Commit e854c64b authored by Pantelis Malekas's avatar Pantelis Malekas
Browse files

OCM Managed helm chart

parent 170a67ee

ocm-managed-chart/Chart.lock

0 → 100644
+6 −0
Original line number Diff line number Diff line 
dependencies:

- name: ziti-edge-tunnel

  repository: https://openziti.io/helm-charts/

  version: 1.5.0

digest: sha256:d0b6068a31a88405c194aabaef966b8bd2068e147fedb613b84202effedfca89

generated: "2026-09-01T17:22:44.452761001+03:00"

ocm-managed-chart/Chart.yaml

0 → 100644
+14 −0
Original line number Diff line number Diff line 
# Chart.yaml

apiVersion: v2

name: ocm-managed-chart

description: Join a managed Kubernetes cluster to an Open Cluster Management hub

type: application

version: 0.1.0

appVersion: "latest"





dependencies:

  - name: ziti-edge-tunnel

    version: "1.5.0"

    repository: "https://openziti.io/helm-charts/"

    condition: openziti.enabled

ocm-managed-chart/charts/ziti-edge-tunnel-1.5.0.tgz

0 → 100644
+7.78 KiB

File added.

No diff preview for this file type.

View file

ocm-managed-chart/templates/_helpers.tpl

0 → 100644
+11 −0
Original line number Diff line number Diff line 
{{- define "ocm-managed.name" -}}

{{- .Chart.Name | trunc 63 | trimSuffix "-" }}

{{- end }}



{{- define "ocm-managed.fullname" -}}

{{- if contains .Chart.Name .Release.Name }}

{{- .Release.Name | trunc 63 | trimSuffix "-" }}

{{- else }}

{{- printf "%s-%s" .Release.Name .Chart.Name | trunc 63 | trimSuffix "-" }}

{{- end }}

{{- end }}

ocm-managed-chart/templates/cleanup-job.yaml

0 → 100644
+288 −0
Original line number Diff line number Diff line 
apiVersion: batch/v1

kind: Job

metadata:

  name: {{ include "ocm-managed.fullname" . }}-cleanup

  namespace: {{ .Release.Namespace }}



  labels:

    app.kubernetes.io/name: {{ include "ocm-managed.name" . }}

    app.kubernetes.io/instance: {{ .Release.Name }}



  annotations:

    "helm.sh/hook": pre-delete

    "helm.sh/hook-weight": "-10"

    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded



spec:

  backoffLimit: 1

  activeDeadlineSeconds: 300



  template:

    metadata:

      labels:

        app.kubernetes.io/name: {{ include "ocm-managed.name" . }}

        app.kubernetes.io/instance: {{ .Release.Name }}



    spec:

      restartPolicy: Never

      serviceAccountName: ocm-managed-installer



      containers:

        - name: cleanup

          image: alpine:3.22

          imagePullPolicy: IfNotPresent



          command:

            - /bin/sh

            - -ec

            - |

              echo "======================================"

              echo "Installing required tools"

              echo "======================================"



              apk add --no-cache \

                curl \

                bash \

                jq \

                ca-certificates



              echo "Installing clusteradm..."



              curl \

                --fail \

                --location \

                --show-error \

                --connect-timeout 10 \

                --max-time 120 \

                https://raw.githubusercontent.com/open-cluster-management-io/clusteradm/main/install.sh \

                | bash



              echo "Installing kubectl..."



              KUBECTL_VERSION="$(

                curl \

                  --fail \

                  --location \

                  --silent \

                  --show-error \

                  --connect-timeout 10 \

                  --max-time 30 \

                  https://dl.k8s.io/release/stable.txt

              )"



              curl \

                --fail \

                --location \

                --show-error \

                --connect-timeout 10 \

                --max-time 120 \

                "https://dl.k8s.io/release/${KUBECTL_VERSION}/bin/linux/amd64/kubectl" \

                -o /usr/local/bin/kubectl



              chmod +x /usr/local/bin/kubectl



              echo "clusteradm version:"

              clusteradm version



              echo "kubectl version:"

              kubectl version --client



              echo "======================================"

              echo "Creating managed cluster kubeconfig"

              echo "======================================"



              SA_TOKEN="$(

                cat /var/run/secrets/kubernetes.io/serviceaccount/token

              )"



              cat > /tmp/managed-kubeconfig <<EOF

              apiVersion: v1

              kind: Config



              clusters:

                - name: managed

                  cluster:

                    server: https://kubernetes.default.svc

                    certificate-authority: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt



              users:

                - name: installer

                  user:

                    token: ${SA_TOKEN}



              contexts:

                - name: managed-context

                  context:

                    cluster: managed

                    user: installer



              current-context: managed-context

              EOF



              export KUBECONFIG=/tmp/managed-kubeconfig



              echo "======================================"

              echo "Unjoining managed cluster"

              echo "======================================"



              clusteradm unjoin \

                --cluster-name "{{ .Values.clusterName }}" \

                --kubeconfig /tmp/managed-kubeconfig \

                --context managed-context || true



              echo "======================================"

              echo "Checking Klusterlet"

              echo "======================================"



              if kubectl get klusterlet klusterlet >/dev/null 2>&1; then



                echo "Klusterlet still exists. Requesting deletion..."



                kubectl delete klusterlet klusterlet \

                  --ignore-not-found=true \

                  --wait=false || true



                echo "Waiting for Klusterlet deletion..."



