kubernetes-sigs/cluster-api-provider-aws

AWSClusterRoleIdentity can be deleted when its still referenced

Open

#2,371 opened on Apr 23, 2021

View on GitHub
 (23 comments) (7 reactions) (1 assignee)Go (689 forks)auto 404
help wantedkind/backportkind/buglifecycle/frozenneeds-triagepriority/backlogpriority/important-soon

Repository metrics

Stars
 (723 stars)
PR merge metrics
 (PR metrics pending)

Description

/kind bug

What steps did you take and what happened: When deleting a cluster, which is using the new AWS multitenancy (https://github.com/kubernetes-sigs/cluster-api-provider-aws/pull/2253) CR AWSClusterRoleIdentity referenced in AWSCuster.spec.identityRef, you can accidentally delete the Role resource and the whole deletion process will fail, because the controller doesn't know how to access the AWS API.

What did you expect to happen: AWSClusterRoleIdentity would have finalizer set on to prevent deletion ( or ownerReferences: to block deletion), until there is no identity reference on it (no AWSCluster is pointing to it)

Anything else you would like to add: I have not tested this with AWSClusterStaticIdentity and AWSClusterControllerIdentity but there could be similar behavior

Environment:

  • Cluster-api-provider-aws version: 0.6.5
  • Kubernetes version: (use kubectl version): 1.19.8

Contributor guide

Research direction
Tech stack
Domain
Issue type
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
Prerequisites
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.