Helm 预安装作业在服务帐户之前创建

Question

作为我的应用程序舵图的一部分，我有一个运行数据库迁移的作业。I\xe2\x80\x99ve 用钩子注释了作业"helm.sh/hook": pre-install,pre-upgrade以确保在部署应用程序之前运行迁移。我想使用我的应用程序部署使用的相同服务帐户和配置映射，但是在执行作业时尚未创建这些资源，从而导致以下错误：

\n

Warning FailedCreate 8s job-controller Error creating: pods "db-migrate-" is forbidden: error looking up service account dev-platform/platform: serviceaccount "platform" not found

\n

根据 helm 安装顺序，应在作业之前创建服务帐户和配置映射。运行作业时该行为是否无效pre-install？：

\n

apiVersion: batch/v1\nkind: Job\nmetadata:\n  namespace: dev-platform\n  name: db-migrate\n  annotations:\n    "helm.sh/hook": pre-install,pre-upgrade\n    "helm.sh/hook-delete-policy": hook-succeeded\nspec:\n  activeDeadlineSeconds: 300\n  backoffLimit: 1\n  template:\n    spec:\n      # Share platform service account IAM role.\n      serviceAccountName: {{ .Release.Name }}\n      securityContext:\n        fsGroup: 65534 #  Allow read permissions of AWS token files for IAM service account token.\n      restartPolicy: Never\n      containers:\n        - name: db-migrate\n          image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"\n          imagePullPolicy: {{ .Values.image.pullPolicy }}\n          envFrom:\n            - configMapRef:\n                name: platform-config\n            - secretRef:\n                name: platform-secrets\n          # Overwrite APP_COMMAND variable.\n          env:\n            - name: APP_COMMAND\n              value: migrate\n            - name: APP_ENVIRONMENT\n              value: {{ .Values.image.appEnvironment | quote }}\n

\n

Answer 1

Helm hooks 不仅仅限于 Jobs。

您可以使用与作业相同的 helm-hook 注释在预安装阶段本身创建 serviceaccount 和 configmap。

注意：如果您需要在预安装阶段后提供可用的 serviceaccount 和 configmap，请勿将 'helm.sh/hook-delete-policy' 设置为 'hook-succeeded'。

例子：

apiVersion: v1
  kind: ServiceAccount
  metadata:
    name: my-sa    
    annotations:
      helm.sh/hook: pre-install
      helm.sh/hook-delete-policy: before-hook-creation
      helm.sh/hook-weight: "-10"