My RHBK - Addition

advanced-cluster-management/templates/crd-reader-bcarr.yaml

@@ -0,0 +1,36 @@
+{{- if not .Values.ignoreHelmHooks }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: crd-reader
+  annotations:
+    "helm.sh/hook": post-install,post-upgrade
+    "helm.sh/hook-weight": "-5"
+    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
+rules:
+- apiGroups:
+  - apiextensions.k8s.io
+  resources:
+  - 'customresourcedefinitions'
+  verbs:
+  - get
+  - list
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: crd-reader-binding
+  annotations:
+    "helm.sh/hook": post-install,post-upgrade
+    "helm.sh/hook-weight": "-5"
+    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: crd-reader
+subjects:
+- kind: ServiceAccount
+  name: default
+  namespace: {{ .Values.acm.namespace }}
+{{- end }}

advanced-cluster-management/templates/crd-reader.yaml

@@ -16,6 +16,22 @@ rules:
   verbs:
   - get
   - list
+- apiGroups:
+  - "apps"
+  resources:
+  - "deployments"
+  verbs:
+  - "get"
+  - "list"
+  - "watch"
+- apiGroups:
+  - ""
+  resources:
+  - "endpoints"
+  verbs:
+  - "get"
+  - "list"
+  - "watch"
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
@@ -33,4 +49,4 @@ subjects:
 - kind: ServiceAccount
   name: default
   namespace: {{ .Values.acm.namespace }}
-{{- end }}
+{{- end }}

advanced-cluster-management/templates/wait-for-crd-bcarr.yaml

@@ -0,0 +1,26 @@
+{{- if not .Values.ignoreHelmHooks }}
+---
+apiVersion: v1
+kind: Pod
+metadata:
+  name: crd-check 
+  annotations:
+    "helm.sh/hook": post-install,post-upgrade
+    "helm.sh/hook-weight": "-1"
+    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
+  namespace: {{ .Values.acm.namespace }}
+spec:
+  containers:
+  - name: crd-check 
+    image: {{ .Values.image }}
+    imagePullPolicy: IfNotPresent
+    command: ['sh', '-c', 'while [ true ]; do oc get crd multiclusterhubs.operator.open-cluster-management.io; if [ $? -eq 0 ]; then break; fi ; sleep 5s; done']
+  restartPolicy: Never
+  terminationGracePeriodSeconds: 0
+  serviceAccount: default
+  serviceAccountName: default
+  securityContext:
+    runAsNonRoot: true
+    seccompProfile:
+      type: RuntimeDefault
+{{- end }}

advanced-cluster-management/templates/wait-for-crd.yaml

@@ -3,18 +3,45 @@
 apiVersion: v1
 kind: Pod
 metadata:
-  name: crd-check 
+  name: crd-check
   annotations:
     "helm.sh/hook": post-install,post-upgrade
     "helm.sh/hook-weight": "-1"
     "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
   namespace: {{ .Values.acm.namespace }}
 spec:
   containers:
-  - name: crd-check 
+  - name: crd-check
     image: {{ .Values.image }}
     imagePullPolicy: IfNotPresent
-    command: ['sh', '-c', 'while [ true ]; do oc get crd multiclusterhubs.operator.open-cluster-management.io; if [ $? -eq 0 ]; then break; fi ; sleep 5s; done']
+    # This command now performs three checks for maximum reliability:
+    # 1. Waits for the CRD to be established.
+    # 2. Waits for the operator's Deployment to be Available.
+    # 3. Explicitly waits for the webhook Service to have active Endpoints.
+    command:
+      - /bin/sh
+      - -c
+      - |
+        echo "Waiting for MultiClusterHub CRD to be established..."
+        oc wait --for=condition=Established crd/multiclusterhubs.operator.open-cluster-management.io --timeout=300s
+
+        echo "CRD found. Waiting for multiclusterhub-operator deployment to become available..."
+        oc wait --for=condition=Available deployment/multiclusterhub-operator -n {{ .Values.acm.namespace }} --timeout=300s
+
+        echo "Operator deployment is available. Now waiting for webhook endpoint to be active..."
+        ATTEMPTS=0
+        MAX_ATTEMPTS=60 # Wait up to 5 minutes (60 * 5s)
+        while [ -z "$(oc get endpoints multiclusterhub-operator-webhook -n {{ .Values.acm.namespace }} -o=jsonpath='{.subsets[?(@.addresses)].addresses[?(@.ip)].ip}')" ]; do
+          if [ $ATTEMPTS -eq $MAX_ATTEMPTS ]; then
+            echo "ERROR: Timed out waiting for webhook endpoint."
+            exit 1
+          fi
+          echo "Webhook endpoint not ready, waiting 5s..."
+          ATTEMPTS=$((ATTEMPTS + 1))
+          sleep 5
+        done
+
+        echo "Webhook endpoint is active. Hook succeeded."
   restartPolicy: Never
   terminationGracePeriodSeconds: 0
   serviceAccount: default
@@ -23,4 +50,4 @@ spec:
     runAsNonRoot: true
     seccompProfile:
       type: RuntimeDefault
-{{- end }}
+{{- end }}