fix: orphan rbac resources instead of deleting #9010
Conversation
Codecov ReportAttention: Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #9010 +/- ##
==========================================
+ Coverage 60.03% 60.20% +0.16%
==========================================
Files 390 390
Lines 46553 46675 +122
==========================================
+ Hits 27948 28099 +151
+ Misses 15909 15883 -26
+ Partials 2696 2693 -3
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
| } | ||
| graphCli model.GraphClient, dag *graph.DAG, matchLabels map[string]string) (err error) { | ||
| // orphan a rbac resource so that it can be adopted by another component | ||
| // this means these resources won't get automatically deleted |
There was a problem hiding this comment.
What is the proper cleanup method to delete these resources? Without implementing a cleanup strategy, resource remnants will persist. For instance, when users attempt to delete namespaces or perform similar cleanup operations, the process will be blocked due to these lingering resources.
There was a problem hiding this comment.
No, it won't. Only when there's a finalizer existing in the resource, can it block the deletion process. Otherwise, resources will be automatically deleted when a namespace is deleted.
There was a problem hiding this comment.
No, it won't. Only when there's a finalizer existing in the resource, can it block the deletion process. Otherwise, resources will be automatically deleted when a namespace is deleted.
Oh, I see you've removed the finalizer. Perhaps later we could consider adding a new controller to manage resources at the namespace level.
fixes #8941. Specifically, this PR tries to fix a stale read condition described in #8941 (comment)
One drawback is rbac resource won't be automactically cleaned up.