---
apiVersion: batch/v1
kind: Job
metadata:
  annotations:
    "helm.sh/hook": pre-delete
    "helm.sh/hook-weight": "10"
    "helm.sh/hook-delete-policy": hook-succeeded,before-hook-creation,hook-failed
  name: {{ .Release.Name }}-flux-teardown
spec:
  template:
    spec:
      serviceAccountName: {{ .Release.Name }}-flux-teardown
      restartPolicy: Never
      tolerations:
        - key: CriticalAddonsOnly
          operator: Exists
        - key: node-role.kubernetes.io/control-plane
          operator: Exists
          effect: "NoSchedule"
      containers:
        - name: kubectl
          image: docker.io/clastix/kubectl:v1.32
          command:
            - /bin/sh
            - -c
            - |
                kubectl
                --namespace={{ .Release.Namespace }}
                patch
                helmrelease
                {{ .Release.Name }}-cilium
                {{ .Release.Name }}-gateway-api-crds
                {{ .Release.Name }}-csi
                {{ .Release.Name }}-cert-manager
                {{ .Release.Name }}-cert-manager-crds
                {{ .Release.Name }}-vertical-pod-autoscaler
                {{ .Release.Name }}-vertical-pod-autoscaler-crds
                {{ .Release.Name }}-ingress-nginx
                {{ .Release.Name }}-fluxcd-operator
                {{ .Release.Name }}-fluxcd
                {{ .Release.Name }}-gpu-operator
                -p '{"spec": {"suspend": true}}'
                --type=merge --field-manager=flux-client-side-apply || true
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: {{ .Release.Name }}-flux-teardown
  annotations:
    helm.sh/hook: pre-delete
    helm.sh/hook-delete-policy: before-hook-creation,hook-failed
    helm.sh/hook-weight: "0"
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  annotations:
    "helm.sh/hook": pre-install,post-install,pre-delete
    "helm.sh/hook-delete-policy": hook-succeeded,before-hook-creation,hook-failed
    "helm.sh/hook-weight": "5"
  name: {{ .Release.Name }}-flux-teardown
rules:
  - apiGroups:
      - "helm.toolkit.fluxcd.io"
    resources:
      - helmreleases
    verbs:
      - get
      - patch
    resourceNames:
      - {{ .Release.Name }}-cilium
      - {{ .Release.Name }}-csi
      - {{ .Release.Name }}-cert-manager
      - {{ .Release.Name }}-cert-manager-crds
      - {{ .Release.Name }}-vertical-pod-autoscaler
      - {{ .Release.Name }}-vertical-pod-autoscaler-crds
      - {{ .Release.Name }}-ingress-nginx
      - {{ .Release.Name }}-fluxcd-operator
      - {{ .Release.Name }}-fluxcd
      - {{ .Release.Name }}-gpu-operator
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  annotations:
    helm.sh/hook: pre-delete
    helm.sh/hook-delete-policy: hook-succeeded,before-hook-creation,hook-failed
    helm.sh/hook-weight: "5"
  name: {{ .Release.Name }}-flux-teardown
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: {{ .Release.Name }}-flux-teardown
subjects:
  - kind: ServiceAccount
    name: {{ .Release.Name }}-flux-teardown
    namespace: {{ .Release.Namespace }}
