helm: ServiceAccount is not created before Jobs/Pods

According to the InstallOrder, ServiceAccount should be installed before both Pod and Job. However, I’ve observed occasions where the ServiceAccount is not created before Jobs (or even standalone Pods).

Steps to reproduce

Run helm create ... to create a fresh new Helm chart.
Copy the following resource definitions under templates/.

apiVersion: v1
kind: ServiceAccount
metadata:
  name: my-sa
  annotations:
    helm.sh/hook: pre-install
    helm.sh/hook-weight: "-3"
    helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded,hook-failed
---
kind: Job
apiVersion: batch/v1
metadata:
  name: my-job
  annotations:
    helm.sh/hook: pre-install
    helm.sh/hook-weight: "-3"
    helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded,hook-failed
spec:
  template:
    spec:
      serviceAccountName: my-sa
      containers:
      - name: my-pod
        image: mcr.microsoft.com/cbl-mariner/base/python:3.9
        command: ["/bin/bash", "-c", "sleep 600"]
      restartPolicy: Never

Note that both the ServiceAccount and Job have the same hook weight of -3.

kubectl get serviceaccounts and kubectl get jobs -n $namespace -w to watch the resource creation.
Install the chart: helm install -n $namespace ....

The output of the watched resources shows that the Job is created but no ServiceAccount is created.

The Job also fails to create Pods.

If I weight the ServiceAccount lower so it gets prioritized, it will get created before the Job, so the hook itself seems to work as expected.

Output of helm version: version.BuildInfo{Version:"v3.12.0", GitCommit:"c9f554d75773799f72ceef38c51210f1842a1dea", GitTreeState:"clean", GoVersion:"go1.20.3"}

Output of kubectl version:

Client Version: version.Info{Major:"1", Minor:"27", GitVersion:"v1.27.2", GitCommit:"7f6f68fdabc4df88cfea2dcf9a19b2b830f1e647", GitTreeState:"clean", BuildDate:"2023-05-17T14:20:07Z", GoVersion:"go1.20.4", Compiler:"gc", Platform:"linux/amd64"}
Kustomize Version: v5.0.1
Server Version: version.Info{Major:"1", Minor:"26", GitVersion:"v1.26.3", GitCommit:"f18584a06fc476806da2e340e2eed960659871e8", GitTreeState:"clean", BuildDate:"2023-06-12T18:45:20Z", GoVersion:"go1.19.7", Compiler:"gc", Platform:"linux/amd64"}

Cloud Provider/Platform (AKS, GKE, Minikube etc.): AKS

About this issue

Original URL
State: open
Created 9 months ago
Comments: 15 (6 by maintainers)

Most upvoted comments

Here’s a PR updating the documentation: https://github.com/helm/helm-www/pull/1520

lynshi on Nov 14, 2023

Hello,

Is there any update on this?

We are on gitlab using auto-deploy helm chart and its using helm v3.13.1. (https://gitlab.com/gitlab-org/cluster-integration/auto-deploy-image) When we try to upgrade the release of our pre-deployed application in eks, it deletes the service account and then tries to spin up a new pod, which fails because the service account doesn’t exist and rolls back completely.

