed with "x509: certificate is valid for skyhook-operator-webhook-service...,
not nodewright-webhook-service".

Label discovery cannot save the upgrade that introduces it, because the pod
holding the lease is the pre-rename one. The existing selectorMigration
pre-upgrade hook now also detects a pre-label-discovery operator (the live
Deployment has no WEBHOOK_SERVICE_NAME env var) and deletes the Deployment so
Helm recreates it... (continued)

Coverage Stats

110 of 140 new or added lines in 1 file covered. (78.57%)

1 existing line in 1 file now uncovered.

10219 of 12895 relevant lines covered (79.25%)

7.94 hits per line