From 7c51d6e0e84f226d676dc9c28c9a7b89877a1c1e Mon Sep 17 00:00:00 2001
From: Kirill Ilin <stitch14@yandex.ru>
Date: Tue, 17 Feb 2026 22:27:05 +0500
Subject: [PATCH] [platform] preserve tenant-root HelmRelease during migration

Signed-off-by: Kirill Ilin <stitch14@yandex.ru>
---
 hack/migrate-to-version-1.0.sh                     | 14 ++++++++++++++
 .../cozystack-basics/templates/tenant-root.yaml    | 14 +++++++++++---
 2 files changed, 25 insertions(+), 3 deletions(-)

diff --git a/hack/migrate-to-version-1.0.sh b/hack/migrate-to-version-1.0.sh
index 3c0c64f8..38096aa5 100755
--- a/hack/migrate-to-version-1.0.sh
+++ b/hack/migrate-to-version-1.0.sh
@@ -32,6 +32,20 @@ if ! kubectl get namespace "$NAMESPACE" &> /dev/null; then
     exit 1
 fi
 
+# Preserve tenant-root HelmRelease during upgrade
+# In v0.41 the HelmRelease lacks helm.sh/resource-policy: keep, so it would be
+# deleted when the old platform chart is uninstalled. Adding the annotation here
+# ensures the resource (and its user-set values like ingress: true) survives the
+# transition to cozystack-basics, where a lookup merges them into the new template.
+echo "Preserving tenant-root HelmRelease..."
+if kubectl get helmrelease -n tenant-root tenant-root &> /dev/null; then
+    kubectl annotate helmrelease -n tenant-root tenant-root helm.sh/resource-policy=keep --overwrite
+    echo "  Added helm.sh/resource-policy: keep annotation"
+else
+    echo "  No tenant-root HelmRelease found (will be created during upgrade)"
+fi
+echo ""
+
 # Read ConfigMap cozystack
 echo "Reading ConfigMap cozystack..."
 COZYSTACK_CM=$(kubectl get configmap -n "$NAMESPACE" cozystack -o json 2>/dev/null || echo "{}")
diff --git a/packages/system/cozystack-basics/templates/tenant-root.yaml b/packages/system/cozystack-basics/templates/tenant-root.yaml
index 95af9d7f..4230e660 100644
--- a/packages/system/cozystack-basics/templates/tenant-root.yaml
+++ b/packages/system/cozystack-basics/templates/tenant-root.yaml
@@ -4,6 +4,11 @@ kind: Namespace
 metadata:
   name: tenant-root
 ---
+{{- $existingValues := dict }}
+{{- $existing := lookup "helm.toolkit.fluxcd.io/v2" "HelmRelease" "tenant-root" "tenant-root" }}
+{{- if and $existing $existing.spec $existing.spec.values }}
+{{- $existingValues = omit $existing.spec.values "_cluster" }}
+{{- end }}
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:
@@ -24,6 +29,9 @@ spec:
   interval: 1m0s
   timeout: 5m0s
   values:
-    _cluster:
-      oidc-enabled: {{ .Values.oidcEnabled | quote }}
-      root-host: {{ .Values.rootHost | quote }}
+    {{- $clusterValues := dict
+        "oidc-enabled" (.Values.oidcEnabled | toString)
+        "root-host" (.Values.rootHost | toString)
+    }}
+    {{- $mergedValues := merge (dict "_cluster" $clusterValues) $existingValues }}
+    {{- $mergedValues | toYaml | nindent 4 }}