Below are the logs we are seeing: history.go:56: [debug] getting history for release review-feature-us-4xvr5j upgrade.go:153: [debug] preparing upgrade for review-feature-us-4xvr5j upgrade.go:161: [debug] performing update for review-feature-us-4xvr5j upgrade.go:354: [debug] creating upgraded release for review-feature-us-4xvr5j client.go:393: [debug] checking 4 resources for changes client.go:693: [debug] Patch Service "review-feature-us-4xvr5j-auto-deploy" in namespace review client.go:693: [debug] Patch Deployment "review-feature-us-4xvr5j" in namespace review client.go:693: [debug] Patch HorizontalPodAutoscaler "review-feature-us-4xvr5j-auto-deploy" in namespace review client.go:693: [debug] Patch Ingress "review-feature-us-4xvr5j-auto-deploy" in namespace review client.go:442: [debug] Deleting ServiceAccount "cdh-browse-middle" in namespace review... upgrade.go:426: [debug] waiting for release review-feature-us-4xvr5j resources (created: 0 updated: 4 deleted: 1) wait.go:48: [debug] beginning wait for 4 resources with timeout of 5m0s ready.go:281: [debug] Deployment is not ready: review/review-feature-us-4xvr5j. 0 out of 1 expected pods are ready ready.go:281: [debug] Deployment is not ready: review/review-feature-us-4xvr5j. 0 out of 1 expected pods are ready ready.go:281: [debug] Deployment is not ready: review/review-feature-us-4xvr5j. 0 out of 1 expected pods are ready ready.go:281: [debug] Deployment is not ready: review/review-feature-us-4xvr5j. 0 out of 1 expected pods are ready ready.go:281: [debug] Deployment is not ready: review/review-feature-us-4xvr5j. 0 out of 1 expected pods are ready ready.go:281: [debug] Deployment is not ready: review/review-feature-us-4xvr5j. 0 out of 2 expected pods are ready ready.go:281: [debug] Deployment is not ready: review/review-feature-us-4xvr5j. 0 out of 2 expected pods are ready ready.go:281: [debug] Deployment is not ready: review/review-feature-us-4xvr5j. 0 out of 2 expected pods are ready ready.go:281: [debug] Deployment is not ready: review/review-feature-us-4xvr5j. 0 out of 2 expected pods are ready ready.go:281: [debug] Deployment is not ready: review/review-feature-us-4xvr5j. 0 out of 2 expected pods are ready ready.go:281: [debug] Deployment is not ready: review/review-feature-us-4xvr5j. 0 out of 2 expected pods are ready ready.go:281: [debug] Deployment is not ready: review/review-feature-us-4xvr5j. 0 out of 2 expected pods are ready ready.go:281: [debug] Deployment is not ready: review/review-feature-us-4xvr5j. 0 out of 2 expected pods are ready ready.go:281: [debug] Deployment is not ready: review/review-feature-us-4xvr5j. 0 out of 2 expected pods are ready ready.go:281: [debug] Deployment is not ready: review/review-feature-us-4xvr5j. 0 out of 2 expected pods are ready ready.go:281: [debug] Deployment is not ready: review/review-feature-us-4xvr5j. 0 out of 2 expected pods are ready ready.go:281: [debug] Deployment is not ready: review/review-feature-us-4xvr5j. 0 out of 2 expected pods are ready ready.go:281: [debug] Deployment is not ready: review/review-feature-us-4xvr5j. 0 out of 2 expected pods are ready ready.go:281: [debug] Deployment is not ready: review/review-feature-us-4xvr5j. 0 out of 2 expected pods are ready ready.go:281: [debug] Deployment is not ready: review/review-feature-us-4xvr5j. 0 out of 2 expected pods are ready ready.go:281: [debug] Deployment is not ready: review/review-feature-us-4xvr5j. 0 out of 2 expected pods are ready ready.go:281: [debug] Deployment is not ready: review/review-feature-us-4xvr5j. 0 out of 2 expected pods are ready ready.go:281: [debug] Deployment is not ready: review/review-feature-us-4xvr5j. 1 out of 2 expected pods are ready ready.go:281: [debug] Deployment is not ready: review/review-feature-us-4xvr5j. 1 out of 2 expected pods are ready ready.go:281: [debug] Deployment is not ready: review/review-feature-us-4xvr5j. 1 out of 2 expected pods are ready ready.go:281: [debug] Deployment is not ready: review/review-feature-us-4xvr5j. 1 out of 2 expected pods are ready ready.go:281: [debug] Deployment is not ready: review/review-feature-us-4xvr5j. 1 out of 2 expected pods are ready ready.go:281: [debug] Deployment is not ready: review/review-feature-us-4xvr5j. 1 out of 2 expected pods are ready ready.go:281: [debug] Deployment is not ready: review/review-feature-us-4xvr5j. 1 out of 2 expected pods are ready ready.go:281: [debug] Deployment is not ready: review/review-feature-us-4xvr5j. 1 out of 2 expected pods are ready ready.go:281: [debug] Deployment is not ready: review/review-feature-us-4xvr5j. 1 out of 2 expected pods are ready ready.go:281: [debug] Deployment is not ready: review/review-feature-us-4xvr5j. 1 out of 2 expected pods are ready ready.go:281: [debug] Deployment is not ready: review/review-feature-us-4xvr5j. 1 out of 2 expected pods are ready ready.go:281: [debug] Deployment is not ready: review/review-feature-us-4xvr5j. 1 out of 2 expected pods are ready ready.go:281: [debug] Deployment is not ready: review/review-feature-us-4xvr5j. 1 out of 2 expected pods are ready ready.go:281: [debug] Deployment is not ready: review/review-feature-us-4xvr5j. 1 out of 2 expected pods are ready ready.go:281: [debug] Deployment is not ready: review/review-feature-us-4xvr5j. 1 out of 2 expected pods are ready ready.go:281: [debug] Deployment is not ready: review/review-feature-us-4xvr5j. 1 out of 2 expected pods are ready ready.go:281: [debug] Deployment is not ready: review/review-feature-us-4xvr5j. 1 out of 2 expected pods are ready ready.go:281: [debug] Deployment is not ready: review/review-feature-us-4xvr5j. 1 out of 2 expected pods are ready ready.go:281: [debug] Deployment is not ready: review/review-feature-us-4xvr5j. 1 out of 2 expected pods are ready ready.go:281: [debug] Deployment is not ready: review/review-feature-us-4xvr5j. 1 out of 2 expected pods are ready ready.go:281: [debug] Deployment is not ready: review/review-feature-us-4xvr5j. 1 out of 2 expected pods are ready ready.go:281: [debug] Deployment is not ready: review/review-feature-us-4xvr5j. 1 out of 2 expected pods are ready ready.go:281: [debug] Deployment is not ready: review/review-feature-us-4xvr5j. 1 out of 2 expected pods are ready ready.go:281: [debug] Deployment is not ready: review/review-feature-us-4xvr5j. 1 out of 2 expected pods are ready ready.go:281: [debug] Deployment is not ready: review/review-feature-us-4xvr5j. 1 out of 2 expected pods are ready ready.go:281: [debug] Deployment is not ready: review/review-feature-us-4xvr5j. 1 out of 2 expected pods are ready ready.go:281: [debug] Deployment is not ready: review/review-feature-us-4xvr5j. 1 out of 2 expected pods are ready ready.go:281: [debug] Deployment is not ready: review/review-feature-us-4xvr5j. 1 out of 2 expected pods are ready ready.go:281: [debug] Deployment is not ready: review/review-feature-us-4xvr5j. 1 out of 2 expected pods are ready ready.go:281: [debug] Deployment is not ready: review/review-feature-us-4xvr5j. 1 out of 2 expected pods are ready ready.go:281: [debug] Deployment is not ready: review/review-feature-us-4xvr5j. 1 out of 2 expected pods are ready ready.go:281: [debug] Deployment is not ready: review/review-feature-us-4xvr5j. 1 out of 2 expected pods are ready ready.go:281: [debug] Deployment is not ready: review/review-feature-us-4xvr5j. 1 out of 2 expected pods are ready ready.go:281: [debug] Deployment is not ready: review/review-feature-us-4xvr5j. 1 out of 2 expected pods are ready ready.go:281: [debug] Deployment is not ready: review/review-feature-us-4xvr5j. 1 out of 2 expected pods are ready ready.go:281: [debug] Deployment is not ready: review/review-feature-us-4xvr5j. 1 out of 2 expected pods are ready ready.go:281: [debug] Deployment is not ready: review/review-feature-us-4xvr5j. 1 out of 2 expected pods are ready ready.go:281: [debug] Deployment is not ready: review/review-feature-us-4xvr5j. 1 out of 2 expected pods are ready ready.go:281: [debug] Deployment is not ready: review/review-feature-us-4xvr5j. 1 out of 2 expected pods