Skip to content

feat(chart): Migrate Apps to HelmReleases. - #217

Draft
Gacko wants to merge 1 commit into
mainfrom
migrate-apps-helmreleases
Draft

feat(chart): Migrate Apps to HelmReleases.#217
Gacko wants to merge 1 commit into
mainfrom
migrate-apps-helmreleases

Conversation

@Gacko

@Gacko Gacko commented Aug 5, 2026

Copy link
Copy Markdown
Member

No description provided.

@Gacko
Gacko force-pushed the migrate-apps-helmreleases branch 7 times, most recently from d823772 to 75c7965 Compare August 11, 2026 06:15
@Gacko
Gacko force-pushed the migrate-apps-helmreleases branch from 75c7965 to 8a32a8d Compare August 12, 2026 04:29
@github-actions

github-actions Bot commented Aug 12, 2026

Copy link
Copy Markdown

There were differences in the rendered Helm template, please check! ⚠️

Output 
=== Differences when rendered with values file helm/cluster-eks/ci/test-wc-minimal-values.yaml ===

(file level)
  - seven documents removed:
    ---
    # Source: cluster-eks/charts/cluster/templates/apps/apps.yaml
    apiVersion: application.giantswarm.io/v1alpha1
    kind: App
    metadata:
      name: test-wc-minimal-observability-bundle
      namespace: org-giantswarm
      annotations:
        cluster.giantswarm.io/description: "test description"
        # explicitly instruct app-operator that this App depends on a HelmRelease (otherwise it will just check App resources)
    app-operator.giantswarm.io/depends-on-helmrelease: "true"
      labels:
        # deprecated: "app: cluster-eks" label is deprecated and it will be removed after upgrading
    # to Kubernetes 1.25. We still need it here because existing ClusterResourceSet selectors
    # need this label on the Cluster resource.
    app: cluster-eks
        app.kubernetes.io/name: cluster
        app.kubernetes.io/version: 7.0.0
        app.kubernetes.io/part-of: cluster-eks
        app.kubernetes.io/instance: release-name
        app.kubernetes.io/managed-by: Helm
        helm.sh/chart: cluster-7.0.0
        application.giantswarm.io/team: 
        giantswarm.io/cluster: test-wc-minimal
        giantswarm.io/organization: giantswarm
        giantswarm.io/service-priority: lowest
        cluster.x-k8s.io/cluster-name: test-wc-minimal
        cluster.x-k8s.io/watch-filter: capi
        release.giantswarm.io/version: 32.1.0
        giantswarm.io/managed-by: cluster
        app-operator.giantswarm.io/version: 0.0.0
    spec:
      name: observability-bundle
      version: N/A
      catalog: fake-app-catalog-from-offline-cluster-chart-rendering
      namespace: org-giantswarm
      kubeConfig:
        inCluster: true
      config:
        configMap:
          name: test-wc-minimal-cluster-values
          namespace: org-giantswarm
      userConfig:
        configMap:
          name: test-wc-minimal-observability-bundle-user-values
          namespace: org-giantswarm
    # Source: cluster-eks/charts/cluster/templates/apps/apps.yaml
    apiVersion: application.giantswarm.io/v1alpha1
    kind: App
    metadata:
      annotations:
        cluster.giantswarm.io/description: "test description"
      labels:
        # deprecated: "app: cluster-eks" label is deprecated and it will be removed after upgrading
    # to Kubernetes 1.25. We still need it here because existing ClusterResourceSet selectors
    # need this label on the Cluster resource.
    app: cluster-eks
        app.kubernetes.io/name: cluster
        app.kubernetes.io/version: 7.0.0
        app.kubernetes.io/part-of: cluster-eks
        app.kubernetes.io/instance: release-name
        app.kubernetes.io/managed-by: Helm
        helm.sh/chart: cluster-7.0.0
        application.giantswarm.io/team: 
        giantswarm.io/cluster: test-wc-minimal
        giantswarm.io/organization: giantswarm
        giantswarm.io/service-priority: lowest
        cluster.x-k8s.io/cluster-name: test-wc-minimal
        cluster.x-k8s.io/watch-filter: capi
        release.giantswarm.io/version: 32.1.0
        giantswarm.io/managed-by: cluster
      name: test-wc-minimal-teleport-kube-agent
      namespace: org-giantswarm
    spec:
      catalog: fake-app-catalog-from-offline-cluster-chart-rendering
      name: teleport-kube-agent
      namespace: kube-system
      kubeConfig:
        context:
          name: test-wc-minimal-admin@test-wc-minimal
        inCluster: false
        secret:
          name: test-wc-minimal-kubeconfig
          namespace: org-giantswarm
      version: N/A
      config:
        configMap:
          name: test-wc-minimal-cluster-values
          namespace: org-giantswarm
        secret:
          name: test-wc-minimal-cluster-values
          namespace: org-giantswarm
      extraConfigs:
      - kind: configMap
        name: test-wc-minimal-teleport-kube-agent-config
        namespace: org-giantswarm
    # Source: cluster-eks/charts/cluster/templates/apps/helmrepositories.yaml
    apiVersion: source.toolkit.fluxcd.io/v1
    kind: HelmRepository
    metadata:
      name: test-wc-minimal-default
      namespace: org-giantswarm
      annotations:
        cluster.giantswarm.io/description: "test description"
      labels:
        # deprecated: "app: cluster-eks" label is deprecated and it will be removed after upgrading
    # to Kubernetes 1.25. We still need it here because existing ClusterResourceSet selectors
    # need this label on the Cluster resource.
    app: cluster-eks
        app.kubernetes.io/name: cluster
        app.kubernetes.io/version: 7.0.0
        app.kubernetes.io/part-of: cluster-eks
        app.kubernetes.io/instance: release-name
        app.kubernetes.io/managed-by: Helm
        helm.sh/chart: cluster-7.0.0
        application.giantswarm.io/team: 
        giantswarm.io/cluster: test-wc-minimal
        giantswarm.io/organization: giantswarm
        giantswarm.io/service-priority: lowest
        cluster.x-k8s.io/cluster-name: test-wc-minimal
        cluster.x-k8s.io/watch-filter: capi
        release.giantswarm.io/version: 32.1.0
    spec:
      interval: 5m
      url: "https://giantswarm.github.io/default-catalog"
    # Source: cluster-eks/charts/cluster/templates/apps/helmrepositories.yaml
    apiVersion: source.toolkit.fluxcd.io/v1
    kind: HelmRepository
    metadata:
      name: test-wc-minimal-default-test
      namespace: org-giantswarm
      annotations:
        cluster.giantswarm.io/description: "test description"
      labels:
        # deprecated: "app: cluster-eks" label is deprecated and it will be removed after upgrading
    # to Kubernetes 1.25. We still need it here because existing ClusterResourceSet selectors
    # need this label on the Cluster resource.
    app: cluster-eks
        app.kubernetes.io/name: cluster
        app.kubernetes.io/version: 7.0.0
        app.kubernetes.io/part-of: cluster-eks
        app.kubernetes.io/instance: release-name
        app.kubernetes.io/managed-by: Helm
        helm.sh/chart: cluster-7.0.0
        application.giantswarm.io/team: 
        giantswarm.io/cluster: test-wc-minimal
        giantswarm.io/organization: giantswarm
        giantswarm.io/service-priority: lowest
        cluster.x-k8s.io/cluster-name: test-wc-minimal
        cluster.x-k8s.io/watch-filter: capi
        release.giantswarm.io/version: 32.1.0
    spec:
      interval: 5m
      url: "https://giantswarm.github.io/default-test-catalog"
    # Source: cluster-eks/charts/cluster/templates/apps/helmrepositories.yaml
    apiVersion: source.toolkit.fluxcd.io/v1
    kind: HelmRepository
    metadata:
      name: test-wc-minimal-cluster
      namespace: org-giantswarm
      annotations:
        cluster.giantswarm.io/description: "test description"
      labels:
        # deprecated: "app: cluster-eks" label is deprecated and it will be removed after upgrading
    # to Kubernetes 1.25. We still need it here because existing ClusterResourceSet selectors
    # need this label on the Cluster resource.
    app: cluster-eks
        app.kubernetes.io/name: cluster
        app.kubernetes.io/version: 7.0.0
        app.kubernetes.io/part-of: cluster-eks
        app.kubernetes.io/instance: release-name
        app.kubernetes.io/managed-by: Helm
        helm.sh/chart: cluster-7.0.0
        application.giantswarm.io/team: 
        giantswarm.io/cluster: test-wc-minimal
        giantswarm.io/organization: giantswarm
        giantswarm.io/service-priority: lowest
        cluster.x-k8s.io/cluster-name: test-wc-minimal
        cluster.x-k8s.io/watch-filter: capi
        release.giantswarm.io/version: 32.1.0
    spec:
      interval: 10m
      url: "https://giantswarm.github.io/cluster-catalog"
    # Source: cluster-eks/charts/cluster/templates/apps/helmrepositories.yaml
    apiVersion: source.toolkit.fluxcd.io/v1
    kind: HelmRepository
    metadata:
      name: test-wc-minimal-cluster-test
      namespace: org-giantswarm
      annotations:
        cluster.giantswarm.io/description: "test description"
      labels:
        # deprecated: "app: cluster-eks" label is deprecated and it will be removed after upgrading
    # to Kubernetes 1.25. We still need it here because existing ClusterResourceSet selectors
    # need this label on the Cluster resource.
    app: cluster-eks
        app.kubernetes.io/name: cluster
        app.kubernetes.io/version: 7.0.0
        app.kubernetes.io/part-of: cluster-eks
        app.kubernetes.io/instance: release-name
        app.kubernetes.io/managed-by: Helm
        helm.sh/chart: cluster-7.0.0
        application.giantswarm.io/team: 
        giantswarm.io/cluster: test-wc-minimal
        giantswarm.io/organization: giantswarm
        giantswarm.io/service-priority: lowest
        cluster.x-k8s.io/cluster-name: test-wc-minimal
        cluster.x-k8s.io/watch-filter: capi
        release.giantswarm.io/version: 32.1.0
    spec:
      interval: 10m
      url: "https://giantswarm.github.io/cluster-test-catalog"
    # Source: cluster-eks/charts/cluster/templates/apps/helmrepositories.yaml
    apiVersion: source.toolkit.fluxcd.io/v1
    kind: HelmRepository
    metadata:
      name: test-wc-minimal-giantswarm
      namespace: org-giantswarm
      annotations:
        cluster.giantswarm.io/description: "test description"
      labels:
        # deprecated: "app: cluster-eks" label is deprecated and it will be removed after upgrading
    # to Kubernetes 1.25. We still need it here because existing ClusterResourceSet selectors
    # need this label on the Cluster resource.
    app: cluster-eks
        app.kubernetes.io/name: cluster
        app.kubernetes.io/version: 7.0.0
        app.kubernetes.io/part-of: cluster-eks
        app.kubernetes.io/instance: release-name
        app.kubernetes.io/managed-by: Helm
        helm.sh/chart: cluster-7.0.0
        application.giantswarm.io/team: 
        giantswarm.io/cluster: test-wc-minimal
        giantswarm.io/organization: giantswarm
        giantswarm.io/service-priority: lowest
        cluster.x-k8s.io/cluster-name: test-wc-minimal
        cluster.x-k8s.io/watch-filter: capi
        release.giantswarm.io/version: 32.1.0
    spec:
      interval: 10m
      url: "https://giantswarm.github.io/giantswarm-catalog"
    
