Bug 1765294: Use OwnerRefs to clean up SA pull secrets #61
Conversation
openshift-ci-robot
added
do-not-merge/work-in-progress
|
@adambkaplan: This pull request references Bugzilla bug 1765294, which is valid. The bug has been moved to the POST state. The bug has been updated to refer to the pull request using the external bug tracker. In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
openshift-ci-robot
added
size/L
|
/test e2e-aws-builds |
adambkaplan
force-pushed
the
pull-secret-use-ownerrefs
branch
from
42b2649
to
3d24283
Compare
|
/test e2e-aws-builds |
adambkaplan
changed the title
openshift-ci-robot
removed
the
do-not-merge/work-in-progress
|
/assign @bparees |
adambkaplan
force-pushed
the
pull-secret-use-ownerrefs
branch
from
3d24283
to
7455a42
Compare
| Name: tokenSecret.Name, | ||
| UID: tokenSecret.UID, | ||
| }, | ||
| }) |
There was a problem hiding this comment.
@deads2k are you aware of any reason we wouldn't want to have ownerrefs between the dockercfg secret and the token secret? I'm sure we didn't do it originally because ownerrefs didn't exist, but now that they do can we just lifecycle the dockercfg secret w/ the tokensecret? (modulo migration concerns)
|
lgtm assuming @deads2k doesn't have a reason why it's not ok to use GC here. |
adambkaplan
force-pushed
the
pull-secret-use-ownerrefs
branch
from
7455a42
to
13b5462
Compare
|
/test e2e-aws-builds |
|
/retest |
1 similar comment
|
/retest |
|
/retest I suspect the errors in |
|
/test e2e-aws-builds |
adambkaplan
force-pushed
the
pull-secret-use-ownerrefs
branch
from
5395f2b
to
938624a
Compare
|
my review stands: |
|
/retest ping @deads2k per #61 (comment) |
|
|
||
| // hasOwnerReference checks if the given tokenSecret is the owner of the provided pullSecret | ||
| func hasOwnerReference(tokenSecret, pullSecret *v1.Secret) bool { | ||
| for _, owner := range pullSecret.OwnerReferences { |
There was a problem hiding this comment.
i think there is upstream helper that does this in generic way
There was a problem hiding this comment.
@mfojtik I found the functions in https://github.com/kubernetes/apimachinery/blob/master/pkg/apis/meta/v1/controller_ref.go. Works -ish - I need to set blockOwnerDeletion to false, otherwise I need additional RBAC permissions.
adambkaplan
changed the title
openshift-ci-robot
added
the
do-not-merge/work-in-progress
|
/retest |
Update the service account pull secret controller to add owner references to generated pull secrets. This ensures pull secrets are deleted when the associated token is deleted.
adambkaplan
force-pushed
the
pull-secret-use-ownerrefs
branch
from
1c3dff5
to
2d3371c
Compare
adambkaplan
changed the title
openshift-ci-robot
removed
the
do-not-merge/work-in-progress
|
/retest AWS rate limit issues |
|
/lgtm |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: adambkaplan, bparees The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
@adambkaplan: All pull requests linked via external trackers have merged. Bugzilla bug 1765294 has been moved to the MODIFIED state. In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
|
/cherrypick release-4.4 /cherrypick release-4.3 |
|
@adambkaplan: new pull request created: #67 In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
|
/cherrypick release-4.3 |
|
@adambkaplan: new pull request created: #68 In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
Update the service account pull secret controller to add owner
references to generated pull secrets. This ensures pull secrets are
deleted when the associated token is deleted.