fixup! fixup! Add prestop hook

crate · Oct 10, 2024 · ab0bf31 · ab0bf31
1 parent 7341f45
commit ab0bf31
Showing 1 changed file with 55 additions and 0 deletions.
diff --git a/crate/operator/create.py b/crate/operator/create.py
@@ -32,6 +32,7 @@
     AppsV1Api,
     CoreV1Api,
     PolicyV1Api,
+    RbacV1Subject,
     V1Affinity,
     V1Capabilities,
     V1ConfigMap,
@@ -63,8 +64,12 @@
     V1PodDisruptionBudgetSpec,
     V1PodSpec,
     V1PodTemplateSpec,
+    V1PolicyRule,
     V1Probe,
     V1ResourceRequirements,
+    V1Role,
+    V1RoleBinding,
+    V1RoleRef,
     V1Secret,
     V1SecretKeySelector,
     V1SecretVolumeSource,
@@ -940,6 +945,56 @@ async def create_statefulset(
             namespace=namespace,
             body=pdb,
         )
+        """
+           A ClusterRole is required to allow the POD to access the
+           number of replicas in the StatefulSet. This is required for the
+           pre-stop lifecycle hook to work correctly and detect a scale to 0.
+        """
+        policy_role = V1PolicyRule(api_client)
+        role_def = V1Role(
+            metadata=V1ObjectMeta(
+                name=f"crate-{name}",
+                owner_references=owner_references,
+            ),
+            rules=[
+                V1PolicyRule(
+                    api_groups=["apps"],
+                    resources=["statefulsets"],
+                    verbs=["get", "list", "watch"],
+                )
+            ],
+        )
+        await call_kubeapi(
+            policy_role.create_namespaced_role,
+            logger,
+            continue_on_conflict=True,
+            body=role_def,
+        )
+        role_binding = V1PolicyRule(api_client)
+        role_binding_def = V1RoleBinding(
+            metadata=V1ObjectMeta(
+                name=f"crate-{name}",
+                owner_references=owner_references,
+            ),
+            role_ref=V1RoleRef(
+                api_group="rbac.authorization.k8s.io",
+                kind="ClusterRole",
+                name=f"crate-{name}",
+            ),
+            subjects=[
+                RbacV1Subject(
+                    kind="ServiceAccount",
+                    name="default",
+                    namespace=namespace,
+                )
+            ],
+        )
+        await call_kubeapi(
+            role_binding.create_namespaced_role_binding,
+            logger,
+            continue_on_conflict=True,
+            body=role_binding_def,
+        )
 
 
 def get_data_service(