Allow job hooks to be disabled (#434)

Co-authored-by: Marco Franssen <[email protected]>
Co-authored-by: Kevin Fox <[email protected]>

charts/spire/charts/spire-server/README.md

@@ -100,6 +100,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
 | clusterName | string | `"example-cluster"` |  |
 | configMap.annotations | object | `{}` | Annotations to add to the SPIRE Server ConfigMap |
 | controllerManager.configMap.annotations | object | `{}` | Annotations to add to the Controller Manager ConfigMap |
+| controllerManager.deleteHook.enabled | bool | `true` | Enable Helm hook to autofix common delete issues (should be disabled when using `helm template`) |
 | controllerManager.enabled | bool | `false` |  |
 | controllerManager.identities.dnsNameTemplates | list | `[]` |  |
 | controllerManager.identities.enabled | bool | `true` |  |
@@ -115,6 +116,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
 | controllerManager.image.repository | string | `"spiffe/spire-controller-manager"` | The repository within the registry |
 | controllerManager.image.tag | string | `"0.2.3"` | Overrides the image tag |
 | controllerManager.image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) |
+| controllerManager.installAndUpgradeHook.enabled | bool | `true` | Enable Helm hook to autofix common install/upgrade issues (should be disabled when using `helm template`) |
 | controllerManager.resources | object | `{}` |  |
 | controllerManager.securityContext | object | `{}` |  |
 | controllerManager.service.annotations | object | `{}` |  |

charts/spire/charts/spire-server/templates/controller-manager-webhook.yaml

@@ -10,7 +10,11 @@ webhooks:
         name: {{ include "spire-controller-manager.fullname" . }}-webhook
         namespace: {{ include "spire-server.namespace" . }}
         path: /validate-spire-spiffe-io-v1alpha1-clusterfederatedtrustdomain
+    {{- if eq (.Values.controllerManager.installAndUpgradeHook.enabled | toString) "true" }}
     failurePolicy: Ignore # Actual value to be set by post install/upgrade hooks
+    {{- else }}
+    failurePolicy: {{ .Values.controllerManager.validatingWebhookConfiguration.failurePolicy }}
+    {{- end }}
     name: vclusterfederatedtrustdomain.kb.io
     rules:
       - apiGroups: ["spire.spiffe.io"]

charts/spire/charts/spire-server/templates/post-install-hook.yaml

@@ -1,3 +1,4 @@
+{{- if eq ((dig "installAndUpgradeHooks" "enabled" .Values.controllerManager.installAndUpgradeHook.enabled .Values.global) | toString) "true" }}
 {{- if eq (.Values.controllerManager.enabled | toString) "true" }}
 {{- if eq .Values.controllerManager.validatingWebhookConfiguration.failurePolicy "Fail" }}
 apiVersion: v1
@@ -85,3 +86,4 @@ spec:
             }
 {{- end }}
 {{- end }}
+{{- end }}

charts/spire/charts/spire-server/templates/post-upgrade-hook.yaml

@@ -1,3 +1,4 @@
+{{- if eq ((dig "installAndUpgradeHooks" "enabled" .Values.controllerManager.installAndUpgradeHook.enabled .Values.global) | toString) "true" }}
 {{- if eq (.Values.controllerManager.enabled | toString) "true" }}
 {{- if eq .Values.controllerManager.validatingWebhookConfiguration.failurePolicy "Fail" }}
 apiVersion: v1
@@ -85,3 +86,4 @@ spec:
             }
 {{- end }}
 {{- end }}
+{{- end }}

charts/spire/charts/spire-server/templates/pre-delete-hook.yaml

@@ -1,3 +1,4 @@
+{{- if eq ((dig "deleteHooks" "enabled" .Values.controllerManager.deleteHook.enabled .Values.global) | toString) "true" }}
 {{- if .Values.upstreamAuthority.spire.enabled }}
 apiVersion: v1
 kind: ServiceAccount
@@ -88,3 +89,4 @@ spec:
           - -n
           - {{ include "spire-server.namespace" . }}
 {{- end }}
+{{- end }}

charts/spire/charts/spire-server/templates/pre-upgrade-hook.yaml

@@ -1,3 +1,4 @@
+{{- if eq ((dig "installAndUpgradeHooks" "enabled" .Values.controllerManager.installAndUpgradeHook.enabled .Values.global) | toString) "true" }}
 {{- if eq (.Values.controllerManager.enabled | toString) "true" }}
 {{- if eq .Values.controllerManager.validatingWebhookConfiguration.failurePolicy "Fail" }}
 apiVersion: v1
@@ -85,3 +86,4 @@ spec:
             }
 {{- end }}
 {{- end }}
+{{- end }}

charts/spire/charts/spire-server/values.yaml

@@ -250,6 +250,12 @@ notifier:
 
 controllerManager:
   enabled: false
+  installAndUpgradeHook:
+    # -- Enable Helm hook to autofix common install/upgrade issues (should be disabled when using `helm template`)
+    enabled: true
+  deleteHook:
+    # -- Enable Helm hook to autofix common delete issues (should be disabled when using `helm template`)
+    enabled: true
 
   image:
     # -- The OCI registry to pull the image from