  
    ---
    # Source: cluster-eks/charts/cluster/templates/apps/helmreleases.yaml
    apiVersion: v1
    kind: ConfigMap
    metadata:
      name: test-wc-minimal-cilium-user-values
      namespace: org-giantswarm
      labels:
        # deprecated: "app: cluster-eks" label is deprecated and it will be removed after upgrading
    # to Kubernetes 1.25. We still need it here because existing ClusterResourceSet selectors
    # need this label on the Cluster resource.
    app: cluster-eks
        app.kubernetes.io/name: cluster
        app.kubernetes.io/version: 7.0.1-dev.migrate-app--elmreleases.2026-08-12.04-26-42.h82cca4e
        app.kubernetes.io/part-of: cluster-eks
        app.kubernetes.io/instance: release-name
        app.kubernetes.io/managed-by: Helm
        helm.sh/chart: cluster-7.0.1-dev.migrate-app--elmreleases.2026-08-12.04-26-42
        application.giantswarm.io/team: 
        giantswarm.io/cluster: test-wc-minimal
        giantswarm.io/organization: giantswarm
        giantswarm.io/service-priority: lowest
        cluster.x-k8s.io/cluster-name: test-wc-minimal
        cluster.x-k8s.io/watch-filter: capi
        release.giantswarm.io/version: 32.1.0
    data:
      values: |
        certgen:
          tolerations:
          - operator: Exists
        cluster:
          name: test-wc-minimal
        cni:
          configMap: cilium-cni-configuration
          customConf: true
        cniCustomConf:
          eni:
            firstInterfaceIndex: 1
            securityGroupTags:
              aws:eks:cluster-name: test-wc-minimal
              kubernetes.io/cluster/test-wc-minimal: owned
            subnetTags:
              sigs.k8s.io/cluster-api-provider-aws/association: secondary
              sigs.k8s.io/cluster-api-provider-aws/cluster/test-wc-minimal: owned
              sigs.k8s.io/cluster-api-provider-aws/role: private
        defaultPolicies: {}
        egressMasqueradeInterfaces: eth+
        enableIPv4Masquerade: false
        eni:
          enabled: true
        extraPolicies: {}
        global:
          podSecurityStandards:
            enforced: true
        hubble:
          relay:
            tolerations:
            - operator: Exists
          ui:
            tolerations:
            - operator: Exists
        ipam:
          mode: eni
        k8sServiceHost: auto
        k8sServicePort: "443"
        kubeProxyReplacement: "true"
        operator:
          extraArgs:
          - --aws-release-excess-ips=true
        routingMode: native
        
    # Source: cluster-eks/charts/cluster/templates/apps/helmreleases.yaml
    apiVersion: v1
    kind: ConfigMap
    metadata:
      name: test-wc-minimal-coredns-user-values
      namespace: org-giantswarm
      labels:
        # deprecated: "app: cluster-eks" label is deprecated and it will be removed after upgrading
    # to Kubernetes 1.25. We still need it here because existing ClusterResourceSet selectors
    # need this label on the Cluster resource.
    app: cluster-eks
        app.kubernetes.io/name: cluster
        app.kubernetes.io/version: 7.0.1-dev.migrate-app--elmreleases.2026-08-12.04-26-42.h82cca4e
        app.kubernetes.io/part-of: cluster-eks
        app.kubernetes.io/instance: release-name
        app.kubernetes.io/managed-by: Helm
        helm.sh/chart: cluster-7.0.1-dev.migrate-app--elmreleases.2026-08-12.04-26-42
        application.giantswarm.io/team: 
        giantswarm.io/cluster: test-wc-minimal
        giantswarm.io/organization: giantswarm
        giantswarm.io/service-priority: lowest
        cluster.x-k8s.io/cluster-name: test-wc-minimal
        cluster.x-k8s.io/watch-filter: capi
        release.giantswarm.io/version: 32.1.0
    data:
      values: |
        adopter:
          enabled: true
        cluster:
          calico:
            CIDR: 100.64.0.0/16
          kubernetes:
            API:
              clusterIPRange: 172.31.0.0/16
            DNS:
              IP: 172.31.0.10
        controlPlane:
          enabled: true
        coredns:
          cluster:
            podCIDR: 100.64.0.0/16
            serviceCIDR: 172.31.0.0/16
        global:
          podSecurityStandards:
            enforced: true
        mastersInstance:
          enabled: false
        service:
          clusterIP: 172.31.0.10
        
    # Source: cluster-eks/charts/cluster/templates/apps/helmreleases.yaml
    apiVersion: v1
    kind: ConfigMap
    metadata:
      name: test-wc-minimal-network-policies-user-values
      namespace: org-giantswarm
      labels:
        # deprecated: "app: cluster-eks" label is deprecated and it will be removed after upgrading
    # to Kubernetes 1.25. We still need it here because existing ClusterResourceSet selectors
    # need this label on the Cluster resource.
    app: cluster-eks
        app.kubernetes.io/name: cluster
        app.kubernetes.io/version: 7.0.1-dev.migrate-app--elmreleases.2026-08-12.04-26-42.h82cca4e
        app.kubernetes.io/part-of: cluster-eks
        app.kubernetes.io/instance: release-name
        app.kubernetes.io/managed-by: Helm
        helm.sh/chart: cluster-7.0.1-dev.migrate-app--elmreleases.2026-08-12.04-26-42
        application.giantswarm.io/team: 
        giantswarm.io/cluster: test-wc-minimal
        giantswarm.io/organization: giantswarm
        giantswarm.io/service-priority: lowest
        cluster.x-k8s.io/cluster-name: test-wc-minimal
        cluster.x-k8s.io/watch-filter: capi
        release.giantswarm.io/version: 32.1.0
    data:
      values: |
        allowEgressToDNS:
          enabled: true
        
    # Source: cluster-eks/charts/cluster/templates/apps/helmreleases.yaml
    apiVersion: helm.toolkit.fluxcd.io/v2
    kind: HelmRelease
    metadata:
      name: test-wc-minimal-observability-bundle
      namespace: org-giantswarm
      annotations:
        cluster.giantswarm.io/description: "test description"
      labels:
        # deprecated: "app: cluster-eks" label is deprecated and it will be removed after upgrading
    # to Kubernetes 1.25. We still need it here because existing ClusterResourceSet selectors
    # need this label on the Cluster resource.
    app: cluster-eks
        app.kubernetes.io/name: cluster
        app.kubernetes.io/version: 7.0.1-dev.migrate-app--elmreleases.2026-08-12.04-26-42.h82cca4e
        app.kubernetes.io/part-of: cluster-eks
        app.kubernetes.io/instance: release-name
        app.kubernetes.io/managed-by: Helm
        helm.sh/chart: cluster-7.0.1-dev.migrate-app--elmreleases.2026-08-12.04-26-42
        application.giantswarm.io/team: 
        giantswarm.io/cluster: test-wc-minimal
        giantswarm.io/organization: giantswarm
        giantswarm.io/service-priority: lowest
        cluster.x-k8s.io/cluster-name: test-wc-minimal
        cluster.x-k8s.io/watch-filter: capi
        release.giantswarm.io/version: 32.1.0
    spec:
      releaseName: test-wc-minimal-observability-bundle
      targetNamespace: org-giantswarm
      storageNamespace: org-giantswarm
      chartRef:
        kind: OCIRepository
        name: test-wc-minimal-observability-bundle
      serviceAccountName: automation
      interval: 5m
      timeout: 5m
      install:
        remediation:
          retries: -1
      upgrade:
        disableWait: false
        remediation:
          retries: -1
          remediateLastFailure: false
      driftDetection:
        mode: enabled
      valuesFrom:
      - kind: ConfigMap
        name: test-wc-minimal-observability-bundle-user-values
        valuesKey: values
        optional: false
    # Source: cluster-eks/charts/cluster/templates/apps/helmreleases.yaml
    apiVersion: helm.toolkit.fluxcd.io/v2
    kind: HelmRelease
    metadata:
      name: test-wc-minimal-teleport-kube-agent
      namespace: org-giantswarm
      annotations:
        cluster.giantswarm.io/description: "test description"
      labels:
        # deprecated: "app: cluster-eks" label is deprecated and it will be removed after upgrading
    # to Kubernetes 1.25. We still need it here because existing ClusterResourceSet selectors
    # need this label on the Cluster resource.
    app: cluster-eks
        app.kubernetes.io/name: cluster
        app.kubernetes.io/version: 7.0.1-dev.migrate-app--elmreleases.2026-08-12.04-26-42.h82cca4e
        app.kubernetes.io/part-of: cluster-eks
        app.kubernetes.io/instance: release-name
        app.kubernetes.io/managed-by: Helm
        helm.sh/chart: cluster-7.0.1-dev.migrate-app--elmreleases.2026-08-12.04-26-42
        application.giantswarm.io/team: 
        giantswarm.io/cluster: test-wc-minimal
        giantswarm.io/organization: giantswarm
        giantswarm.io/service-priority: lowest
        cluster.x-k8s.io/cluster-name: test-wc-minimal
        cluster.x-k8s.io/watch-filter: capi
        release.giantswarm.io/version: 32.1.0
    spec:
      releaseName: teleport-kube-agent
      targetNamespace: kube-system
      storageNamespace: kube-system
      chartRef:
        kind: OCIRepository
        name: test-wc-minimal-teleport-kube-agent
      kubeConfig:
        secretRef:
          name: test-wc-minimal-kubeconfig
      interval: 5m
      timeout: 5m
      install:
        remediation:
          retries: -1
      upgrade:
        disableWait: false
        remediation:
          retries: -1
          remediateLastFailure: false
      valuesFrom:
      - kind: ConfigMap
        name: test-wc-minimal-teleport-kube-agent-config
        valuesKey: values
        optional: false
    # Source: cluster-eks/charts/cluster/templates/apps/helmreleases.yaml
    apiVersion: source.toolkit.fluxcd.io/v1
    kind: OCIRepository
    metadata:
      name: test-wc-minimal-cilium
      namespace: org-giantswarm
      annotations:
        cluster.giantswarm.io/description: "test description"
      labels:
        # deprecated: "app: cluster-eks" label is deprecated and it will be removed after upgrading
    # to Kubernetes 1.25. We still need it here because existing ClusterResourceSet selectors
    # need this label on the Cluster resource.
    app: cluster-eks
        app.kubernetes.io/name: cluster
        app.kubernetes.io/version: 7.0.1-dev.migrate-app--elmreleases.2026-08-12.04-26-42.h82cca4e
        app.kubernetes.io/part-of: cluster-eks
        app.kubernetes.io/instance: release-name
        app.kubernetes.io/managed-by: Helm
        helm.sh/chart: cluster-7.0.1-dev.migrate-app--elmreleases.2026-08-12.04-26-42
        application.giantswarm.io/team: 
        giantswarm.io/cluster: test-wc-minimal
        giantswarm.io/organization: giantswarm
        giantswarm.io/service-priority: lowest
        cluster.x-k8s.io/cluster-name: test-wc-minimal
        cluster.x-k8s.io/watch-filter: capi
        release.giantswarm.io/version: 32.1.0
    spec:
      url: "oci://gsoci.azurecr.io/charts/giantswarm/cilium"
      ref:
        tag: N/A
      interval: 24h
      timeout: 60s
    # Source: cluster-eks/charts/cluster/templates/apps/helmreleases.yaml
    apiVersion: source.toolkit.fluxcd.io/v1
    kind: OCIRepository
    metadata:
      name: test-wc-minimal-coredns
      namespace: org-giantswarm
      annotations:
        cluster.giantswarm.io/description: "test description"
      labels:
        # deprecated: "app: cluster-eks" label is deprecated and it will be removed after upgrading
    # to Kubernetes 1.25. We still need it here because existing ClusterResourceSet selectors
    # need this label on the Cluster resource.
    app: cluster-eks
        app.kubernetes.io/name: cluster
        app.kubernetes.io/version: 7.0.1-dev.migrate-app--elmreleases.2026-08-12.04-26-42.h82cca4e
        app.kubernetes.io/part-of: cluster-eks
        app.kubernetes.io/instance: release-name
        app.kubernetes.io/managed-by: Helm
        helm.sh/chart: cluster-7.0.1-dev.migrate-app--elmreleases.2026-08-12.04-26-42
        application.giantswarm.io/team: 
        giantswarm.io/cluster: test-wc-minimal
        giantswarm.io/organization: giantswarm
        giantswarm.io/service-priority: lowest
        cluster.x-k8s.io/cluster-name: test-wc-minimal
        cluster.x-k8s.io/watch-filter: capi
        release.giantswarm.io/version: 32.1.0
    spec:
      url: "oci://gsoci.azurecr.io/charts/giantswarm/coredns-app"
      ref:
        tag: N/A
      interval: 24h
      timeout: 60s
    # Source: cluster-eks/charts/cluster/templates/apps/helmreleases.yaml
    apiVersion: source.toolkit.fluxcd.io/v1
    kind: OCIRepository
    metadata:
      name: test-wc-minimal-network-policies
      namespace: org-giantswarm
      annotations:
        cluster.giantswarm.io/description: "test description"
      labels:
        # deprecated: "app: cluster-eks" label is deprecated and it will be removed after upgrading
    # to Kubernetes 1.25. We still need it here because existing ClusterResourceSet selectors
    # need this label on the Cluster resource.
    app: cluster-eks
        app.kubernetes.io/name: cluster
        app.kubernetes.io/version: 7.0.1-dev.migrate-app--elmreleases.2026-08-12.04-26-42.h82cca4e
        app.kubernetes.io/part-of: cluster-eks
        app.kubernetes.io/instance: release-name
        app.kubernetes.io/managed-by: Helm
        helm.sh/chart: cluster-7.0.1-dev.migrate-app--elmreleases.2026-08-12.04-26-42
        application.giantswarm.io/team: 
        giantswarm.io/cluster: test-wc-minimal
        giantswarm.io/organization: giantswarm
        giantswarm.io/service-priority: lowest
        cluster.x-k8s.io/cluster-name: test-wc-minimal
        cluster.x-k8s.io/watch-filter: capi
        release.giantswarm.io/version: 32.1.0
    spec:
      url: "oci://gsoci.azurecr.io/charts/giantswarm/network-policies"
      ref:
        tag: N/A
      interval: 24h
      timeout: 60s
    # Source: cluster-eks/charts/cluster/templates/apps/helmreleases.yaml
    apiVersion: source.toolkit.fluxcd.io/v1
    kind: OCIRepository
    metadata:
      name: test-wc-minimal-observability-bundle
      namespace: org-giantswarm
      annotations:
        cluster.giantswarm.io/description: "test description"
      labels:
        # deprecated: "app: cluster-eks" label is deprecated and it will be removed after upgrading
    # to Kubernetes 1.25. We still need it here because existing ClusterResourceSet selectors
    # need this label on the Cluster resource.
    app: cluster-eks
        app.kubernetes.io/name: cluster
        app.kubernetes.io/version: 7.0.1-dev.migrate-app--elmreleases.2026-08-12.04-26-42.h82cca4e
        app.kubernetes.io/part-of: cluster-eks
        app.kubernetes.io/instance: release-name
        app.kubernetes.io/managed-by: Helm
        helm.sh/chart: cluster-7.0.1-dev.migrate-app--elmreleases.2026-08-12.04-26-42
        application.giantswarm.io/team: 
        giantswarm.io/cluster: test-wc-minimal
        giantswarm.io/organization: giantswarm
        giantswarm.io/service-priority: lowest
        cluster.x-k8s.io/cluster-name: test-wc-minimal
        cluster.x-k8s.io/watch-filter: capi
        release.giantswarm.io/version: 32.1.0
    spec:
      url: "oci://gsoci.azurecr.io/charts/giantswarm/observability-bundle"
      ref:
        tag: N/A
      interval: 24h
      timeout: 60s
    # Source: cluster-eks/charts/cluster/templates/apps/helmreleases.yaml
    apiVersion: source.toolkit.fluxcd.io/v1
    kind: OCIRepository
    metadata:
      name: test-wc-minimal-teleport-kube-agent
      namespace: org-giantswarm
      annotations:
        cluster.giantswarm.io/description: "test description"
      labels:
        # deprecated: "app: cluster-eks" label is deprecated and it will be removed after upgrading
    # to Kubernetes 1.25. We still need it here because existing ClusterResourceSet selectors
    # need this label on the Cluster resource.
    app: cluster-eks
        app.kubernetes.io/name: cluster
        app.kubernetes.io/version: 7.0.1-dev.migrate-app--elmreleases.2026-08-12.04-26-42.h82cca4e
        app.kubernetes.io/part-of: cluster-eks
        app.kubernetes.io/instance: release-name
        app.kubernetes.io/managed-by: Helm
        helm.sh/chart: cluster-7.0.1-dev.migrate-app--elmreleases.2026-08-12.04-26-42
        application.giantswarm.io/team: 
        giantswarm.io/cluster: test-wc-minimal
        giantswarm.io/organization: giantswarm
        giantswarm.io/service-priority: lowest
        cluster.x-k8s.io/cluster-name: test-wc-minimal
        cluster.x-k8s.io/watch-filter: capi
        release.giantswarm.io/version: 32.1.0
    spec:
      url: "oci://gsoci.azurecr.io/charts/giantswarm/teleport-kube-agent"
      ref:
        tag: N/A
      interval: 24h
      timeout: 60s
    # Source: cluster-eks/templates/helmreleases/aws-ebs-csi-driver-helmrelease.yaml
    apiVersion: source.toolkit.fluxcd.io/v1beta2
    kind: OCIRepository
    metadata:
      name: test-wc-minimal-aws-ebs-csi-driver-bundle
      namespace: org-giantswarm
      annotations:
        cluster.giantswarm.io/description: "test description"
      labels:
        cluster-apps-operator.giantswarm.io/watching: 
        app: cluster-eks
        app.kubernetes.io/managed-by: Helm
        cluster.x-k8s.io/cluster-name: test-wc-minimal
        giantswarm.io/cluster: test-wc-minimal
        giantswarm.io/organization: giantswarm
        cluster.x-k8s.io/watch-filter: capi
        helm.sh/chart: cluster-eks-3.0.0
        application.giantswarm.io/team: phoenix
        release.giantswarm.io/version: 32.1.0
    spec:
      url: "oci://gsoci.azurecr.io/charts/giantswarm/aws-ebs-csi-driver-bundle"
      ref:
        tag: N/A
      interval: 24h
      timeout: 60s
    # Source: cluster-eks/charts/cluster/templates/apps/hr-cleanup-delete-hook/serviceaccount.yaml
    apiVersion: v1
    kind: ServiceAccount
    metadata:
      name: test-wc-minimal-cleanup-hrs
      namespace: org-giantswarm
      labels:
        # deprecated: "app: cluster-eks" label is deprecated and it will be removed after upgrading
    # to Kubernetes 1.25. We still need it here because existing ClusterResourceSet selectors
    # need this label on the Cluster resource.
    app: cluster-eks
        app.kubernetes.io/name: cluster
        app.kubernetes.io/version: 7.0.1-dev.migrate-app--elmreleases.2026-08-12.04-26-42.h82cca4e
        app.kubernetes.io/part-of: cluster-eks
        app.kubernetes.io/instance: release-name
        app.kubernetes.io/managed-by: Helm
        helm.sh/chart: cluster-7.0.1-dev.migrate-app--elmreleases.2026-08-12.04-26-42
        application.giantswarm.io/team: 
        giantswarm.io/cluster: test-wc-minimal
        giantswarm.io/organization: giantswarm
        giantswarm.io/service-priority: lowest
        cluster.x-k8s.io/cluster-name: test-wc-minimal
        cluster.x-k8s.io/watch-filter: capi
        release.giantswarm.io/version: 32.1.0
      annotations:
        helm.sh/hook: pre-delete
        helm.sh/hook-weight: "-20"
        helm.sh/hook-delete-policy: "before-hook-creation,hook-succeeded"
    # Source: cluster-eks/charts/cluster/templates/apps/hr-cleanup-delete-hook/role.yaml
    apiVersion: rbac.authorization.k8s.io/v1
    kind: Role
    metadata:
      name: test-wc-minimal-cleanup-hrs
      namespace: org-giantswarm
      labels:
        # deprecated: "app: cluster-eks" label is deprecated and it will be removed after upgrading
    # to Kubernetes 1.25. We still need it here because existing ClusterResourceSet selectors
    # need this label on the Cluster resource.
    app: cluster-eks
        app.kubernetes.io/name: cluster
        app.kubernetes.io/version: 7.0.1-dev.migrate-app--elmreleases.2026-08-12.04-26-42.h82cca4e
        app.kubernetes.io/part-of: cluster-eks
        app.kubernetes.io/instance: release-name
        app.kubernetes.io/managed-by: Helm
        helm.sh/chart: cluster-7.0.1-dev.migrate-app--elmreleases.2026-08-12.04-26-42
        application.giantswarm.io/team: 
        giantswarm.io/cluster: test-wc-minimal
        giantswarm.io/organization: giantswarm
        giantswarm.io/service-priority: lowest
        cluster.x-k8s.io/cluster-name: test-wc-minimal
        cluster.x-k8s.io/watch-filter: capi
        release.giantswarm.io/version: 32.1.0
      annotations:
        helm.sh/hook: pre-delete
        helm.sh/hook-weight: "-20"
        helm.sh/hook-delete-policy: "before-hook-creation,hook-succeeded"
    rules:
    - apiGroups:
      - helm.toolkit.fluxcd.io
      resources:
      - helmreleases
      verbs:
      - list
      - get
      - patch
      - delete
    # Source: cluster-eks/charts/cluster/templates/apps/hr-cleanup-delete-hook/rolebinding.yaml
    apiVersion: rbac.authorization.k8s.io/v1
    kind: RoleBinding
    metadata:
      name: test-wc-minimal-cleanup-hrs
      namespace: org-giantswarm
      labels:
        # deprecated: "app: cluster-eks" label is deprecated and it will be removed after upgrading
    # to Kubernetes 1.25. We still need it here because existing ClusterResourceSet selectors
    # need this label on the Cluster resource.
    app: cluster-eks
        app.kubernetes.io/name: cluster
        app.kubernetes.io/version: 7.0.1-dev.migrate-app--elmreleases.2026-08-12.04-26-42.h82cca4e
        app.kubernetes.io/part-of: cluster-eks
        app.kubernetes.io/instance: release-name
        app.kubernetes.io/managed-by: Helm
        helm.sh/chart: cluster-7.0.1-dev.migrate-app--elmreleases.2026-08-12.04-26-42
        application.giantswarm.io/team: 
        giantswarm.io/cluster: test-wc-minimal
        giantswarm.io/organization: giantswarm
        giantswarm.io/service-priority: lowest
        cluster.x-k8s.io/cluster-name: test-wc-minimal
        cluster.x-k8s.io/watch-filter: capi
        release.giantswarm.io/version: 32.1.0
      annotations:
        helm.sh/hook: pre-delete
        helm.sh/hook-weight: "-20"
        helm.sh/hook-delete-policy: "before-hook-creation,hook-succeeded"
    roleRef:
      apiGroup: rbac.authorization.k8s.io
      kind: Role
      name: test-wc-minimal-cleanup-hrs
    subjects:
    - kind: ServiceAccount
      name: test-wc-minimal-cleanup-hrs
      namespace: org-giantswarm
    # Source: cluster-eks/charts/cluster/templates/apps/app-to-hr-migration-hook/post-upgrade-job.yaml
    apiVersion: batch/v1
    kind: Job
    metadata:
      name: test-wc-minimal-release-mc-charts
      namespace: org-giantswarm
      labels:
        # deprecated: "app: cluster-eks" label is deprecated and it will be removed after upgrading
    # to Kubernetes 1.25. We still need it here because existing ClusterResourceSet selectors
    # need this label on the Cluster resource.
    app: cluster-eks
        app.kubernetes.io/name: cluster
        app.kubernetes.io/version: 7.0.1-dev.migrate-app--elmreleases.2026-08-12.04-26-42.h82cca4e
        app.kubernetes.io/part-of: cluster-eks
        app.kubernetes.io/instance: release-name
        app.kubernetes.io/managed-by: Helm
        helm.sh/chart: cluster-7.0.1-dev.migrate-app--elmreleases.2026-08-12.04-26-42
        application.giantswarm.io/team: 
        giantswarm.io/cluster: test-wc-minimal
        giantswarm.io/organization: giantswarm
        giantswarm.io/service-priority: lowest
        cluster.x-k8s.io/cluster-name: test-wc-minimal
        cluster.x-k8s.io/watch-filter: capi
        release.giantswarm.io/version: 32.1.0
      annotations:
        helm.sh/hook: post-upgrade
        helm.sh/hook-delete-policy: before-hook-creation
    spec:
      template:
        metadata:
          labels:
            # deprecated: "app: cluster-eks" label is deprecated and it will be removed after upgrading
    # to Kubernetes 1.25. We still need it here because existing ClusterResourceSet selectors
    # need this label on the Cluster resource.
    app: cluster-eks
            app.kubernetes.io/name: cluster
            app.kubernetes.io/version: 7.0.1-dev.migrate-app--elmreleases.2026-08-12.04-26-42.h82cca4e
            app.kubernetes.io/part-of: cluster-eks
            app.kubernetes.io/instance: release-name
            app.kubernetes.io/managed-by: Helm
            helm.sh/chart: cluster-7.0.1-dev.migrate-app--elmreleases.2026-08-12.04-26-42
            application.giantswarm.io/team: 
            giantswarm.io/cluster: test-wc-minimal
            giantswarm.io/organization: giantswarm
            giantswarm.io/service-priority: lowest
            cluster.x-k8s.io/cluster-name: test-wc-minimal
            cluster.x-k8s.io/watch-filter: capi
            release.giantswarm.io/version: 32.1.0
        spec:
          serviceAccountName: automation
          initContainers:
          - name: wait
            image: "gsoci.azurecr.io/giantswarm/docker-kubectl:1.36.3"
            securityContext:
              runAsNonRoot: true
              runAsUser: 1000
              runAsGroup: 1000
              allowPrivilegeEscalation: false
              seccompProfile:
                type: RuntimeDefault
              capabilities:
                drop:
                - ALL
              readOnlyRootFilesystem: true
            command:
            - sleep
            args:
            - 1m
            resources:
              requests:
                cpu: 100m
                memory: 100Mi
              limits:
                cpu: 100m
                memory: 100Mi
          containers:
          - name: kubectl
            image: "gsoci.azurecr.io/giantswarm/docker-kubectl:1.36.3"
            securityContext:
              runAsNonRoot: true
              runAsUser: 1000
              runAsGroup: 1000
              allowPrivilegeEscalation: false
              seccompProfile:
                type: RuntimeDefault
              capabilities:
                drop:
                - ALL
              readOnlyRootFilesystem: true
            command:
            - sh
            args:
            - "-c"
            - |
              # Exit on error.
              set -o errexit -o nounset -o pipefail
              
