From b94fc6c9c84cc73e5f53341a24bbdfe0f2fb0f62 Mon Sep 17 00:00:00 2001 From: Timofei Larkin Date: Tue, 30 Dec 2025 11:38:49 +0300 Subject: [PATCH] [tenant] Run cleanup job from system namespace ## What this PR does The Helm hook that creates a job deleting all applications in a tenant before deleting the tenant itself now runs this job from the cozy-system namespace. This prevents conflicts with resource quotas (not enough resources to run cleanup job) without temporary increases of the quota or similar vulnerability-introducing hacks. ### Release note ```release-note [tenant] Run cleanup job in system namespace to avoid conflicts on resource quotas. ``` Signed-off-by: Timofei Larkin --- packages/apps/tenant/templates/cleanup-job.yaml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/packages/apps/tenant/templates/cleanup-job.yaml b/packages/apps/tenant/templates/cleanup-job.yaml index 9a1bcdd5..9b2f2c50 100644 --- a/packages/apps/tenant/templates/cleanup-job.yaml +++ b/packages/apps/tenant/templates/cleanup-job.yaml @@ -3,7 +3,7 @@ apiVersion: v1 kind: ServiceAccount metadata: name: {{ include "tenant.name" . }}-cleanup - namespace: {{ include "tenant.name" . }} + namespace: cozy-system annotations: helm.sh/hook: pre-delete helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded @@ -39,13 +39,13 @@ roleRef: subjects: - kind: ServiceAccount name: {{ include "tenant.name" . }}-cleanup - namespace: {{ include "tenant.name" . }} + namespace: cozy-system --- apiVersion: batch/v1 kind: Job metadata: name: {{ include "tenant.name" . }}-cleanup - namespace: {{ include "tenant.name" . }} + namespace: cozy-system annotations: helm.sh/hook: pre-delete helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded