Rework on-cluster manifests [3]

cmd/deploy.go

@@ -20,7 +20,6 @@ import (
 	"github.com/stackrox/roxie/internal/env"
 	"github.com/stackrox/roxie/internal/helpers"
 	"github.com/stackrox/roxie/internal/imagetag"
-	"github.com/stackrox/roxie/internal/k8s"
 	log "github.com/stackrox/roxie/internal/logger"
 	"github.com/stackrox/roxie/internal/manifest"
 	"github.com/stackrox/roxie/internal/roxieenv"
@@ -235,12 +234,7 @@ func runDeploy(cmd *cobra.Command, args []string) error {
 		return err
 	}
 
-	// Cluster-config retrieval happens before the full config (and thus the configured deploy
-	// wait timeouts) is assembled, so give it its own short bounded context.
-	setupCtx, setupCancel := context.WithTimeout(context.Background(), 10*time.Minute)
-	defer setupCancel()
-
-	clusterConfig := retrieveClusterConfigForComponents(setupCtx, components)
+	clusterConfig := new(deployer.DefaultConfig())
 
 	deploySettings, err := assembleConfigForCommand(clusterConfig, deploySettingsFromArgs, skipUserConfig)
 	if err != nil {
@@ -344,20 +338,18 @@ func runDeploy(cmd *cobra.Command, args []string) error {
 		d.WaitForCentral(5 * time.Minute)
 	}
 
-	if !dryRun {
+	// The on-cluster manifest is lifecylce-aligned with Central.
+	if components.IncludesCentral() {
 		roxieEnv := roxieenv.AssembleRoxieEnvironment(d.GetCentralDeploymentInfo())
-		m := manifest.RoxieManifest{
-			RoxieEnvironment: roxieEnv,
-			Config:           deploySettings,
-		}
+		m := manifest.NewManifest(roxieEnv, deploySettings)
 		if err := manifest.CreateManifestSecretOnCluster(ctx, m); err != nil {
 			log.Warningf("Failed to save roxie manifest: %v", err)
 		}
-	}
 
-	if components.IncludesCentral() && envrc == "" {
-		if err := spawnSubshellForDeployerEnv(deploySettings.Roxie, d); err != nil {
-			return fmt.Errorf("failed to spawn subshell: %w", err)
+		if envrc == "" {
+			if err := spawnSubshellForDeployerEnv(deploySettings.Roxie, d); err != nil {
+				return fmt.Errorf("failed to spawn subshell: %w", err)
+			}
 		}
 	}
 
@@ -402,30 +394,6 @@ func validateContainerizedCredentials(registry string, clusterType types.Cluster
 	return nil
 }
 
-func retrieveClusterConfigForComponents(
-	ctx context.Context,
-	components component.Component,
-) *deployer.Config {
-	clusterManifest, err := manifest.LoadManifestSecret(ctx)
-	if err != nil {
-		if errors.Is(err, k8s.ErrResourceNotFound) {
-			log.Dim("No existing manifest found on cluster, starting from defaults")
-		} else {
-			log.Warningf("Failed to load manifest from cluster: %v", err)
-		}
-		return nil // Let's try to continue without manifest
-	}
-
-	if components == component.SecuredCluster && clusterManifest.Config.SecuredCluster.Spec != nil {
-		// Reusing these fields from the config stored on the cluster would cause problems
-		// during repeating sensor deploy & teardown cycles.
-		delete(clusterManifest.Config.SecuredCluster.Spec, "clusterName")
-		delete(clusterManifest.Config.SecuredCluster.Spec, "centralEndpoint")
-	}
-
-	return &clusterManifest.Config
-}
-
 func configureConfig(components component.Component, deploySettings *deployer.Config) error {
 	if deploySettings.Roxie.ClusterType == "" {
 		clusterType := env.GetAutoDetectedClusterType()

cmd/main.go

@@ -136,7 +136,7 @@ func init() {
 	)
 
 	rootCmd.AddCommand(newDeployCmd(&deploySettingsFromArgs))
-	rootCmd.AddCommand(newTeardownCmd(&deploySettingsFromArgs))
+	rootCmd.AddCommand(newTeardownCmd())
 	rootCmd.AddCommand(newShellCmd())
 	rootCmd.AddCommand(newVersionCmd())
 	rootCmd.AddCommand(newEnvCmd())

cmd/shell.go

@@ -9,6 +9,7 @@ import (
 	"time"
 
 	"github.com/spf13/cobra"
+	"github.com/stackrox/roxie/internal/deployer"
 	"github.com/stackrox/roxie/internal/env"
 	log "github.com/stackrox/roxie/internal/logger"
 	"github.com/stackrox/roxie/internal/manifest"
@@ -70,9 +71,14 @@ func runShell(args []string) error {
 		return fmt.Errorf("failed to load roxie manifest: %w", err)
 	}
 	log.Dim("roxie manifest loaded")
-	configBase := m.Config
 
-	config, err := assembleConfigForCommand(&configBase, deploySettingsFromArgs, skipUserConfig)
+	// Seed the merge pipeline with the fields the manifest persists (HAProxy and
+	// Exposure), so they are overridable by user config and CLI args while still
+	// defaulting to what was deployed.
+	var base deployer.Config
+	base.Roxie.HAProxy = m.HAProxy
+	base.Central.Exposure = m.Exposure
+	config, err := assembleConfigForCommand(&base, deploySettingsFromArgs, skipUserConfig)
 	if err != nil {
 		return err
 	}

cmd/teardown.go

@@ -2,20 +2,18 @@ package main
 
 import (
 	"context"
-	"errors"
 	"fmt"
 	"time"
 