              # Release charts.
              kubectl get charts.application.giantswarm.io \
                --namespace giantswarm \
                --selector giantswarm.io/cluster=test-wc-minimal,helm.sh/chart \
                --output name | xargs --no-run-if-empty \
              kubectl patch \
                --namespace giantswarm \
                --type merge \
                --patch '{ "metadata": { "annotations": { "chart-operator.giantswarm.io/paused": null }, "finalizers": [] } }'
              
            resources:
              requests:
                cpu: 100m
                memory: 100Mi
              limits:
                cpu: 100m
                memory: 100Mi
          restartPolicy: Never
      activeDeadlineSeconds: 90
      ttlSecondsAfterFinished: 3600
    # Source: cluster-eks/charts/cluster/templates/apps/app-to-hr-migration-hook/post-upgrade-job.yaml
    apiVersion: batch/v1
    kind: Job
    metadata:
      name: test-wc-minimal-release-wc-charts
      namespace: org-giantswarm
      labels:
        # deprecated: "app: cluster-eks" label is deprecated and it will be removed after upgrading
    # to Kubernetes 1.25. We still need it here because existing ClusterResourceSet selectors
    # need this label on the Cluster resource.
    app: cluster-eks
        app.kubernetes.io/name: cluster
        app.kubernetes.io/version: 7.0.1-dev.migrate-app--elmreleases.2026-08-12.04-26-42.h82cca4e
        app.kubernetes.io/part-of: cluster-eks
        app.kubernetes.io/instance: release-name
        app.kubernetes.io/managed-by: Helm
        helm.sh/chart: cluster-7.0.1-dev.migrate-app--elmreleases.2026-08-12.04-26-42
        application.giantswarm.io/team: 
        giantswarm.io/cluster: test-wc-minimal
        giantswarm.io/organization: giantswarm
        giantswarm.io/service-priority: lowest
        cluster.x-k8s.io/cluster-name: test-wc-minimal
        cluster.x-k8s.io/watch-filter: capi
        release.giantswarm.io/version: 32.1.0
      annotations:
        helm.sh/hook: post-upgrade
        helm.sh/hook-delete-policy: before-hook-creation
    spec:
      template:
        metadata:
          labels:
            # deprecated: "app: cluster-eks" label is deprecated and it will be removed after upgrading
    # to Kubernetes 1.25. We still need it here because existing ClusterResourceSet selectors
    # need this label on the Cluster resource.
    app: cluster-eks
            app.kubernetes.io/name: cluster
            app.kubernetes.io/version: 7.0.1-dev.migrate-app--elmreleases.2026-08-12.04-26-42.h82cca4e
            app.kubernetes.io/part-of: cluster-eks
            app.kubernetes.io/instance: release-name
            app.kubernetes.io/managed-by: Helm
            helm.sh/chart: cluster-7.0.1-dev.migrate-app--elmreleases.2026-08-12.04-26-42
            application.giantswarm.io/team: 
            giantswarm.io/cluster: test-wc-minimal
            giantswarm.io/organization: giantswarm
            giantswarm.io/service-priority: lowest
            cluster.x-k8s.io/cluster-name: test-wc-minimal
            cluster.x-k8s.io/watch-filter: capi
            release.giantswarm.io/version: 32.1.0
        spec:
          automountServiceAccountToken: false
          volumes:
          - name: kubeconfig
            secret:
              secretName: test-wc-minimal-kubeconfig
              items:
              - key: value
                path: kubeconfig
          containers:
          - name: kubectl
            image: "gsoci.azurecr.io/giantswarm/docker-kubectl:1.36.3"
            securityContext:
              runAsNonRoot: true
              runAsUser: 1000
              runAsGroup: 1000
              allowPrivilegeEscalation: false
              seccompProfile:
                type: RuntimeDefault
              capabilities:
                drop:
                - ALL
              readOnlyRootFilesystem: true
            volumeMounts:
            - name: kubeconfig
              subPath: kubeconfig
              mountPath: /etc/kubeconfig
              readOnly: true
            env:
            - name: KUBECONFIG
              value: /etc/kubeconfig
            command:
            - sh
            args:
            - "-c"
            - |
              # Exit on error.
              set -o errexit -o nounset -o pipefail
              