                COUNT=0



                while kubectl get klusterlet klusterlet >/dev/null 2>&1; do

                  COUNT=$((COUNT + 1))



                  if [ "${COUNT}" -ge 12 ]; then

                    echo "Klusterlet is stuck. Removing finalizers..."



                    kubectl patch klusterlet klusterlet \

                      --type=merge \

                      -p '{"metadata":{"finalizers":[]}}' || true



                    break

                  fi



                  sleep 5

                done

              fi



              echo "======================================"

              echo "Deleting remaining OCM namespaces"

              echo "======================================"



              kubectl delete namespace \

                open-cluster-management-agent \

                --ignore-not-found=true \

                --wait=false || true



              kubectl delete namespace \

                open-cluster-management \

                --ignore-not-found=true \

                --wait=false || true







{{- if .Values.openziti.enabled }}

              echo "========================================"

              echo "Cleaning OpenZiti controller resources"

              echo "========================================"



              ZITI_API="{{ .Values.openziti.controller.url }}/edge/management/v1"

              ZITI_USERNAME={{ .Values.openziti.controller.username | quote }}

              ZITI_PASSWORD={{ .Values.openziti.controller.password | quote }}



              ZITI_IDENTITY_NAME={{ .Values.openziti.identity.name | quote }}

              ZITI_SERVICE_NAME={{ .Values.openziti.hubApi.serviceName | quote }}

              ZITI_DIAL_POLICY="${ZITI_SERVICE_NAME}-{{ .Values.clusterName }}-dial"



              AUTH_RESPONSE="$(curl -ksS -X POST \

                "${ZITI_API}/authenticate?method=password" \

                -H "Content-Type: application/json" \

                -d "{\"username\":\"${ZITI_USERNAME}\",\"password\":\"${ZITI_PASSWORD}\"}")"



              ZITI_TOKEN="$(echo "${AUTH_RESPONSE}" | jq -r '.data.token // empty')"



              if [ -n "${ZITI_TOKEN}" ]; then



                echo "========================================"

                echo "Deleting OpenZiti Dial policy"

                echo "========================================"



                FILTER="name=\"${ZITI_DIAL_POLICY}\""



                POLICIES="$(curl -ksS --get \

                  "${ZITI_API}/service-policies" \

                  --data-urlencode "filter=${FILTER}" \

                  -H "zt-session: ${ZITI_TOKEN}")"



                POLICY_ID="$(echo "${POLICIES}" \

                  | jq -r --arg NAME "${ZITI_DIAL_POLICY}" \

                    '.data[]? | select(.name == $NAME) | .id' \

                  | head -n1)"



                if [ -n "${POLICY_ID}" ]; then

                  echo "Deleting OpenZiti Dial policy ${ZITI_DIAL_POLICY}"



                  curl -ksS -X DELETE \

                    "${ZITI_API}/service-policies/${POLICY_ID}" \

                    -H "zt-session: ${ZITI_TOKEN}" \

                    >/dev/null || true

                else

                  echo "OpenZiti Dial policy ${ZITI_DIAL_POLICY} not found."

                fi



                echo "========================================"

                echo "Deleting OpenZiti controller identity"

                echo "========================================"



                FILTER="name=\"${ZITI_IDENTITY_NAME}\""



                IDENTITIES="$(curl -ksS --get \

                  "${ZITI_API}/identities" \

                  --data-urlencode "filter=${FILTER}" \

                  -H "zt-session: ${ZITI_TOKEN}")"



                IDENTITY_ID="$(echo "${IDENTITIES}" \

                  | jq -r --arg NAME "${ZITI_IDENTITY_NAME}" \

                    '.data[]? | select(.name == $NAME) | .id' \

                  | head -n1)"



                if [ -n "${IDENTITY_ID}" ]; then

                  echo "Deleting OpenZiti identity ${ZITI_IDENTITY_NAME}"



                  curl -ksS -X DELETE \

                    "${ZITI_API}/identities/${IDENTITY_ID}" \

                    -H "zt-session: ${ZITI_TOKEN}" \

                    >/dev/null || true

                else

                  echo "OpenZiti identity ${ZITI_IDENTITY_NAME} not found."

                fi



              else

                echo "WARNING: Could not authenticate to OpenZiti controller."

                echo "Continuing uninstall without controller cleanup."

              fi



              echo "========================================"

              echo "Cleaning OpenZiti bootstrap resources"

              echo "========================================"



              kubectl delete secret {{ .Values.openziti.identity.secretName }} \

                -n {{ .Release.Namespace }} \

                --ignore-not-found=true || true



              kubectl delete rolebinding {{ include "ocm-managed.fullname" . }}-ziti-bootstrap \

                -n {{ .Release.Namespace }} \

                --ignore-not-found=true || true



              kubectl delete role {{ include "ocm-managed.fullname" . }}-ziti-bootstrap \

                -n {{ .Release.Namespace }} \

                --ignore-not-found=true || true



              kubectl delete serviceaccount {{ include "ocm-managed.fullname" . }}-ziti-bootstrap \

                -n {{ .Release.Namespace }} \

                --ignore-not-found=true || true

{{- end }}







              echo "======================================"

              echo "Managed cluster cleanup completed"

              echo "======================================"