 	"github.com/spf13/cobra"
 	"github.com/stackrox/roxie/internal/component"
 	"github.com/stackrox/roxie/internal/deployer"
 	"github.com/stackrox/roxie/internal/env"
-	"github.com/stackrox/roxie/internal/k8s"
 	log "github.com/stackrox/roxie/internal/logger"
 	"github.com/stackrox/roxie/internal/manifest"
 )
 
-func newTeardownCmd(settings *deployer.Config) *cobra.Command {
+func newTeardownCmd() *cobra.Command {
 	cmd := &cobra.Command{
 		Use:       "teardown [component]",
 		Short:     "Teardown ACS components",
@@ -25,17 +23,9 @@ func newTeardownCmd(settings *deployer.Config) *cobra.Command {
 		RunE:      runTeardown,
 	}
 
-	registerFlag(cmd, settings, "single-namespace", "Deploy all components in a single namespace ('stackrox')",
-		withNoOptDefVal("true"),
-		withApplyFnBool(func(config *deployer.Config, val bool) error {
-			// We do not support --single-namespace=false as of now.
-			if val {
-				config.Central.Namespace = sharedNamespace
-				config.SecuredCluster.Namespace = sharedNamespace
-			}
-			return nil
-		}),
-	)
+	// Accepted for backwards compatibility but ignored — teardown now discovers namespaces from the cluster.
+	cmd.Flags().Bool("single-namespace", false, "Deprecated: teardown discovers namespaces automatically")
+	_ = cmd.Flags().MarkDeprecated("single-namespace", "teardown now discovers namespaces automatically")
 
 	return cmd
 }
@@ -60,29 +50,12 @@ func runTeardown(cmd *cobra.Command, args []string) error {
 	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Minute)
 	defer cancel()
 
-	var clusterConfig *deployer.Config
-	clusterManifest, err := manifest.LoadManifestSecret(ctx)
-	if errors.Is(err, k8s.ErrResourceNotFound) {
-		log.Infof("No roxie manifest found in cluster, proceeding without it")
-	} else if err != nil {
-		log.Warningf("Failed to load manifest from cluster: %v", err)
-	} else {
-		clusterConfig = &clusterManifest.Config
-	}
-
-	deploySettings, err := assembleConfigForCommand(clusterConfig, deploySettingsFromArgs, skipUserConfig)
-	if err != nil {
-		return err
-	}
-
 	d, err := deployer.New()
 	if err != nil {
 		return fmt.Errorf("failed to create deployer: %w", err)
 	}
 	defer d.Cleanup()
 
-	d.SetConfig(deploySettings)
-
 	if err := d.Teardown(ctx, components); err != nil {
 		return fmt.Errorf("teardown failed: %w", err)
 	}

internal/deployer/addons.go

@@ -8,6 +8,8 @@ import (
 	"regexp"
 	"slices"
 
+	"github.com/stackrox/roxie/internal/helm"
+	"github.com/stackrox/roxie/internal/k8s"
 	log "github.com/stackrox/roxie/internal/logger"
 )
 
@@ -52,22 +54,36 @@ func (d *Deployer) deployAddOns(ctx context.Context, addOns []AddOn) error {
 	return nil
 }
 
-func (d *Deployer) teardownAddOns(ctx context.Context, addOns []AddOn) {
-	if len(addOns) == 0 {
+// teardownDiscoveredAddOns discovers add-on Helm releases deployed alongside
+// Central directly from the cluster and uninstalls them. Add-ons are
+// lifecycle-aligned with Central, so we locate the Central namespace and
+// uninstall every Helm release matching the roxie add-on prefix.
+func (d *Deployer) teardownDiscoveredAddOns(ctx context.Context) {
+	namespace, err := k8s.DiscoverCRNamespace(ctx, "central", centralCrName)
+	if err != nil {
+		log.Warningf("Could not discover Central namespace for add-on teardown: %v", err)
+		return
+	}
+	if namespace == "" {
+		log.Infof("No Central CR found on cluster, skipping add-on teardown")
 		return
 	}
 
-	log.Infof("Tearing down %d add-on(s)...", len(addOns))
+	releases, err := helm.ListByPrefix(ctx, addOnReleasePrefix, namespace)
+	if err != nil {
+		log.Warningf("Could not list add-on Helm releases in namespace %s: %v", namespace, err)
+		return
+	}
+	if len(releases) == 0 {
+		return
+	}
 
-	for _, addon := range addOns {
-		if err := addon.Teardown(ctx); err != nil {
-			if !addon.IsOptional() {
-				log.Errorf("Failed to tear down non-optional add-on %q: %v", addon.Name(), err)
-			} else {
-				log.Warningf("Failed to tear down optional add-on %q: %v", addon.Name(), err)
-			}
+	log.Infof("Tearing down %d add-on(s)...", len(releases))
+	for _, release := range releases {
+		if err := helm.Uninstall(ctx, release, namespace); err != nil {
+			log.Warningf("Failed to tear down add-on release %q: %v", release, err)
 		} else {
-			log.Successf("Add-on %q torn down", addon.Name())
+			log.Successf("Add-on release %q torn down", release)
 		}
 	}
 }