              # Release charts.
              kubectl get charts.application.giantswarm.io \
                --namespace giantswarm \
                --selector giantswarm.io/cluster=test-wc-minimal,helm.sh/chart \
                --output name | xargs --no-run-if-empty \
              kubectl patch \
                --namespace giantswarm \
                --type merge \
                --patch '{ "metadata": { "annotations": { "chart-operator.giantswarm.io/paused": null }, "finalizers": [] } }'
              
            resources:
              requests:
                cpu: 100m
                memory: 100Mi
              limits:
                cpu: 100m
                memory: 100Mi
          restartPolicy: Never
      activeDeadlineSeconds: 30
      ttlSecondsAfterFinished: 3600
    # Source: cluster-eks/charts/cluster/templates/apps/app-to-hr-migration-hook/pre-upgrade-job.yaml
    apiVersion: batch/v1
    kind: Job
    metadata:
      name: test-wc-minimal-pause-mc-charts
      namespace: org-giantswarm
      labels:
        # deprecated: "app: cluster-eks" label is deprecated and it will be removed after upgrading
    # to Kubernetes 1.25. We still need it here because existing ClusterResourceSet selectors
    # need this label on the Cluster resource.
    app: cluster-eks
        app.kubernetes.io/name: cluster
        app.kubernetes.io/version: 7.0.1-dev.migrate-app--elmreleases.2026-08-12.04-26-42.h82cca4e
        app.kubernetes.io/part-of: cluster-eks
        app.kubernetes.io/instance: release-name
        app.kubernetes.io/managed-by: Helm
        helm.sh/chart: cluster-7.0.1-dev.migrate-app--elmreleases.2026-08-12.04-26-42
        application.giantswarm.io/team: 
        giantswarm.io/cluster: test-wc-minimal
        giantswarm.io/organization: giantswarm
        giantswarm.io/service-priority: lowest
        cluster.x-k8s.io/cluster-name: test-wc-minimal
        cluster.x-k8s.io/watch-filter: capi
        release.giantswarm.io/version: 32.1.0
      annotations:
        helm.sh/hook: pre-upgrade
        helm.sh/hook-delete-policy: before-hook-creation
    spec:
      template:
        metadata:
          labels:
            # deprecated: "app: cluster-eks" label is deprecated and it will be removed after upgrading
    # to Kubernetes 1.25. We still need it here because existing ClusterResourceSet selectors
    # need this label on the Cluster resource.
    app: cluster-eks
            app.kubernetes.io/name: cluster
            app.kubernetes.io/version: 7.0.1-dev.migrate-app--elmreleases.2026-08-12.04-26-42.h82cca4e
            app.kubernetes.io/part-of: cluster-eks
            app.kubernetes.io/instance: release-name
            app.kubernetes.io/managed-by: Helm
            helm.sh/chart: cluster-7.0.1-dev.migrate-app--elmreleases.2026-08-12.04-26-42
            application.giantswarm.io/team: 
            giantswarm.io/cluster: test-wc-minimal
            giantswarm.io/organization: giantswarm
            giantswarm.io/service-priority: lowest
            cluster.x-k8s.io/cluster-name: test-wc-minimal
            cluster.x-k8s.io/watch-filter: capi
            release.giantswarm.io/version: 32.1.0
        spec:
          serviceAccountName: automation
          containers:
          - name: kubectl
            image: "gsoci.azurecr.io/giantswarm/docker-kubectl:1.36.3"
            securityContext:
              runAsNonRoot: true
              runAsUser: 1000
              runAsGroup: 1000
              allowPrivilegeEscalation: false
              seccompProfile:
                type: RuntimeDefault
              capabilities:
                drop:
                - ALL
              readOnlyRootFilesystem: true
            args:
            - annotate
            - charts.application.giantswarm.io
            - "--namespace"
            - giantswarm
            - "--selector"
            - "giantswarm.io/cluster=test-wc-minimal,helm.sh/chart"
            - chart-operator.giantswarm.io/paused=true
            - "--overwrite"
            resources:
              requests:
                cpu: 100m
                memory: 100Mi
              limits:
                cpu: 100m
                memory: 100Mi
          restartPolicy: Never
      activeDeadlineSeconds: 30
      ttlSecondsAfterFinished: 3600
    # Source: cluster-eks/charts/cluster/templates/apps/app-to-hr-migration-hook/pre-upgrade-job.yaml
    apiVersion: batch/v1
    kind: Job
    metadata:
      name: test-wc-minimal-pause-wc-charts
      namespace: org-giantswarm
      labels:
        # deprecated: "app: cluster-eks" label is deprecated and it will be removed after upgrading
    # to Kubernetes 1.25. We still need it here because existing ClusterResourceSet selectors
    # need this label on the Cluster resource.
    app: cluster-eks
        app.kubernetes.io/name: cluster
        app.kubernetes.io/version: 7.0.1-dev.migrate-app--elmreleases.2026-08-12.04-26-42.h82cca4e
        app.kubernetes.io/part-of: cluster-eks
        app.kubernetes.io/instance: release-name
        app.kubernetes.io/managed-by: Helm
        helm.sh/chart: cluster-7.0.1-dev.migrate-app--elmreleases.2026-08-12.04-26-42
        application.giantswarm.io/team: 
        giantswarm.io/cluster: test-wc-minimal
        giantswarm.io/organization: giantswarm
        giantswarm.io/service-priority: lowest
        cluster.x-k8s.io/cluster-name: test-wc-minimal
        cluster.x-k8s.io/watch-filter: capi
        release.giantswarm.io/version: 32.1.0
      annotations:
        helm.sh/hook: pre-upgrade
        helm.sh/hook-delete-policy: before-hook-creation
    spec:
      template:
        metadata:
          labels:
            # deprecated: "app: cluster-eks" label is deprecated and it will be removed after upgrading
    # to Kubernetes 1.25. We still need it here because existing ClusterResourceSet selectors
    # need this label on the Cluster resource.
    app: cluster-eks
            app.kubernetes.io/name: cluster
            app.kubernetes.io/version: 7.0.1-dev.migrate-app--elmreleases.2026-08-12.04-26-42.h82cca4e
            app.kubernetes.io/part-of: cluster-eks
            app.kubernetes.io/instance: release-name
            app.kubernetes.io/managed-by: Helm
            helm.sh/chart: cluster-7.0.1-dev.migrate-app--elmreleases.2026-08-12.04-26-42
            application.giantswarm.io/team: 
            giantswarm.io/cluster: test-wc-minimal
            giantswarm.io/organization: giantswarm
            giantswarm.io/service-priority: lowest
            cluster.x-k8s.io/cluster-name: test-wc-minimal
            cluster.x-k8s.io/watch-filter: capi
            release.giantswarm.io/version: 32.1.0
        spec:
          automountServiceAccountToken: false
          volumes:
          - name: kubeconfig
            secret:
              secretName: test-wc-minimal-kubeconfig
              items:
              - key: value
                path: kubeconfig
          containers:
          - name: kubectl
            image: "gsoci.azurecr.io/giantswarm/docker-kubectl:1.36.3"
            securityContext:
              runAsNonRoot: true
              runAsUser: 1000
              runAsGroup: 1000
              allowPrivilegeEscalation: false
              seccompProfile:
                type: RuntimeDefault
              capabilities:
                drop:
                - ALL
              readOnlyRootFilesystem: true
            volumeMounts:
            - name: kubeconfig
              subPath: kubeconfig
              mountPath: /etc/kubeconfig
              readOnly: true
            env:
            - name: KUBECONFIG
              value: /etc/kubeconfig
            args:
            - annotate
            - charts.application.giantswarm.io
            - "--namespace"
            - giantswarm
            - "--selector"
            - "giantswarm.io/cluster=test-wc-minimal,helm.sh/chart"
            - chart-operator.giantswarm.io/paused=true
            - "--overwrite"
            resources:
              requests:
                cpu: 100m
                memory: 100Mi
              limits:
                cpu: 100m
                memory: 100Mi
          restartPolicy: Never
      activeDeadlineSeconds: 30
      ttlSecondsAfterFinished: 3600
    # Source: cluster-eks/charts/cluster/templates/apps/hr-cleanup-delete-hook/job.yaml
    apiVersion: batch/v1
    kind: Job
    metadata:
      name: test-wc-minimal-cleanup-hrs
      namespace: org-giantswarm
      labels:
        # deprecated: "app: cluster-eks" label is deprecated and it will be removed after upgrading
    # to Kubernetes 1.25. We still need it here because existing ClusterResourceSet selectors
    # need this label on the Cluster resource.
    app: cluster-eks
        app.kubernetes.io/name: cluster
        app.kubernetes.io/version: 7.0.1-dev.migrate-app--elmreleases.2026-08-12.04-26-42.h82cca4e
        app.kubernetes.io/part-of: cluster-eks
        app.kubernetes.io/instance: release-name
        app.kubernetes.io/managed-by: Helm
        helm.sh/chart: cluster-7.0.1-dev.migrate-app--elmreleases.2026-08-12.04-26-42
        application.giantswarm.io/team: 
        giantswarm.io/cluster: test-wc-minimal
        giantswarm.io/organization: giantswarm
        giantswarm.io/service-priority: lowest
        cluster.x-k8s.io/cluster-name: test-wc-minimal
        cluster.x-k8s.io/watch-filter: capi
        release.giantswarm.io/version: 32.1.0
      annotations:
        helm.sh/hook: pre-delete
        helm.sh/hook-weight: "-10"
        helm.sh/hook-delete-policy: "before-hook-creation,hook-succeeded"
    spec:
      template:
        metadata:
          labels:
            # deprecated: "app: cluster-eks" label is deprecated and it will be removed after upgrading
    # to Kubernetes 1.25. We still need it here because existing ClusterResourceSet selectors
    # need this label on the Cluster resource.
    app: cluster-eks
            app.kubernetes.io/name: cluster
            app.kubernetes.io/version: 7.0.1-dev.migrate-app--elmreleases.2026-08-12.04-26-42.h82cca4e
            app.kubernetes.io/part-of: cluster-eks
            app.kubernetes.io/instance: release-name
            app.kubernetes.io/managed-by: Helm
            helm.sh/chart: cluster-7.0.1-dev.migrate-app--elmreleases.2026-08-12.04-26-42
            application.giantswarm.io/team: 
            giantswarm.io/cluster: test-wc-minimal
            giantswarm.io/organization: giantswarm
            giantswarm.io/service-priority: lowest
            cluster.x-k8s.io/cluster-name: test-wc-minimal
            cluster.x-k8s.io/watch-filter: capi
            release.giantswarm.io/version: 32.1.0
        spec:
          serviceAccountName: test-wc-minimal-cleanup-hrs
          volumes:
          - name: tmp
            emptyDir:
              sizeLimit: 100Mi
          containers:
          - name: kubectl
            image: "gsoci.azurecr.io/giantswarm/docker-kubectl:1.36.2"
            securityContext:
              runAsNonRoot: true
              runAsUser: 1000
              runAsGroup: 1000
              allowPrivilegeEscalation: false
              seccompProfile:
                type: RuntimeDefault
              capabilities:
                drop:
                - ALL
              readOnlyRootFilesystem: true
            volumeMounts:
            - name: tmp
              mountPath: /tmp
            env:
            - name: KUBECACHEDIR
              value: /tmp/.kube/cache
            - name: CLUSTER_NAME
              value: test-wc-minimal
            - name: NAMESPACE
              value: org-giantswarm
            - name: BATCH_SIZE
              value: 10
            command:
            - /bin/sh
            args:
            - "-c"
            - |
              set -eu
              