are ready ready.go:281: [debug] Deployment is not ready: review/review-feature-us-4xvr5j. 1 out of 2 expected pods are ready ready.go:281: [debug] Deployment is not ready: review/review-feature-us-4xvr5j. 1 out of 2 expected pods are ready ready.go:281: [debug] Deployment is not ready: review/review-feature-us-4xvr5j. 1 out of 2 expected pods are ready ready.go:281: [debug] Deployment is not ready: review/review-feature-us-4xvr5j. 1 out of 2 expected pods are ready ready.go:281: [debug] Deployment is not ready: review/review-feature-us-4xvr5j. 1 out of 2 expected pods are ready ready.go:281: [debug] Deployment is not ready: review/review-feature-us-4xvr5j. 1 out of 2 expected pods are ready ready.go:281: [debug] Deployment is not ready: review/review-feature-us-4xvr5j. 1 out of 2 expected pods are ready ready.go:281: [debug] Deployment is not ready: review/review-feature-us-4xvr5j. 1 out of 2 expected pods are ready ready.go:281: [debug] Deployment is not ready: review/review-feature-us-4xvr5j. 1 out of 2 expected pods are ready ready.go:281: [debug] Deployment is not ready: review/review-feature-us-4xvr5j. 1 out of 2 expected pods are ready ready.go:281: [debug] Deployment is not ready: review/review-feature-us-4xvr5j. 1 out of 2 expected pods are ready ready.go:281: [debug] Deployment is not ready: review/review-feature-us-4xvr5j. 1 out of 2 expected pods are ready ready.go:281: [debug] Deployment is not ready: review/review-feature-us-4xvr5j. 1 out of 2 expected pods are ready ready.go:281: [debug] Deployment is not ready: review/review-feature-us-4xvr5j. 1 out of 2 expected pods are ready ready.go:281: [debug] Deployment is not ready: review/review-feature-us-4xvr5j. 1 out of 2 expected pods are ready ready.go:281: [debug] Deployment is not ready: review/review-feature-us-4xvr5j. 1 out of 2 expected pods are ready ready.go:281: [debug] Deployment is not ready: review/review-feature-us-4xvr5j. 1 out of 2 expected pods are ready ready.go:281: [debug] Deployment is not ready: review/review-feature-us-4xvr5j. 1 out of 2 expected pods are ready ready.go:281: [debug] Deployment is not ready: review/review-feature-us-4xvr5j. 1 out of 2 expected pods are ready ready.go:281: [debug] Deployment is not ready: review/review-feature-us-4xvr5j. 1 out of 2 expected pods are ready ready.go:281: [debug] Deployment is not ready: review/review-feature-us-4xvr5j. 1 out of 2 expected pods are ready ready.go:281: [debug] Deployment is not ready: review/review-feature-us-4xvr5j. 1 out of 2 expected pods are ready ready.go:281: [debug] Deployment is not ready: review/review-feature-us-4xvr5j. 1 out of 2 expected pods are ready ready.go:281: [debug] Deployment is not ready: review/review-feature-us-4xvr5j. 1 out of 2 expected pods are ready ready.go:281: [debug] Deployment is not ready: review/review-feature-us-4xvr5j. 1 out of 2 expected pods are ready ready.go:281: [debug] Deployment is not ready: review/review-feature-us-4xvr5j. 1 out of 2 expected pods are ready ready.go:281: [debug] Deployment is not ready: review/review-feature-us-4xvr5j. 1 out of 2 expected pods are ready ready.go:281: [debug] Deployment is not ready: review/review-feature-us-4xvr5j. 1 out of 2 expected pods are ready ready.go:281: [debug] Deployment is not ready: review/review-feature-us-4xvr5j. 1 out of 2 expected pods are ready ready.go:281: [debug] Deployment is not ready: review/review-feature-us-4xvr5j. 1 out of 2 expected pods are ready ready.go:281: [debug] Deployment is not ready: review/review-feature-us-4xvr5j. 1 out of 2 expected pods are ready ready.go:281: [debug] Deployment is not ready: review/review-feature-us-4xvr5j. 1 out of 2 expected pods are ready ready.go:281: [debug] Deployment is not ready: review/review-feature-us-4xvr5j. 1 out of 2 expected pods are ready ready.go:281: [debug] Deployment is not ready: review/review-feature-us-4xvr5j. 1 out of 2 expected pods are ready ready.go:281: [debug] Deployment is not ready: review/review-feature-us-4xvr5j. 1 out of 2 expected pods are ready