Make credential migration hook configurable via opencloud.migration.enabled

charts/opencloud/README.md

@@ -389,13 +389,15 @@ The job and its RBAC resources (ServiceAccount, Role, RoleBinding) are cleaned u
 
 | Parameter | Description | Default |
 | --------- | ----------- | ------- |
+| `opencloud.migration.enabled` | Enable the credential migration job hook | `true` |
 | `opencloud.migration.configPvcClaimName` | Name of the legacy config PVC to read credentials from | `<release>-opencloud-config` |
 
 **Example:**
 
 ```yaml
 opencloud:
   migration:
+    enabled: true
     configPvcClaimName: "my-old-opencloud-config"
 ```
 

charts/opencloud/templates/opencloud/migration-job.yaml

@@ -1,4 +1,4 @@
-{{- if .Values.opencloud.enabled }}
+{{- if and .Values.opencloud.enabled .Values.opencloud.migration.enabled }}
 {{- $jobName := printf "%s-credential-migration" (include "opencloud.opencloud.fullname" .) -}}
 {{- $saName := printf "%s-credential-migration" (include "opencloud.opencloud.fullname" .) -}}
 {{- $targetSecret := .Values.opencloud.initSecrets.existingSecret | default (printf "%s-init" (include "opencloud.opencloud.fullname" .)) -}}

charts/opencloud/tests/migration-job_test.yaml

@@ -0,0 +1,22 @@
+suite: Credential Migration Job Tests
+
+templates:
+  - _helpers/tpl.yaml
+  - opencloud/migration-job.yaml
+
+tests:
+  - it: migration job resources are created by default
+    template: opencloud/migration-job.yaml
+    asserts:
+      - hasDocuments:
+          count: 4
+
+  - it: migration job resources are not created when disabled
+    template: opencloud/migration-job.yaml
+    set:
+      opencloud:
+        migration:
+          enabled: false
+    asserts:
+      - hasDocuments:
+          count: 0

charts/opencloud/values.yaml

@@ -498,6 +498,8 @@ opencloud:
       accessMode: ReadWriteOnce
   # Migration configuration for migrating credentials from legacy config PVC to new secrets
   migration:
+    # Enable credential migration job on chart upgrades.
+    enabled: true
     # Name of the legacy config PVC to read credentials from.
     # Defaults to "<fullname>-config" if not set.
     configPvcClaimName: ""