cozystack/packages/apps/kubernetes/templates/delete.yaml

---
apiVersion: batch/v1
kind: Job
metadata:
  annotations:
    "helm.sh/hook": pre-delete
    "helm.sh/hook-weight": "10"
    "helm.sh/hook-delete-policy": hook-succeeded,before-hook-creation
  name: {{ .Release.Name }}-pre-cleanup
spec:
  template:
    metadata:
      labels:
        policy.cozystack.io/allow-to-apiserver: "true"
    spec:
      serviceAccountName: {{ .Release.Name }}-cleanup
      restartPolicy: Never
      tolerations:
        - key: CriticalAddonsOnly
          operator: Exists
        - key: node-role.kubernetes.io/control-plane
          operator: Exists
          effect: "NoSchedule"
      containers:
        - name: kubectl
          image: docker.io/clastix/kubectl:v1.32
          command:
            - /bin/sh
            - -c
            - |
              set -e
              echo "Step 1: Suspending all HelmReleases with label cozystack.io/target-cluster-name={{ .Release.Name }}"
              for hr in $(kubectl -n {{ .Release.Namespace }} get helmreleases.helm.toolkit.fluxcd.io -l "cozystack.io/target-cluster-name={{ .Release.Name }}" -o name 2>/dev/null || true); do
                if [ -n "$hr" ]; then           
                  echo "  Suspending $hr"
                  kubectl -n {{ .Release.Namespace }} patch "$hr" \
                    -p '{"spec": {"suspend": true}}' \
                    --type=merge --field-manager=flux-client-side-apply
                fi
              done

              echo "Step 2: Deleting HelmReleases with label cozystack.io/target-cluster-name={{ .Release.Name }}"
              kubectl -n {{ .Release.Namespace }} delete helmreleases.helm.toolkit.fluxcd.io \
                -l "cozystack.io/target-cluster-name={{ .Release.Name }}" \
                --ignore-not-found=true --wait=true

              echo "Step 3: Deleting KamajiControlPlane {{ .Release.Name }}"
              kubectl -n {{ .Release.Namespace }} delete kamajicontrolplanes.controlplane.cluster.x-k8s.io {{ .Release.Name }} \
                --ignore-not-found=true

              echo "Step 4: Deleting TenantControlPlane {{ .Release.Name }}"
              kubectl -n {{ .Release.Namespace }} delete tenantcontrolplanes.kamaji.clastix.io {{ .Release.Name }} \
                --ignore-not-found=true

              echo "Step 5: Cleaning up DataVolumes"
              kubectl -n {{ .Release.Namespace }} delete datavolumes \
                -l "cluster.x-k8s.io/cluster-name={{ .Release.Name }}" \
                --ignore-not-found=true

              echo "Step 6: Cleaning up LoadBalancer Services"
              kubectl -n {{ .Release.Namespace }} delete services \
                -l "cluster.x-k8s.io/cluster-name={{ .Release.Name }}" \
                --field-selector spec.type=LoadBalancer \
                --ignore-not-found=true

              echo "Cleanup completed successfully"

---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: {{ .Release.Name }}-cleanup
  annotations:
    helm.sh/hook: pre-delete
    helm.sh/hook-delete-policy: hook-succeeded,before-hook-creation,hook-failed
    helm.sh/hook-weight: "0"
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  annotations:
    "helm.sh/hook": pre-delete
    "helm.sh/hook-delete-policy": hook-succeeded,before-hook-creation,hook-failed
    "helm.sh/hook-weight": "5"
  name: {{ .Release.Name }}-cleanup
rules:
  - apiGroups:
      - "helm.toolkit.fluxcd.io"
    resources:
      - helmreleases
    verbs:
      - get
      - list
      - watch
      - patch
      - delete
  - apiGroups:
      - "controlplane.cluster.x-k8s.io"
    resources:
      - kamajicontrolplanes
    verbs:
      - get
      - list
      - watch
      - delete
  - apiGroups:
      - "kamaji.clastix.io"
    resources:
      - tenantcontrolplanes
    verbs:
      - get
      - list
      - watch
      - delete
  - apiGroups:
      - "cdi.kubevirt.io"
    resources:
      - datavolumes
    verbs:
      - get
      - list
      - watch
      - delete
  - apiGroups:
      - ""
    resources:
      - services
    verbs:
      - get
      - list
      - watch
      - delete
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  annotations:
    "helm.sh/hook": pre-delete
    "helm.sh/hook-delete-policy": hook-succeeded,before-hook-creation,hook-failed
    "helm.sh/hook-weight": "5"
  name: {{ .Release.Name }}-cleanup
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: {{ .Release.Name }}-cleanup
subjects:
  - kind: ServiceAccount
    name: {{ .Release.Name }}-cleanup
    namespace: {{ .Release.Namespace }}