ready.go:281: [debug] Deployment is not ready: review/review-feature-us-4xvr5j. 1 out of 2 expected pods are ready ready.go:281: [debug] Deployment is not ready: review/review-feature-us-4xvr5j. 1 out of 2 expected pods are ready ready.go:281: [debug] Deployment is not ready: review/review-feature-us-4xvr5j. 1 out of 2 expected pods are ready ready.go:281: [debug] Deployment is not ready: review/review-feature-us-4xvr5j. 1 out of 2 expected pods are ready ready.go:281: [debug] Deployment is not ready: review/review-feature-us-4xvr5j. 1 out of 2 expected pods are ready ready.go:281: [debug] Deployment is not ready: review/review-feature-us-4xvr5j. 1 out of 2 expected pods are ready ready.go:281: [debug] Deployment is not ready: review/review-feature-us-4xvr5j. 1 out of 2 expected pods are ready ready.go:281: [debug] Deployment is not ready: review/review-feature-us-4xvr5j. 1 out of 2 expected pods are ready ready.go:281: [debug] Deployment is not ready: review/review-feature-us-4xvr5j. 1 out of 2 expected pods are ready ready.go:281: [debug] Deployment is not ready: review/review-feature-us-4xvr5j. 1 out of 2 expected pods are ready ready.go:281: [debug] Deployment is not ready: review/review-feature-us-4xvr5j. 1 out of 2 expected pods are ready ready.go:281: [debug] Deployment is not ready: review/review-feature-us-4xvr5j. 1 out of 2 expected pods are ready ready.go:281: [debug] Deployment is not ready: review/review-feature-us-4xvr5j. 1 out of 2 expected pods are ready ready.go:281: [debug] Deployment is not ready: review/review-feature-us-4xvr5j. 1 out of 2 expected pods are ready ready.go:281: [debug] Deployment is not ready: review/review-feature-us-4xvr5j. 1 out of 2 expected pods are ready ready.go:281: [debug] Deployment is not ready: review/review-feature-us-4xvr5j. 1 out of 2 expected pods are ready ready.go:281: [debug] Deployment is not ready: review/review-feature-us-4xvr5j. 1 out of 2 expected pods are ready ready.go:281: [debug] Deployment is not ready: review/review-feature-us-4xvr5j. 1 out of 2 expected pods are ready ready.go:281: [debug] Deployment is not ready: review/review-feature-us-4xvr5j. 1 out of 2 expected pods are ready ready.go:281: [debug] Deployment is not ready: review/review-feature-us-4xvr5j. 1 out of 2 expected pods are ready ready.go:281: [debug] Deployment is not ready: review/review-feature-us-4xvr5j. 1 out of 2 expected pods are ready ready.go:281: [debug] Deployment is not ready: review/review-feature-us-4xvr5j. 1 out of 2 expected pods are ready ready.go:281: [debug] Deployment is not ready: review/review-feature-us-4xvr5j. 1 out of 2 expected pods are ready ready.go:281: [debug] Deployment is not ready: review/review-feature-us-4xvr5j. 1 out of 2 expected pods are ready ready.go:281: [debug] Deployment is not ready: review/review-feature-us-4xvr5j. 1 out of 2 expected pods are ready ready.go:281: [debug] Deployment is not ready: review/review-feature-us-4xvr5j. 1 out of 2 expected pods are ready ready.go:281: [debug] Deployment is not ready: review/review-feature-us-4xvr5j. 1 out of 2 expected pods are ready ready.go:281: [debug] Deployment is not ready: review/review-feature-us-4xvr5j. 1 out of 2 expected pods are ready ready.go:281: [debug] Deployment is not ready: review/review-feature-us-4xvr5j. 1 out of 2 expected pods are ready ready.go:281: [debug] Deployment is not ready: review/review-feature-us-4xvr5j. 1 out of 2 expected pods are ready ready.go:281: [debug] Deployment is not ready: review/review-feature-us-4xvr5j. 1 out of 2 expected pods are ready ready.go:281: [debug] Deployment is not ready: review/review-feature-us-4xvr5j. 1 out of 2 expected pods are ready ready.go:281: [debug] Deployment is not ready: review/review-feature-us-4xvr5j. 1 out of 2 expected pods are ready ready.go:281: [debug] Deployment is not ready: review/review-feature-us-4xvr5j. 1 out of 2 expected pods are ready ready.go:281: [debug] Deployment is not ready: review/review-feature-us-4xvr5j. 1 out of 2 expected pods are ready ready.go:281: [debug] Deployment is not ready: review/review-feature-us-4xvr5j. 1 out of 2 expected pods are ready ready.go:281: [debug] Deployment is not ready: review/review-feature-us-4xvr5j. 1 out of 2 expected pods are ready ready.go:281: [debug] Deployment is not ready: review/review-feature-us-4xvr5j. 1 out of 2 expected pods are ready ready.go:281: [debug] Deployment is not ready: review/review-feature-us-4xvr5j. 1 out of 2 expected pods are ready ready.go:281: [debug] Deployment is not ready: review/review-feature-us-4xvr5j. 1 out of 2 expected pods are ready ready.go:281: [debug] Deployment is not ready: review/review-feature-us-4xvr5j. 1 out of 2 expected pods are ready ready.go:281: [debug] Deployment is not ready: review/review-feature-us-4xvr5j. 1 out of 2 expected pods are ready ready.go:281: [debug] Deployment is not ready: review/review-feature-us-4xvr5j. 1 out of 2 expected pods are ready ready.go:281: [debug] Deployment is not ready: review/review-feature-us-4xvr5j. 1 out of 2 expected pods are ready ready.go:281: [debug] Deployment is not ready: review/review-feature-us-4xvr5j. 1 out of 2 expected pods are ready ready.go:281: [debug] Deployment is not ready: review/review-feature-us-4xvr5j. 1 out of 2 expected pods are ready ready.go:281: [debug] Deployment is not ready: review/review-feature-us-4xvr5j. 1 out of 2 expected pods are ready ready.go:281: [debug] Deployment is not ready: review/review-feature-us-4xvr5j. 1 out of 2 expected pods are ready ready.go:281: [debug] Deployment is not ready: review/review-feature-us-4xvr5j. 1 out of 2 expected pods are ready ready.go:281: [debug] Deployment is not ready: review/review-feature-us-4xvr5j. 1 out of 2 expected pods are ready ready.go:281: [debug] Deployment is not ready: review/review-feature-us-4xvr5j. 1 out of 2 expected pods are ready ready.go:281: [debug] Deployment is not ready: review/review-feature-us-4xvr5j. 1 out of 2 expected pods are ready ready.go:281: [debug] Deployment is not ready: review/review-feature-us-4xvr5j. 1 out of 2 expected pods are ready ready.go:281: [debug] Deployment is not ready: review/review-feature-us-4xvr5j. 1 out of 2 expected pods are ready ready.go:281: [debug] Deployment is not ready: review/review-feature-us-4xvr5j. 1 out of 2 expected pods are ready upgrade.go:466: [debug] warning: Upgrade "review-feature-us-4xvr5j" failed: context deadline exceeded upgrade.go:484: [debug] Upgrade failed and atomic is set, rolling back to last successful release history.go:56: [debug] getting history for release review-feature-us-4xvr5j rollback.go:65: [debug] preparing rollback of review-feature-us-4xvr5j rollback.go:131: [debug] rolling back review-feature-us-4xvr5j (current: v8, target: v7) rollback.go:72: [debug] creating rolled back release for review-feature-us-4xvr5j rollback.go:78: [debug] performing rollback of review-feature-us-4xvr5j client.go:[393](https://gitlab.com/ebscois/clinical-decisions/sirocco/cdh-browse-middle/-/jobs/5500927186#L393): [debug] checking 5 resources for changes client.go:[414](https://gitlab.com/ebscois/clinical-decisions/sirocco/cdh-browse-middle/-/jobs/5500927186#L414): [debug] Created a new ServiceAccount called "cdh-browse-middle" in review client.go:693: [debug] Patch Service "review-feature-us-4xvr5j-auto-deploy" in namespace review client.go:693: [debug] Patch Deployment "review-feature-us-4xvr5j" in namespace review client.go:693: [debug] Patch HorizontalPodAutoscaler "review-feature-us-4xvr5j-auto-deploy" in namespace review client.go:693: [debug] Patch Ingress "review-feature-us-4xvr5j-auto-deploy" in namespace review wait.go:48: [debug] beginning wait for 5 resources with timeout of 5m0s rollback.go:256: [debug] superseding previous deployment 7 rollback.go:84: [debug] updating status for rolled back release for review-feature-us-4xvr5j Error: UPGRADE FAILED: release review-feature-us-4xvr5j failed, and has been rolled back due to atomic being set: context deadline exceeded helm.go:84: [debug] context deadline exceeded