              echo "Cleaning up WC-targeted HelmReleases for cluster ${CLUSTER_NAME}"
              
              # Discover every HR labeled with our cluster, paired with its
              # `spec.kubeConfig.secretRef.name`. The presence of that field is
              # how we tell WC-targeted (helm-controller talks to the WC apiserver
              # via that kubeconfig secret) from MC-targeted (field empty,
              # helm-controller talks to the MC). See the file header for why
              # we only act on the WC set.
              helmrelease_pairs="$(kubectl get helmreleases.helm.toolkit.fluxcd.io --namespace "${NAMESPACE}" --selector giantswarm.io/cluster="${CLUSTER_NAME}" --output jsonpath='{ range .items[*] }{ .metadata.name }|{ .spec.kubeConfig.secretRef.name }{ "\n" }{ end }' 2> /dev/null || :)"
              
              # WC-targeted: secretRef.name non-empty.
              wc_helmreleases="$(echo "${helmrelease_pairs}" | awk -F "|" 'NF==2 && $2 != "" {print $1}')"
              wc_helmreleases_count=$(echo "${wc_helmreleases}" | grep -c . || :)
              echo "  WC-targeted: ${wc_helmreleases_count} (force-cleaned by this hook)"
              
              # MC-targeted: secretRef.name empty.
              mc_helmreleases="$(echo "${helmrelease_pairs}" | awk -F "|" 'NF==2 && $2 == "" {print $1}')"
              mc_helmreleases_count=$(echo "${mc_helmreleases}" | grep -c . || :)
              echo "  MC-targeted: ${mc_helmreleases_count} (left for helm-controller to uninstall normally)"
              
              if [ ${wc_helmreleases_count} -eq 0 ]
              then
                echo "No WC-targeted HelmReleases found; nothing to do."
                exit 0
              fi
              
              # Step 1: Suspend WC-targeted HRs to stop Flux from reconciling them.
              # This prevents Flux from re-adding the finalizer after we remove it
              # in Step 2.
              echo "  Step 1: Suspending WC-targeted HelmReleases"
              count=0
              for wc_helmrelease in ${wc_helmreleases}
              do
                (kubectl patch helmreleases.helm.toolkit.fluxcd.io --namespace "${NAMESPACE}" "${wc_helmrelease}" --type merge --patch '{ "spec": { "suspend": true } }' 2> /dev/null || :) &
                count=$((count + 1))
              
                if [ $((count % BATCH_SIZE)) -eq 0 ]
                then
                  wait
                fi
              done
              
              wait
              
              # Brief pause to let in-flight reconciliations complete before
              # removing finalizers, reducing the chance of Flux re-adding them.
              sleep 5
              
              # Step 2: Remove finalizers from WC-targeted HRs. Two passes to handle
              # the race where an in-flight reconciliation re-adds the finalizer
              # after suspend lands.
              for pass in 1 2
              do
                echo "  Step 2 pass ${pass}: Removing finalizers from WC-targeted HelmReleases"
                count=0
                for wc_helmrelease in ${wc_helmreleases}
                do
                  (kubectl patch helmreleases.helm.toolkit.fluxcd.io --namespace "${NAMESPACE}" "${wc_helmrelease}" --type json --patch '[{ "op": "remove", "path": "/metadata/finalizers" }]' 2> /dev/null || :) &
                  count=$((count + 1))
              
                  if [ $((count % BATCH_SIZE)) -eq 0 ]
                  then
                    wait
                  fi
                done
              
                wait
              
                [ "${pass}" -ne 2 ] && sleep 3
              done
              
              # Step 3: Delete WC-targeted HRs. With suspend + no finalizer, this
              # is instant. We deliberately do NOT delete MC-targeted HRs here —
              # they are deleted by the subsequent `helm uninstall <cluster>`,
              # with helm-controller running `helm uninstall` against each
              # MC-side release in the normal way (header explains why).
              echo "  Step 3: Deleting WC-targeted HelmReleases"
              count=0
              for wc_helmrelease in ${wc_helmreleases}
              do
                (kubectl delete helmreleases.helm.toolkit.fluxcd.io --namespace "${NAMESPACE}" "${wc_helmrelease}" --wait=false 2> /dev/null || :) &
                count=$((count + 1))
              
                if [ $((count % BATCH_SIZE)) -eq 0 ]
                then
                  wait
                fi
              done
              
              wait
              
              echo "Processed ${count} WC-targeted HelmReleases for cluster ${CLUSTER_NAME}"
              echo "Leaving ${mc_helmreleases_count} MC-targeted HelmReleases for helm-controller-driven uninstall."
              
            resources:
              requests:
                cpu: 10m
                memory: 128Mi
              limits:
                cpu: 1
                memory: 512Mi
          restartPolicy: Never
      activeDeadlineSeconds: 600
      backoffLimit: 3
      ttlSecondsAfterFinished: 3600
    
  

/metadata/labels/app.kubernetes.io/version  (v1/ConfigMap/org-giantswarm/test-wc-minimal-observability-bundle-user-values)
  ± value change
    - 7.0.0
    + 7.0.1-dev.migrate-app--elmreleases.2026-08-12.04-26-42.h82cca4e

