fix a couple more omissions on `Job` resources

charts/nginx-ingress/templates/admission-webhooks/job-patch/job-createSecret.yaml

@@ -50,6 +50,8 @@ spec:
       serviceAccountName: {{ include "ingress-nginx.fullname" . }}-admission
     {{- if .Values.controller.admissionWebhooks.patch.nodeSelector }}
       nodeSelector: {{ toYaml .Values.controller.admissionWebhooks.patch.nodeSelector | nindent 8 }}
+    {{- else }}
+    {{- include "gitlab.nodeSelector" . | nindent 6 }}
     {{- end }}
     {{- if .Values.controller.admissionWebhooks.patch.tolerations }}
       tolerations: {{ toYaml .Values.controller.admissionWebhooks.patch.tolerations | nindent 8 }}

charts/nginx-ingress/templates/admission-webhooks/job-patch/job-patchWebhook.yaml

@@ -52,6 +52,8 @@ spec:
       serviceAccountName: {{ include "ingress-nginx.fullname" . }}-admission
     {{- if .Values.controller.admissionWebhooks.patch.nodeSelector }}
       nodeSelector: {{ toYaml .Values.controller.admissionWebhooks.patch.nodeSelector | nindent 8 }}
+    {{- else }}
+    {{- include "gitlab.nodeSelector" . | nindent 6 }}
     {{- end }}
     {{- if .Values.controller.admissionWebhooks.patch.tolerations }}
       tolerations: {{ toYaml .Values.controller.admissionWebhooks.patch.tolerations | nindent 8 }}

charts/shared-secrets/templates/_self-signed-cert-job.yml

@@ -18,6 +18,7 @@ spec:
         app: {{ template "name" . }}
         release: {{ .Release.Name }}
     spec:
+      {{- include "gitlab.nodeSelector" . | nindent 6 }}
       {{- if .Values.tolerations }}
       tolerations:
         {{- toYaml .Values.tolerations | nindent 8 }}

spec/configuration/node_selector_spec.rb

@@ -7,14 +7,35 @@ require 'yaml'
 describe 'Node Selector configuration' do
   let(:default_values) do
     {
-      'certmanager-issuer' => { 'email' => 'test@example.com' },
       'global' => {
+        # the values we test for presence of across components
+        'nodeSelector' => { 'region' => 'us-central-1a' },
+
+        # PLEASE UPDATE AS NEW COMPONENTS ARE ADDED (unless they are enabled by default)
         'gitlab' => {
           'kas' => { 'enabled' => 'true' }, # DELETE THIS WHEN KAS BECOMES ENABLED BY DEFAULT
           'pages' => { 'enabled' => 'true' },
           'praefect' => { 'enabled' => 'true' }
         },
-        'nodeSelector' => { 'region' => 'us-central-1a' }
+
+        # ensures inclusion of:
+        # - shared-secrets/templates/_self-signed-cert-job.yml
+        'ingress' => {
+          'configureCertmanager' => 'false',
+          'tls' => { 'enabled' => 'false' }
+        }
+      },
+
+      'certmanager-issuer' => { 'email' => 'test@example.com' },
+
+      # ensures inclusion of:
+      # - nginx-ingress/templates/admission-webhooks/job-patch/job-createSecret.yaml
+      # - nginx-ingress/templates/admission-webhooks/job-patch/job-patchWebhook.yaml
+      'nginx-ingress' => {
+        'admissionWebhooks' => {
+          'enabled' => 'true',
+          'patch' => { 'enabled' => 'true' }
+        }
       }
     }
   end
@@ -38,7 +59,8 @@ describe 'Node Selector configuration' do
       resources = [
         *t.resources_by_kind('Deployment'),
         *t.resources_by_kind('DaemonSet'),
-        *t.resources_by_kind('StatefulSet')
+        *t.resources_by_kind('StatefulSet'),
+        *t.resources_by_kind('Job')
       ]
       .to_h.reject { |key, _| ignored_charts.include? key }
 

templates/upgrade_check_hook.yaml

@@ -33,6 +33,11 @@ spec:
         app: {{ template "name" . }}
         release: {{ .Release.Name }}
     spec:
+      {{- if .Values.upgradeCheck.nodeSelector }}
+        nodeSelector: {{ toYaml .Values.upgradeCheck.nodeSelector | nindent 8 }}
+      {{- else }}
+      {{- include "gitlab.nodeSelector" . | nindent 6 }}
+      {{- end }}
       {{- if .Values.upgradeCheck.tolerations }}
       tolerations:
         {{- toYaml .Values.upgradeCheck.tolerations | nindent 8 }}