Please help.

pkalantri-ebsco on Nov 9, 2023

Sorting by (Weight, Kind, Name) allows developers to treat hooks of the same weight as one unit of work, especially when there are structural dependencies (e.g. a Job that needs a Service Account for authorization). If Job A needs Service Account A and Job B needs Service Account B, but Job A needs to run before Job B, we can just group the A resources under the same, lower weight for better semantics.

As a user I would expect to use weights to order my hooks based on my unique workload (e.g. a hook weighted 0 sets up cloud resources for a hook weighted 1), while orderings implicitly required by Kubernetes (basically what InstallOrder defines) should be handled by Helm. With the current behavior, I need to use weights to sort across both dimensions.

Additionally, based on my reading of the code, ordering by (Weight, Kind, Name) seems to be the original intent. The hooks are sorted with Stable() and there is a comment above the sort that says “hooke [sic] are pre-ordered by kind, so keep order stable”. This suggests that the original author wanted to preserve ordering by kind, and the stability of the sort was only broken by the usage of hook name as a sort key, which makes every item unique and renders Stable() useless.

That being said, I understand the concern about breaking users. My rebuttal is that the area of effect could be small. Since hooks are still first sorted by weight, any explicitly intended ordering remains the same. Additionally, as hooks of the same kind and weight are still sorted by name, the original ordering is again unaffected.

Consequently, this change only affects users who named hooks of the same weight in such a way that alphabetical ordering also happens to be the expected prioritization. I think there’s two worrisome re-orderings in this scenario:

Different kinds that run processes (e.g. Jobs, Pods, Deployments) where the workloads depend on each other; however, I would imagine such hooks are already ordered by weight.
CRDs - in this ordering, unknown kinds are installed last, and it’s quite possible that users have named their CRDs in a way that currently installs them first.

I certainly don’t feel strongly about this as it’s not too hard to change weights to accommodate. I was just curious to investigate what was wrong in the code and ended up submitting a PR with a fix 😄

lynshi on Oct 20, 2023

It’s not clear from the documentation that install order is not respected. In fact, in the hook lifecycle description, step 6 says:
6. The library sorts hooks by weight (assigning a weight of 0 by default), by resource kind and finally by name in ascending order.
This suggests that install order applies within hooks of the same weight.

If I am misinterpreting the docs and this is indeed not the behavior, is it possible to add a feature to apply install order as a tiebreaker for hooks with the same weight? That would make it much easier to create associated sets of hook resources. For example, Job A needs Service Account A, so we assign them the same weight to deploy them together.

I think it makes sense. I also first looked at the documentation and didn’t find the explanation. Then, I found out the logic here by checking the code.

Ithrael on Sep 22, 2023

It’s not clear from the documentation that install order is not respected. In fact, in the hook lifecycle description, step 6 says:

6. The library sorts hooks by weight (assigning a weight of 0 by default), by resource kind and finally by name in ascending order.

This suggests that install order applies within hooks of the same weight.

If I am misinterpreting the docs and this is indeed not the behavior, is it possible to add a feature to apply install order as a tiebreaker for hooks with the same weight? That would make it much easier to create associated sets of hook resources. For example, Job A needs Service Account A, so we assign them the same weight to deploy them together.

lynshi on Sep 21, 2023