Ensure that holder-update DaemonSet pods are restarted on script changes

We add the script's md5sum as an annotation to the DaemonSet pod
template to force Kubernetes to recreate the pods when we modify the
script.

Additionally, we set `sync-wave=10` for the DaemonSet to ensure that the
ConfigMap changes are synced before the checksum annotation on the
DaemonSet is updated.

component/restart-holder-ds.libsonnet

@@ -89,11 +89,19 @@ local daemonset = kube.DaemonSet('syn-holder-updater') {
         'non-daemonset pods are running on the node) and then deletes any ' +
         'outdated csi holder pods. Outdated holder pods are identified by ' +
         'comparing the DaemonSet generation with the pod generation.',
+      // set sync wave 10 for the daemonset to ensure that the ConfigMap is
+      // updated first.
+      'argocd.argoproj.io/sync-wave': '10',
     },
     namespace: params.namespace,
   },
   spec+: {
     template+: {
+      metadata+: {
+        annotations+: {
+          'script-checksum': std.md5(script),
+        },
+      },
       spec+: {
         serviceAccountName: serviceaccount.metadata.name,
         containers_: {

tests/golden/cephfs/rook-ceph/rook-ceph/50_restart_holder_ds.yaml

@@ -103,6 +103,7 @@ apiVersion: apps/v1
 kind: DaemonSet
 metadata:
   annotations:
+    argocd.argoproj.io/sync-wave: '10'
     syn.tools/description: DaemonSet which waits for node to be drained (by waiting
       until no non-daemonset pods are running on the node) and then deletes any outdated
       csi holder pods. Outdated holder pods are identified by comparing the DaemonSet
@@ -123,7 +124,8 @@ spec:
       name: syn-holder-updater
   template:
     metadata:
-      annotations: {}
+      annotations:
+        script-checksum: 488da91788ef6e501cece9d3d67ff8b0
       labels:
         app.kubernetes.io/component: rook-ceph
         app.kubernetes.io/managed-by: commodore

tests/golden/defaults/rook-ceph/rook-ceph/50_restart_holder_ds.yaml

@@ -103,6 +103,7 @@ apiVersion: apps/v1
 kind: DaemonSet
 metadata:
   annotations:
+    argocd.argoproj.io/sync-wave: '10'
     syn.tools/description: DaemonSet which waits for node to be drained (by waiting
       until no non-daemonset pods are running on the node) and then deletes any outdated
       csi holder pods. Outdated holder pods are identified by comparing the DaemonSet
@@ -123,7 +124,8 @@ spec:
       name: syn-holder-updater
   template:
     metadata:
-      annotations: {}
+      annotations:
+        script-checksum: 488da91788ef6e501cece9d3d67ff8b0
       labels:
         app.kubernetes.io/component: rook-ceph
         app.kubernetes.io/managed-by: commodore

tests/golden/openshift4/rook-ceph/rook-ceph/50_restart_holder_ds.yaml

@@ -103,6 +103,7 @@ apiVersion: apps/v1
 kind: DaemonSet
 metadata:
   annotations:
+    argocd.argoproj.io/sync-wave: '10'
     syn.tools/description: DaemonSet which waits for node to be drained (by waiting
       until no non-daemonset pods are running on the node) and then deletes any outdated
       csi holder pods. Outdated holder pods are identified by comparing the DaemonSet
@@ -123,7 +124,8 @@ spec:
       name: syn-holder-updater
   template:
     metadata:
-      annotations: {}
+      annotations:
+        script-checksum: 488da91788ef6e501cece9d3d67ff8b0
       labels:
         app.kubernetes.io/component: rook-ceph
         app.kubernetes.io/managed-by: commodore