Skip to content

Commit 94dc10b

Browse files
committed
feat(kubewarden-controller): Delete all CRs in pre-delete hook
On 1.36, without this change: - Deleting a PolicyServer sets its policies as scheduled. - Recommended policies are managed via Helm and removed when `kubewarden-defaults` is uninstalled. - User-managed policies will never be deleted, and linger after the removal of the CRDs, as they have finalizers. With this change: All CRs will be removed when uninstalling the `kubewarden-controller` chart. This includes charts of downstream consumers that use a single chart approach. The used image, kuberlr/kubectl, has busybox, hence `ash` as shell. Use the shell to remove all CRs. Removing all CRs in potentially all namespaces is costly; do backgrounds jobs with `&`, wait, and only then remove the policyservers. Signed-off-by: Víctor Cuadrado Juan <vcuadradojuan@suse.de>
1 parent 9ec623d commit 94dc10b

1 file changed

Lines changed: 10 additions & 1 deletion

File tree

charts/kubewarden-controller/templates/pre-delete-hook.yaml

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,16 @@ spec:
3636
containers:
3737
- name: pre-delete-job
3838
image: '{{ template "system_default_registry" . }}{{ .Values.preDeleteJob.image.repository }}:{{ .Values.preDeleteJob.image.tag }}'
39-
command: ["kubectl", "delete", "--all", "policyservers.policies.kubewarden.io"]
39+
command:
40+
- /bin/sh
41+
- -c
42+
- |
43+
kubectl delete --wait --all clusteradmissionpolicies.policies.kubewarden.io &
44+
kubectl delete --wait --all --all-namespaces admissionpolicies.policies.kubewarden.io &
45+
kubectl delete --wait --all clusteradmissionpolicygroups.policies.kubewarden.io &
46+
kubectl delete --wait --all --all-namespaces admissionpolicygroups.policies.kubewarden.io &
47+
wait &&
48+
kubectl delete --wait --all policyservers.policies.kubewarden.io
4049
env:
4150
- name: KUBERLR_ALLOWDOWNLOAD
4251
value: "1"

0 commit comments

Comments
 (0)