如何在Helm Chart的ownerReference中动态解析Deployment的UID

1. Helm渲染时机限制：Helm在部署前会先渲染所有模板生成YAML文件，此时Deployment还未部署到Kubernetes集群，对应的UID尚未生成，无法提前获取。
2. Shell命令不被解析：你直接写入的$(kubectl get deployment my-release-parent -o jsonpath='{.metadata.uid}')会被Helm当成纯字符串存入YAML，Kubernetes无法识别这种格式的UID值，导致Job创建失败。

利用Helm的钩子机制，在Deployment成功部署到集群后，再动态创建带有正确OwnerReference的Job。

修改后的Job模板（作为Hook使用） #

apiVersion: batch/v1
kind: Job
metadata:
  name: {{ .Release.Name }}-job-creator
  annotations:
    # 指定为安装/升级完成后执行的钩子
    "helm.sh/hook": post-install,post-upgrade
    # 钩子执行完成后自动清理自身
    "helm.sh/hook-delete-policy": hook-succeeded,hook-failed
spec:
  template:
    spec:
      restartPolicy: OnFailure
      containers:
      - name: job-creator
        # 使用内置kubectl的镜像执行集群操作
        image: bitnami/kubectl:latest
        command:
        - /bin/sh
        - -c
        - |
          # 获取已部署Deployment的UID
          DEPLOYMENT_UID=$(kubectl get deployment {{ .Release.Name }}-parent -o jsonpath='{.metadata.uid}')
          # 动态生成目标Job的YAML并提交到集群
          cat <<EOF | kubectl apply -f -
          apiVersion: batch/v1
          kind: Job
          metadata:
            name: {{ .Release.Name }}-job
            ownerReferences:
              - apiVersion: apps/v1
                blockOwnerDeletion: true
                controller: true
                kind: Deployment
                name: {{ .Release.Name }}-parent
                uid: $DEPLOYMENT_UID
          spec:
            template:
              metadata:
                labels:
                  app: {{ .Release.Name }}-job
              spec:
                containers:
                  - name: busybox
                    image: busybox:latest
                    # 这里添加你的容器业务命令，例如：command: ["echo", "Job executed"]
                restartPolicy: Never
          EOF

关键补充配置（RBAC环境） #

如果你的集群启用了RBAC，需要给钩子Job对应的ServiceAccount添加权限，允许它查询Deployment和创建Job。在Chart中新增templates/rbac.yaml文件：

apiVersion: v1
kind: ServiceAccount
metadata:
  name: {{ .Release.Name }}-hook-sa
  annotations:
    "helm.sh/hook": post-install,post-upgrade
    "helm.sh/hook-delete-policy": hook-succeeded,hook-failed
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: {{ .Release.Name }}-hook-role
  annotations:
    "helm.sh/hook": post-install,post-upgrade
    "helm.sh/hook-delete-policy": hook-succeeded,hook-failed
rules:
- apiGroups: ["apps"]
  resources: ["deployments"]
  verbs: ["get"]
- apiGroups: ["batch"]
  resources: ["jobs"]
  verbs: ["create"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: {{ .Release.Name }}-hook-rb
  annotations:
    "helm.sh/hook": post-install,post-upgrade
    "helm.sh/hook-delete-policy": hook-succeeded,hook-failed
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: {{ .Release.Name }}-hook-role
subjects:
- kind: ServiceAccount
  name: {{ .Release.Name }}-hook-sa

然后在钩子Job的spec.template.spec中添加serviceAccountName: {{ .Release.Name }}-hook-sa。

效果验证 #

部署Helm Chart后，钩子Job会自动执行，创建带有正确OwnerReference的目标Job。此时删除Deployment时，对应的Job会被Kubernetes自动清理。

内容的提问来源于stack exchange，提问作者tobo