Fix reconcile of deleted resources in namespaced mode #69
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
The predicate function for Delete events of the lockedresources reconciler assumes the client is a cluster scoped client with permissions to Get Namespace resources. If the call to get a Namespace fails, the deleted resources will not be reconciled. This commit fixes that by trying to reconcile the deleted resource even if the call to get the Namespace fails. This causes no problems as the k8s API will deny any create/update operation in a Namespace that's marked for termination (which was the original intention of the failing code)
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There is a bug when using the locked resources controller where deleted resources are never reconciled. This occurs because the predicate for deletion events has code that checks if the Namespace of the deleted resource is in the process of being terminated. This only works when the reconciler is used with cluster scoped permissions. The current code returns false if an error occurs trying to retrieve the Namespace, which leads to the resources never being reconciled again. This could be not only a permissions problem, but also a temporary unavailability of the API server.
The proposed solution is to return true, as a fallback, if the get operation of the Namespace resource fails so the resource is reconciled. This is not even a problem in the case the Namespace is actually being deleted, as the api server will refuse to perform any create/update if the Namespace is being terminated.