From 9a37e865d5e4732753260d0327c0d933c9b5eb2a Mon Sep 17 00:00:00 2001 From: "sumit.jain6" Date: Wed, 9 Sep 2026 15:30:55 +0530 Subject: [PATCH 1/3] changes to make postdelete-delete-db2-user_Job.yaml to use post delete instead of presync --- .../templates/postdelete-delete-db2-user_Job.yaml | 6 +++--- .../templates/130-ibm-mas-suite-configs-app.yaml | 3 +-- 2 files changed, 4 insertions(+), 5 deletions(-) diff --git a/instance-applications/130-ibm-jdbc-config/templates/postdelete-delete-db2-user_Job.yaml b/instance-applications/130-ibm-jdbc-config/templates/postdelete-delete-db2-user_Job.yaml index 442126650..62318f6e3 100644 --- a/instance-applications/130-ibm-jdbc-config/templates/postdelete-delete-db2-user_Job.yaml +++ b/instance-applications/130-ibm-jdbc-config/templates/postdelete-delete-db2-user_Job.yaml @@ -23,7 +23,7 @@ metadata: name: {{ $sa }} namespace: {{ $ns }} annotations: - argocd.argoproj.io/hook: PreSync + argocd.argoproj.io/hook: PostDelete argocd.argoproj.io/hook-delete-policy: HookSucceeded,BeforeHookCreation {{- if .Values.custom_labels }} labels: @@ -41,7 +41,7 @@ metadata: name: {{ $role }} namespace: {{ .Values.db2_namespace }} annotations: - argocd.argoproj.io/hook: PreSync + argocd.argoproj.io/hook: PostDelete argocd.argoproj.io/hook-delete-policy: HookSucceeded,BeforeHookCreation {{- if .Values.custom_labels }} labels: @@ -78,7 +78,7 @@ metadata: name: {{ $rb }} namespace: {{ .Values.db2_namespace }} annotations: - argocd.argoproj.io/hook: PreSync + argocd.argoproj.io/hook: PostDelete argocd.argoproj.io/hook-delete-policy: HookSucceeded,BeforeHookCreation {{- if .Values.custom_labels }} labels: diff --git a/root-applications/ibm-mas-instance-root/templates/130-ibm-mas-suite-configs-app.yaml b/root-applications/ibm-mas-instance-root/templates/130-ibm-mas-suite-configs-app.yaml index fd5d05884..66d74c108 100644 --- a/root-applications/ibm-mas-instance-root/templates/130-ibm-mas-suite-configs-app.yaml +++ b/root-applications/ibm-mas-instance-root/templates/130-ibm-mas-suite-configs-app.yaml @@ -30,8 +30,7 @@ metadata: {{- end }} finalizers: - resources-finalizer.argocd.argoproj.io - - post-delete-finalizer.argocd.argoproj.io - - post-delete-finalizer.argocd.argoproj.io/cleanup + - post-delete-finalizer.argocd.argoproj.io labels: environment: '{{ $.Values.account.id }}' region: '{{ $.Values.region.id }}' From b8c3da3a233e77c9a1d213380365d0676f605790 Mon Sep 17 00:00:00 2001 From: "sumit.jain6" Date: Mon, 14 Sep 2026 14:03:24 +0530 Subject: [PATCH 2/3] using network policy and a role to access secret from syncres namespace --- .../postdelete-delete-db2-user_Job.yaml | 102 +++++++++++++++--- 1 file changed, 86 insertions(+), 16 deletions(-) diff --git a/instance-applications/130-ibm-jdbc-config/templates/postdelete-delete-db2-user_Job.yaml b/instance-applications/130-ibm-jdbc-config/templates/postdelete-delete-db2-user_Job.yaml index 62318f6e3..2c77fdc43 100644 --- a/instance-applications/130-ibm-jdbc-config/templates/postdelete-delete-db2-user_Job.yaml +++ b/instance-applications/130-ibm-jdbc-config/templates/postdelete-delete-db2-user_Job.yaml @@ -8,11 +8,13 @@ Use the build/bin/set-cli-image-digest.sh script to update this value across all {{- $_cli_image_digest := "sha256:1c5701a24c9796e02b33036f56babbe74032831e1db733ce9228a46dce4a870b" }} {{ $ns := printf "mas-%s-core" .Values.instance_id }} +{{ $syncres_ns := printf "mas-%s-syncres" .Values.instance_id }} {{ $prefix := printf "post-jdbc-usr-%s" .Values.mas_config_name }} -{{ $secret := printf "%s-creds" $prefix }} {{ $sa := printf "%s-sa" $prefix }} {{ $role := printf "%s-role" $prefix }} {{ $rb := printf "%s-rb" $prefix }} +{{ $syncres_role := printf "%s-syncres-role" $prefix }} +{{ $syncres_rb := printf "%s-syncres-rb" $prefix }} {{ $np := printf "%s-np" $prefix }} {{ $job := printf "%s-job" $prefix }} @@ -32,6 +34,53 @@ metadata: + +--- +# Role in syncres namespace — grants the postdelete SA read access to the aws credentials secret. +# This avoids embedding AVP placeholder tokens (sm_aws_access_key_id / sm_aws_secret_access_key) +# as literal env var values in the Job, which would cause AVP to try to resolve them at manifest +# generation time and fail if the upstream AWS SM secret has since been deleted. +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: {{ $syncres_role }} + namespace: {{ $syncres_ns }} + annotations: + argocd.argoproj.io/hook: PostDelete + argocd.argoproj.io/hook-delete-policy: HookSucceeded,BeforeHookCreation +{{- if .Values.custom_labels }} + labels: +{{ .Values.custom_labels | toYaml | indent 4 }} +{{- end }} +rules: +- apiGroups: [""] + resources: ["secrets"] + verbs: ["get"] + resourceNames: ["aws"] + +--- +# RoleBinding in syncres namespace to bind the postdelete SA from mas-core namespace +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: {{ $syncres_rb }} + namespace: {{ $syncres_ns }} + annotations: + argocd.argoproj.io/hook: PostDelete + argocd.argoproj.io/hook-delete-policy: HookSucceeded,BeforeHookCreation +{{- if .Values.custom_labels }} + labels: +{{ .Values.custom_labels | toYaml | indent 4 }} +{{- end }} +subjects: + - kind: ServiceAccount + name: {{ $sa }} + namespace: {{ $ns }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: {{ $syncres_role }} + --- # Role in DB2 namespace for accessing DB2 resources # This allows the service account from mas-core namespace to access resources in db2 namespace @@ -70,6 +119,7 @@ rules: - get - list + --- # RoleBinding in DB2 namespace to bind the service account from mas-core namespace kind: RoleBinding @@ -93,6 +143,30 @@ roleRef: kind: Role name: {{ $role }} +--- +# Permit outbound communication by the Job pods +# (Needed to communicate with the K8S HTTP API and AWS SM) +kind: NetworkPolicy +apiVersion: networking.k8s.io/v1 +metadata: + name: {{ $np }} + namespace: {{ $ns }} + annotations: + argocd.argoproj.io/hook: PostDelete + argocd.argoproj.io/hook-delete-policy: HookSucceeded,BeforeHookCreation +{{- if .Values.custom_labels }} + labels: +{{ .Values.custom_labels | toYaml | indent 4 }} +{{- end }} +spec: + podSelector: + matchLabels: + app: {{ $job }} + egress: + - {} + policyTypes: + - Egress + --- apiVersion: batch/v1 kind: Job @@ -144,24 +218,16 @@ spec: - name: MAS_INSTANCE_ID value: "{{ .Values.instance_id }}" - # Hard-coded for now: + # AWS SM credentials are read at runtime from the aws Secret in the syncres namespace + # (via the syncres Role/RoleBinding above) to avoid embedding AVP placeholder tokens + # as literal values — which would cause manifest generation failures during deprovisioning + # if the upstream AWS SM secret has since been deleted. - name: AVP_TYPE value: "aws" - name: SM_AWS_REGION - valueFrom: - secretKeyRef: - name: aws - key: aws_default_region - - name: SM_AWS_ACCESS_KEY_ID - valueFrom: - secretKeyRef: - name: aws - key: aws_access_key_id - - name: SM_AWS_SECRET_ACCESS_KEY - valueFrom: - secretKeyRef: - name: aws - key: aws_secret_access_key + value: "{{ .Values.region_id }}" + - name: SYNCRES_NS + value: "{{ $syncres_ns }}" command: - /bin/sh @@ -178,11 +244,15 @@ spec: SECRETS_KEY_SEPERATOR="/" SECRET_NAME_JDBC_CONFIG=${ACCOUNT_ID}${SECRETS_KEY_SEPERATOR}${CLUSTER_ID}${SECRETS_KEY_SEPERATOR}${MAS_INSTANCE_ID}${SECRETS_KEY_SEPERATOR}jdbc${SECRETS_KEY_SEPERATOR}${DB2_INSTANCE_NAME}${SECRETS_KEY_SEPERATOR}config + export SM_AWS_ACCESS_KEY_ID=$(oc get secret aws -n ${SYNCRES_NS} -o jsonpath='{.data.aws_access_key_id}' | base64 -d) + export SM_AWS_SECRET_ACCESS_KEY=$(oc get secret aws -n ${SYNCRES_NS} -o jsonpath='{.data.aws_secret_access_key}' | base64 -d) + echo "Params:" echo " - ACCOUNT_ID ................... ${ACCOUNT_ID}" echo " - CLUSTER_ID ................... ${CLUSTER_ID}" echo " - MAS_INSTANCE_ID ................... ${MAS_INSTANCE_ID}" echo " - SECRET_NAME_JDBC_CONFIG ................... ${SECRET_NAME_JDBC_CONFIG}" + echo " - SYNCRES_NS ................... ${SYNCRES_NS}" echo " - SM_AWS_REGION ................... ${SM_AWS_REGION}" echo " - SM_AWS_ACCESS_KEY_ID ................... ${SM_AWS_ACCESS_KEY_ID:0:2}" echo " - SM_AWS_SECRET_ACCESS_KEY ................... ${SM_AWS_SECRET_ACCESS_KEY:0:2}" From 9f2c1d9047f8436a5212768f960293fbd87463b3 Mon Sep 17 00:00:00 2001 From: "sumit.jain6" Date: Mon, 14 Sep 2026 22:51:55 +0530 Subject: [PATCH 3/3] merged with main --- .../templates/140-ibm-mas-suite-configs-app.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/root-applications/ibm-mas-instance-root/templates/140-ibm-mas-suite-configs-app.yaml b/root-applications/ibm-mas-instance-root/templates/140-ibm-mas-suite-configs-app.yaml index 1c0088555..2787c7449 100644 --- a/root-applications/ibm-mas-instance-root/templates/140-ibm-mas-suite-configs-app.yaml +++ b/root-applications/ibm-mas-instance-root/templates/140-ibm-mas-suite-configs-app.yaml @@ -31,6 +31,7 @@ metadata: finalizers: - resources-finalizer.argocd.argoproj.io - post-delete-finalizer.argocd.argoproj.io + - post-delete-finalizer.argocd.argoproj.io/cleanup labels: environment: '{{ $.Values.account.id }}' region: '{{ $.Values.region.id }}'