rke2-calico-crd RKE2 HelmChart remains present

I observed that although our intention is to have full failover from RKE2 HelmChart controller to FluxCD HelmRelease for Calico, the rke2-calico-crd RKE2 HelmChart remains present after installation.

HelmCharts.helm.cattle.io.summary.txt of a CI run:

NAMESPACE     NAME                           JOB                                         CHART                                                                                           TARGETNAMESPACE   VERSION     REPO   HELMVERSION   BOOTSTRAP
kube-system   rke2-calico-crd                helm-install-rke2-calico-crd                oci://172.20.136.39/proxy_cache_registry.gitlab.com/sylva-projects/sylva-core/rke2-calico-crd   kube-system       v3.30.100                        true
kube-system   rke2-runtimeclasses            helm-install-rke2-runtimeclasses                                                                                                                                                               false
kube-system   rke2-snapshot-controller       helm-install-rke2-snapshot-controller                                                                                                                                                          false
kube-system   rke2-snapshot-controller-crd   helm-install-rke2-snapshot-controller-crd                                                                                                                                                      false

This is explained by the fact that only the rke2-calico HelmChart is deleted at https://gitlab.com/sylva-projects/sylva-elements/helm-charts/sylva-capi-cluster/-/blob/333e390a470ea1e465bbb212557941899f58ad78/charts/sylva-capi-cluster-base/templates/bootstrap/cabpr/_machine-files.tpl#L437

Having this rke2-calico HelmChart remain present introduces a risk of cluster breakage (we had seen in the past occurences where misfunctions of the HelmChart controller would lead to Calico charts being uninstalled !). (I'm removing this statement, because after discussing with @cristian.manda it seems that this risk does not exist anymore, since we annotate the HelmChart with helmcharts.helm.cattle.io/unmanaged to ensure that the RKE2 HelmChart controller will not do anything with it)

I think that we need to:

  • also delete the rke2-calico-crd RKE2 HelmChart in this step
  • to correct existing platforms, we need to have a kube-job unit that will delete this HelmChart (similar to the kube-job we had in the release where we introduced this code to have Calico be managed by FluxCD)

(I noticed this problem by pure luck (while reviewing !4228 (merged) and checking that the rke2-metrics-server was removed)

/cc @cristian.manda

Edited Aug 13, 2025 by Thomas Morin
Assignee Loading
Time tracking Loading