fix: add istio job exit and url encode (#183)

Author: togashidm

VERSION

@@ -1 +1 @@
-2.2.2-dev
+2.2.2

deployment/charts/cluster-manager/Chart.yaml

@@ -16,8 +16,8 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 2.2.2-dev
-appVersion: 2.2.2-dev
+version: 2.2.2
+appVersion: 2.2.2
 annotations:
-  revision: 0cd3c01663a670be5a52130d1a85d83cb1ec2241
-  created: "2025-10-17T20:42:42Z"
+  revision: 078544072892ea57ccedc87830ef319e2308ae60
+  created: "2025-10-20T18:20:56Z"

deployment/charts/cluster-manager/templates/configmap-m2m-credentials.yaml

@@ -33,7 +33,33 @@ data:
     cleanup_sensitive_vars() {
         unset root_token VAULT_TOKEN ADMIN_PASS KC_ADMIN_TOKEN CLIENT_SECRET SA_TOKEN 2>/dev/null || true
     }
-    trap cleanup_sensitive_vars EXIT
+
+    wait_for_istio_sidecar() {
+        local max_wait=60
+        local wait_time=0
+        log "Waiting for Istio sidecar to be ready..."
+        while [ $wait_time -lt $max_wait ]; do
+            if curl -s -f http://127.0.0.1:15021/healthz/ready >/dev/null 2>&1; then
+                log "Istio sidecar is ready"
+                return 0
+            fi
+            log "Waiting for Istio sidecar... ($wait_time/$max_wait seconds)"
+            sleep 2
+            wait_time=$((wait_time + 2))
+        done
+        log "WARNING: Istio sidecar not ready after ${max_wait}s, continuing anyway"
+        return 1
+    }
+
+    # Istio sidecar shutdown function
+    shutdown_istio_sidecar() {
+        if curl -s -f http://127.0.0.1:15020/healthz/ready >/dev/null 2>&1; then
+            log "Shutting down Istio sidecar..."
+            curl -s -X POST http://127.0.0.1:15000/quitquitquit >/dev/null 2>&1 || true
+        fi
+    }
+
+    trap 'cleanup_sensitive_vars; shutdown_istio_sidecar' EXIT
 
     log() {
         echo "[$(date -Iseconds)] $*" >&2
@@ -205,10 +231,13 @@ data:
         fi
 
         local token_response=$(retry_with_backoff "getting keycloak admin token" sh -c "
-            echo 'grant_type=password&client_id=admin-cli&username=$admin_user&password=$ADMIN_PASS' | curl -s -f \
+            curl -s -f \
                 --request POST \
                 --header 'Content-Type: application/x-www-form-urlencoded' \
-                --data @- \
+                --data-urlencode 'grant_type=password' \
+                --data-urlencode 'client_id=admin-cli' \
+                --data-urlencode 'username=$admin_user' \
+                --data-urlencode 'password=$ADMIN_PASS' \
                 '$KEYCLOAK_URL/realms/master/protocol/openid-connect/token'
         ")
 
@@ -309,6 +338,8 @@ data:
     }
 
     main() {
+        wait_for_istio_sidecar
+
         if ! ensure_vault_role_and_policy; then
             log "WARNING: failed to ensure vault role/policy, continuing anyway"
         fi

deployment/charts/cluster-manager/templates/job-m2m-credentials.yaml

@@ -21,6 +21,7 @@ spec:
         app.kubernetes.io/component: credentials-m2m
     spec:
       serviceAccountName: {{ include "cluster-manager.serviceAccountName" . }}
+      terminationGracePeriodSeconds: {{ .Values.credentialsM2M.job.terminationGracePeriodSeconds | default 30 }}
       restartPolicy: Never
       securityContext:
         runAsNonRoot: true

deployment/charts/cluster-template-crd/Chart.yaml

@@ -6,8 +6,8 @@ apiVersion: v2
 name: cluster-template-crd
 description: A Helm chart for the ClusterTemplate CRD
 type: application
-version: 2.2.2-dev
-appVersion: 2.2.2-dev
+version: 2.2.2
+appVersion: 2.2.2
 annotations:
-  revision: 0cd3c01663a670be5a52130d1a85d83cb1ec2241
-  created: "2025-10-17T20:42:42Z"
+  revision: 078544072892ea57ccedc87830ef319e2308ae60
+  created: "2025-10-20T18:20:56Z"