feat(kubewarden-controller): Delete all CRs in pre-delete hook#1774
Closed
viccuad wants to merge 1 commit into
Closed
feat(kubewarden-controller): Delete all CRs in pre-delete hook#1774viccuad wants to merge 1 commit into
viccuad wants to merge 1 commit into
Conversation
On 1.36, without this change: - Deleting a PolicyServer sets its policies as scheduled. - Recommended policies are managed via Helm and removed when `kubewarden-defaults` is uninstalled. - User-managed policies will never be deleted, and linger after the removal of the CRDs, as they have finalizers. With this change: All CRs will be removed when uninstalling the `kubewarden-controller` chart. This includes charts of downstream consumers that use a single chart approach. The used image, kuberlr/kubectl, has busybox, hence `ash` as shell. Use the shell to remove all CRs. Removing all CRs in potentially all namespaces is costly; do backgrounds jobs with `&`, wait, and only then remove the policyservers. Signed-off-by: Víctor Cuadrado Juan <vcuadradojuan@suse.de>
github-project-automation
Bot
moved this to Pending review
in Kubewarden Admission Controller
viccuad
commented
May 27, 2026
| - /bin/sh | ||
| - -c | ||
| - | | ||
| kubectl delete --wait --all clusteradmissionpolicies.policies.kubewarden.io & |
Member
Author
There was a problem hiding this comment.
We used to not have the waits. It may be better to remove them.
Contributor
There was a problem hiding this comment.
Pull request overview
This PR updates the kubewarden-controller Helm chart’s pre-delete hook job to delete all Kubewarden policy-related Custom Resources (across cluster and all namespaces where applicable) before deleting PolicyServer resources, to prevent CRs with finalizers from lingering after uninstall.
Changes:
- Replace the pre-delete hook’s single
kubectl deleteinvocation with a shell script that deletesClusterAdmissionPolicy*andAdmissionPolicy*resources in parallel. - Add a
waitbarrier so policy resources are deleted before deletingPolicyServerresources.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+47
to
+48
| wait && | ||
| kubectl delete --wait --all policyservers.policies.kubewarden.io |
Comment on lines
+43
to
+48
| kubectl delete --wait --all clusteradmissionpolicies.policies.kubewarden.io & | ||
| kubectl delete --wait --all --all-namespaces admissionpolicies.policies.kubewarden.io & | ||
| kubectl delete --wait --all clusteradmissionpolicygroups.policies.kubewarden.io & | ||
| kubectl delete --wait --all --all-namespaces admissionpolicygroups.policies.kubewarden.io & | ||
| wait && | ||
| kubectl delete --wait --all policyservers.policies.kubewarden.io |
jvanz
reviewed
May 27, 2026
Member
jvanz
left a comment
jvanz
left a comment
There was a problem hiding this comment.
Overall, LGTM. But I think that copilot comments are good suggestions.
Member
|
closing as discussed during the daily |
github-project-automation
Bot
moved this from Pending review
to Done
in Kubewarden Admission Controller
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
On 1.36, without this change:
kubewarden-defaultsis uninstalled.With this change:
All CRs will be removed when uninstalling the
kubewarden-controllerchart. This includes charts of downstream consumers that use a single chart approach.The used image, kuberlr/kubectl, has busybox, hence
ashas shell. Use the shell to remove all CRs. Removing all CRs in potentially all namespaces is costly; do backgrounds jobs with&, wait, and only then remove the policyservers.Test
Tested locally by deploying charts with recommended policies, a user-managed policy and policy server, and uninstalling the charts one by one.
Additional Information
Tradeoff
Potential improvement
Checklist