60 lines
2.6 KiB
YAML
60 lines
2.6 KiB
YAML
---
|
|
# Tears one app off the cluster: delete the manifests it was deployed from
|
|
# and let k3s's deploy controller garbage-collect what they created.
|
|
#
|
|
# This is the one place k3s is *less* work than Compose. `compose_stack`
|
|
# has to run `docker compose down` and therefore needs the compose file to
|
|
# still be on disk to know what it's tearing down (which is why removing an
|
|
# app there is a two-pass job — see CLAUDE.md → "Removing an app"). Here the
|
|
# deploy controller already tracks which resources each manifest file
|
|
# created, via the Addon CR it writes alongside them, so deleting the file
|
|
# is the teardown. src/<app>/ can be deleted in the same commit.
|
|
#
|
|
# Deliberately *not* removed, same reasoning as compose_stack's opt-in
|
|
# flags — a default teardown should be reversible:
|
|
#
|
|
# - the app's database and role on the shared Postgres
|
|
# - its PersistentVolumeClaims (the app's manifests own those; if the
|
|
# chart's PVCs carry a Helm ownership annotation they go with the
|
|
# HelmChart CR, so check `kubectl -n <ns> get pvc` after)
|
|
# - its Vault path
|
|
# - the namespace, which the secrets manifest below creates but the
|
|
# controller will only remove if nothing else landed in it
|
|
#
|
|
# There's no `remove_database`/`remove_volumes` equivalent yet. Add one the
|
|
# day it's actually wanted rather than guessing at the shape now.
|
|
|
|
- name: Find the app's Kubernetes manifest templates
|
|
ansible.builtin.set_fact:
|
|
app_manifest_templates: >-
|
|
{{ query('fileglob',
|
|
app_local_dir ~ '/ansible/' ~ k3s_app_platform_dir ~ '/*.yaml.j2')
|
|
| sort }}
|
|
|
|
# The secrets manifest first, then the app's own. Order is cosmetic — the
|
|
# controller reconciles each file's removal independently — but removing the
|
|
# workload's namespace/Secret last would leave pods briefly running without
|
|
# the credentials they were started with, and losing them noisily in a log
|
|
# is worse than losing them quietly.
|
|
- name: Remove the app's Kubernetes manifests
|
|
ansible.builtin.file:
|
|
path: >-
|
|
{{ k3s_manifests_dir }}/{{ app.name }}-{{
|
|
item | basename | regex_replace('\.j2$', '') }}
|
|
state: absent
|
|
loop: "{{ app_manifest_templates }}"
|
|
become: true
|
|
|
|
- name: Remove the app namespace and secrets manifest
|
|
ansible.builtin.file:
|
|
path: "{{ k3s_manifests_dir }}/{{ app.name }}-secrets.yaml"
|
|
state: absent
|
|
become: true
|
|
|
|
- name: Report what removal left behind
|
|
ansible.builtin.debug:
|
|
msg: >-
|
|
App '{{ app.name }}' manifests removed; k3s will garbage-collect the
|
|
resources they created. Its database, PVCs and Vault path were left
|
|
alone on purpose — remove those by hand if the teardown is meant to be
|
|
permanent.
|