SAP-archive / karydia

Kubernetes Security Walnut
Other
77 stars 10 forks source link

Karydia Helm Upgrade process is broken #225

Closed linuxbsdfreak closed 4 years ago

linuxbsdfreak commented 4 years ago

Description

Karydia Helm Upgrade process is completely broken

Steps to reproduce

helm del --purge karydia

Expected behavior

Helm would cleanup the karydia chart resources in a clean manner.

Default behavior

helm del --purge karydia
Error: serviceaccounts "karydia-cleanup" already exists
k get serviceaccounts -n kube-system | grep "karydia"
karydia-cleanup                      1         91m

My previous install was from a previous chart version which was installed in kube-system namespace

The whole helm chart upgrade process is broken and needs to be looked into at the earliest. FYI. We cannot delete and recreate K8s cluster to re-create a karydia install if the helm upgrade is not clean.

For info we are upgrading a K8s operator with helm and it works without any issues

helm upgrade --namespace flux --install flux fluxcd/flux --version $FLUX_CHART_VERSION --values flux-deployment-values-$CLUSTER-$REGION.yaml

The flux helm chart for reference

https://github.com/fluxcd/flux/tree/master/chart/flux

Logs / console output / screenshots / affected lines of code

Environment

Neumann-Nils commented 4 years ago

We are really sorry that the upgrade process of Karydia using Helm did not work for you as intended. We strongly believe that a consistent and working upgrade process is a must for Karydia and I am looking into this issue.

I already wanted to give you our first feedback. Besides giving a clean upgrade process using Helm from a technical perspective, we think that we can improve the upgrade/versioning process over all. This might include:

linuxbsdfreak commented 4 years ago

@Neumann-Nils . Thanks for your help. However the Upgrade process does not work. Steps to simulate.

  1. Created my custom values.yaml for overriding
exclusionObjectLabels:
  - key: "app"
    values:
      - "karydia"
      - "flux"
      - "flux-helm-operator"
      - "flux-memcached"
      - "postgresql"
      - "postgresql-client"
  1. Installed as follows helm install ./install/charts --name karydia-install --namespace karydia -f ./install/values.yaml

  2. Install works

  3. Edited my custom values.yaml

exclusionObjectLabels:
  - key: "app"
    values:
      - "karydia"
      - "flux"
      - "flux-helm-operator"
      - "flux-memcached"
      - "postgresql"
      - "postgresql-client"
      - "sealed-secrets"
  1. Changed the install/charts/Chart.yaml and incremented to version: 0.1.1

  2. helm upgrade -f ./install/values.yaml karydia-install ./install/charts.

The Validating and Mutating webhooks data does not contain the exception and the karydia pod does not get relaunched.

Neumann-Nils commented 4 years ago

This should be fixed with PR https://github.com/karydia/karydia/pull/260