/metadata/labels/helm.sh/chart  (v1/ConfigMap/org-giantswarm/test-wc-minimal-observability-bundle-user-values)
  ± value change
    - cluster-7.0.0
    + cluster-7.0.1-dev.migrate-app--elmreleases.2026-08-12.04-26-42

/data/values  (v1/ConfigMap/org-giantswarm/test-wc-minimal-observability-bundle-user-values)
  ± value change in multiline text (one insert, no deletions)
    + clusterID: test-wc-minimal


/metadata/labels/app.kubernetes.io/version  (cluster.x-k8s.io/v1beta2/Cluster/org-giantswarm/test-wc-minimal)
  ± value change
    - 7.0.0
    + 7.0.1-dev.migrate-app--elmreleases.2026-08-12.04-26-42.h82cca4e

/metadata/labels/helm.sh/chart  (cluster.x-k8s.io/v1beta2/Cluster/org-giantswarm/test-wc-minimal)
  ± value change
    - cluster-7.0.0
    + cluster-7.0.1-dev.migrate-app--elmreleases.2026-08-12.04-26-42

/metadata/labels/app.kubernetes.io/version  (helm.toolkit.fluxcd.io/v2/HelmRelease/org-giantswarm/test-wc-minimal-cilium)
  ± value change
    - 7.0.0
    + 7.0.1-dev.migrate-app--elmreleases.2026-08-12.04-26-42.h82cca4e

/metadata/labels/helm.sh/chart  (helm.toolkit.fluxcd.io/v2/HelmRelease/org-giantswarm/test-wc-minimal-cilium)
  ± value change
    - cluster-7.0.0
    + cluster-7.0.1-dev.migrate-app--elmreleases.2026-08-12.04-26-42

/spec  (helm.toolkit.fluxcd.io/v2/HelmRelease/org-giantswarm/test-wc-minimal-cilium)
  - two map entries removed:
    chart:
      spec:
        version: N/A
        chart: cilium
        sourceRef:
          name: test-wc-minimal-fake-app-catalog-from-offline-cluster-chart-rendering
          kind: HelmRepository
    values:
      cluster:
        name: test-wc-minimal
      cni:
        configMap: cilium-cni-configuration
        customConf: true
      cniCustomConf:
        eni:
          firstInterfaceIndex: 1
          securityGroupTags:
            aws:eks:cluster-name: test-wc-minimal
            kubernetes.io/cluster/test-wc-minimal: owned
          subnetTags:
            sigs.k8s.io/cluster-api-provider-aws/association: secondary
            sigs.k8s.io/cluster-api-provider-aws/cluster/test-wc-minimal: owned
            sigs.k8s.io/cluster-api-provider-aws/role: private
      defaultPolicies: {}
      egressMasqueradeInterfaces: eth+
      enableIPv4Masquerade: false
      eni:
        enabled: true
      extraPolicies: {}
      global:
        podSecurityStandards:
          enforced: true
      hubble:
        relay:
          enabled: true
          tolerations: []
        ui: {}
      ipam:
        mode: eni
      k8sServiceHost: auto
      k8sServicePort: 443
      kubeProxyReplacement: "true"
      operator:
        extraArgs:
        - "--aws-release-excess-ips=true"
      routingMode: native
    
  
  + two map entries added:
    chartRef:
      name: test-wc-minimal-cilium
      kind: OCIRepository
    valuesFrom:
    - name: test-wc-minimal-cilium-user-values
      kind: ConfigMap
      valuesKey: values
      optional: false
  

/spec/upgrade/remediation  (helm.toolkit.fluxcd.io/v2/HelmRelease/org-giantswarm/test-wc-minimal-cilium)
  + one map entry added:
    remediateLastFailure: false

/spec/upgrade/remediation/retries  (helm.toolkit.fluxcd.io/v2/HelmRelease/org-giantswarm/test-wc-minimal-cilium)
  ± value change
    - 0
    + -1

/metadata/labels/app.kubernetes.io/version  (helm.toolkit.fluxcd.io/v2/HelmRelease/org-giantswarm/test-wc-minimal-coredns)
  ± value change
    - 7.0.0
    + 7.0.1-dev.migrate-app--elmreleases.2026-08-12.04-26-42.h82cca4e

/metadata/labels/helm.sh/chart  (helm.toolkit.fluxcd.io/v2/HelmRelease/org-giantswarm/test-wc-minimal-coredns)
  ± value change
    - cluster-7.0.0
    + cluster-7.0.1-dev.migrate-app--elmreleases.2026-08-12.04-26-42

/spec  (helm.toolkit.fluxcd.io/v2/HelmRelease/org-giantswarm/test-wc-minimal-coredns)
  - two map entries removed:
    chart:
      spec:
        version: N/A
        chart: coredns-app
        sourceRef:
          name: test-wc-minimal-fake-app-catalog-from-offline-cluster-chart-rendering
          kind: HelmRepository
    values:
      adopter:
        enabled: true
      cluster:
        calico:
          CIDR: 100.64.0.0/16
        kubernetes:
          API:
            clusterIPRange: 172.31.0.0/16
          DNS:
            IP: 172.31.0.10
      controlPlane:
        enabled: true
      coredns:
        cluster:
          podCIDR: 100.64.0.0/16
          serviceCIDR: 172.31.0.0/16
      global:
        podSecurityStandards:
          enforced: true
      mastersInstance:
        enabled: false
      service:
        clusterIP: 172.31.0.10
    
  
  + two map entries added:
    chartRef:
      name: test-wc-minimal-coredns
      kind: OCIRepository
    valuesFrom:
    - name: test-wc-minimal-coredns-user-values
      kind: ConfigMap
      valuesKey: values
      optional: false
  

/spec/upgrade/remediation  (helm.toolkit.fluxcd.io/v2/HelmRelease/org-giantswarm/test-wc-minimal-coredns)
  + one map entry added:
    remediateLastFailure: false

/metadata/labels/app.kubernetes.io/version  (helm.toolkit.fluxcd.io/v2/HelmRelease/org-giantswarm/test-wc-minimal-network-policies)
  ± value change
    - 7.0.0
    + 7.0.1-dev.migrate-app--elmreleases.2026-08-12.04-26-42.h82cca4e

/metadata/labels/helm.sh/chart  (helm.toolkit.fluxcd.io/v2/HelmRelease/org-giantswarm/test-wc-minimal-network-policies)
  ± value change
    - cluster-7.0.0
    + cluster-7.0.1-dev.migrate-app--elmreleases.2026-08-12.04-26-42

/spec  (helm.toolkit.fluxcd.io/v2/HelmRelease/org-giantswarm/test-wc-minimal-network-policies)
  - two map entries removed:
    chart:
      spec:
        version: N/A
        chart: network-policies
        sourceRef:
          name: test-wc-minimal-fake-app-catalog-from-offline-cluster-chart-rendering
          kind: HelmRepository
    values:
      allowEgressToDNS:
        enabled: true
    
  
  + two map entries added:
    chartRef:
      name: test-wc-minimal-network-policies
      kind: OCIRepository
    valuesFrom:
    - name: test-wc-minimal-network-policies-user-values
      kind: ConfigMap
      valuesKey: values
      optional: false
  

/spec/upgrade/remediation  (helm.toolkit.fluxcd.io/v2/HelmRelease/org-giantswarm/test-wc-minimal-network-policies)
  + one map entry added:
    remediateLastFailure: false

/spec  (helm.toolkit.fluxcd.io/v2/HelmRelease/org-giantswarm/test-wc-minimal-aws-ebs-csi-driver-bundle)
  - one map entry removed:
    chart:
      spec:
        version: N/A
        chart: aws-ebs-csi-driver-bundle
        sourceRef:
          name: test-wc-minimal-fake-app-catalog-from-offline-cluster-chart-rendering
          kind: HelmRepository
    
  
  + one map entry added:
    chartRef:
      name: test-wc-minimal-aws-ebs-csi-driver-bundle
      kind: OCIRepository
  

/metadata/labels/app.kubernetes.io/version  (cluster.x-k8s.io/v1beta2/MachinePool/org-giantswarm/test-wc-minimal-def00)
  ± value change
    - 7.0.0
    + 7.0.1-dev.migrate-app--elmreleases.2026-08-12.04-26-42.h82cca4e

/metadata/labels/helm.sh/chart  (cluster.x-k8s.io/v1beta2/MachinePool/org-giantswarm/test-wc-minimal-def00)
  ± value change
    - cluster-7.0.0
    + cluster-7.0.1-dev.migrate-app--elmreleases.2026-08-12.04-26-42

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@Gacko