ESO Upgrade 0.16.2 to 0.18 is breaking workload-team-defs deployment (at least)

Summary

The ESO upgrade in !4419 (merged) is from 0.16.2 which supports v1 and v1beta1 to 0.18.0 through 0.17 which no more supports v1beta1. In addition, ESO CRD Upgrade has automatically upgraded deployed ESS.

Helm upgrade mechanism are comparing internal information (in sh.helmrelease... secrets) to the current deployment. If a Helm chart has deployed ESS in v1beta1 then the ESO has been upgraded, it is no more possible to upgrade Helm chart since Helm will check for exisiting v1bet1 secrets which are impossible to list, since the CRD does not support this version anymore

This is the case for the workload-team-defs:

  • In Sylva 1.4.0 its version was 0.1.2 which was using v1beta1
  • In Sylva 1.4.1 its version was 0.1.2 which was using v1beta1
  • In Sylva main its version is 0.3.0 which was using v1

Therefore, if the 1.5 Sylva version includes the ESO upgrade, someone which has deployed 1.4, which has deploy a team with workload-team-defs and tries to deploy 1.5 will not be able to deploy workload-team-defs HelmRelease because

Steps to reproduce

  • Deploy Sylva 1.4.0 with the following values (to define a team)

    workload_clusters:
  sylva_source:
    type: git
    url: https://gitlab.com/sylva-projects/sylva-core.git
    tag: 1.4.0
  teams:
    teama:
      gitrepository_spec:
        url: "https://github.com/vladimirBraquet/test"
        ref:
          branch: main
      gitrepository_path: "teama"
      git_secret_path: "gitsecret"

  • Upgrade to Sylva main

  • The workload-team-defs HelmRelease fails (In this example, I try to bump Helm chart version to 0.3.2)

     message: |-
      Helm upgrade failed for release sylva-system/workload-team-defs with chart workload-team-defs@0.3.2+e06df5fc0ceb: unable to build kubernetes objects from current release manifest: [resource mapping not found for name: "eso-sylva-ca" namespace: "teama" from "": no matches for kind "ExternalSecret" in version "external-secrets.io/v1beta1"
      ensure CRDs are installed first, resource mapping not found for name: "gitsecret" namespace: "teama" from "": no matches for kind "ExternalSecret" in version "external-secrets.io/v1beta1"
      ensure CRDs are installed first, resource mapping not found for name: "teama" namespace: "teama" from "": no matches for kind "SecretStore" in version "external-secrets.io/v1beta1"
      ensure CRDs are installed first]

What is the current bug behavior?

ESO Upgrade prevents workload-team-defs HelmRelease upgrade if any team has been created

What is the expected correct behavior?

No impact

Relevant logs and/or screenshots

Possible fixes

Revert !4419 (merged), upgrade workload-team-defs and tag 1.5, Then upgrade ESO in a later version

Or backport workload-team-defs 0.3.X to Sylva core 1.4.x

Edited by vladimir braquet