up

Author: mitchross

CLAUDE.md

@@ -523,6 +523,11 @@ PVC populated from last backup
    - Automatically injects NFS volume into VolSync mover jobs
    - No manual NFS configuration needed per app
 
+3. **volsync-orphan-cleanup.yaml** - Orphan resource cleanup (ClusterCleanupPolicy)
+   - Runs every 15 minutes
+   - Deletes orphaned ReplicationSource, ReplicationDestination, ExternalSecret when backup label is removed from PVC or PVC is deleted
+   - Prevents stale backup/restore jobs from running after disabling backups
+
 ### PVC Plumber Service
 
 **Purpose**: Checks Kopia repository for existing backups before PVC creation

infrastructure/controllers/kyverno/kustomization.yaml

@@ -6,6 +6,7 @@ resources:
 - rbac-patch.yaml
 - policies/volsync-pvc-backup-restore.yaml
 - policies/volsync-nfs-inject.yaml
+- policies/volsync-orphan-cleanup.yaml
 helmCharts:
 - name: kyverno
   repo: https://kyverno.github.io/kyverno

infrastructure/controllers/kyverno/policies/volsync-orphan-cleanup.yaml

@@ -0,0 +1,58 @@
+---
+apiVersion: kyverno.io/v2
+kind: ClusterCleanupPolicy
+metadata:
+  name: volsync-orphan-cleanup
+  annotations:
+    argocd.argoproj.io/sync-wave: "4"
+    policies.kyverno.io/title: VolSync Orphan Resource Cleanup
+    policies.kyverno.io/description: >-
+      Cleans up orphaned VolSync backup resources when the backup label is removed
+      from the corresponding PVC or the PVC no longer exists. Runs every 15 minutes.
+      Targets resources generated by the volsync-pvc-backup-restore policy
+      (identified by app.kubernetes.io/managed-by=kyverno and volsync.backup/pvc labels).
+spec:
+  schedule: "*/15 * * * *"
+  match:
+    any:
+      - resources:
+          kinds:
+            - ReplicationSource
+            - ReplicationDestination
+          selector:
+            matchExpressions:
+              - key: app.kubernetes.io/managed-by
+                operator: In
+                values: ["kyverno"]
+              - key: volsync.backup/pvc
+                operator: Exists
+      - resources:
+          kinds:
+            - ExternalSecret
+          selector:
+            matchExpressions:
+              - key: app.kubernetes.io/managed-by
+                operator: In
+                values: ["kyverno"]
+              - key: volsync.backup/pvc
+                operator: Exists
+  exclude:
+    any:
+      - resources:
+          namespaces:
+            - kube-system
+            - volsync-system
+            - kyverno
+  context:
+    - name: pvcName
+      variable:
+        jmesPath: 'target.metadata.labels."volsync.backup/pvc"'
+    - name: pvcBackupLabel
+      apiCall:
+        urlPath: "/api/v1/namespaces/{{target.metadata.namespace}}/persistentvolumeclaims"
+        jmesPath: "items[?metadata.name=='{{pvcName}}'].metadata.labels.backup | [0] || ''"
+  conditions:
+    all:
+      - key: "{{ pvcBackupLabel }}"
+        operator: NotIn
+        values: ["hourly", "daily"]

infrastructure/controllers/kyverno/values.yaml

@@ -62,6 +62,36 @@ cleanupController:
     requests:
       cpu: 100m
       memory: 64Mi
+  rbac:
+    clusterRole:
+      extraResources:
+      - apiGroups:
+        - ""
+        resources:
+        - persistentvolumeclaims
+        verbs:
+        - get
+        - list
+        - watch
+      - apiGroups:
+        - volsync.backube
+        resources:
+        - replicationsources
+        - replicationdestinations
+        verbs:
+        - get
+        - list
+        - watch
+        - delete
+      - apiGroups:
+        - external-secrets.io
+        resources:
+        - externalsecrets
+        verbs:
+        - get
+        - list
+        - watch
+        - delete
 
 reportsController:
   replicas: 1