[kubernetes] Cleanup loadbalancer services by lllamnyp · Pull Request #1631 · cozystack/cozystack

Timofei Larkin (lllamnyp) · 2025-11-13T13:30:07Z

What this PR does

Similar to an earlier issue with DataVolumes remaining after deleting the tenant k8s cluster using them, a similar problem is observed with LoadBalancer services consuming external IPs. This patch adds another step to the cleanup Helm hook to delete any such services.

Release note

[kubernetes] Add a cleanup hook to delete LoadBalancer services after
deleting the tenant Kubernetes cluster that they were servicing.

Summary by CodeRabbit

New Features
- Added automatic cleanup of LoadBalancer services during resource deletion workflows.
Chores
- Updated resource naming conventions for consistency.
- Extended service management permissions in access control configurations.

## What this PR does Similar to an earlier issue with DataVolumes remaining after deleting the tenant k8s cluster using them, a similar problem is observed with LoadBalancer services consuming external IPs. This patch adds another step to the cleanup Helm hook to delete any such services. ### Release note ```release-note [kubernetes] Add a cleanup hook to delete LoadBalancer services after deleting the tenant Kubernetes cluster that they were servicing. ``` Signed-off-by: Timofei Larkin <lllamnyp@gmail.com>

gemini-code-assist · 2025-11-13T13:30:23Z

Summary of Changes

Hello Timofei Larkin (@lllamnyp), I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request implements a critical cleanup enhancement for Kubernetes deployments managed via Helm. It introduces a new step in the post-deletion lifecycle to automatically remove LoadBalancer services that would otherwise remain orphaned after a tenant Kubernetes cluster is decommissioned. This prevents the accumulation of unused external IP addresses and ensures more efficient resource management.

Highlights

Issue Resolution: Addresses the problem of LoadBalancer services persisting after tenant Kubernetes cluster deletion, preventing resource leakage (e.g., external IPs).
Helm Hook Enhancement: Extends the existing Helm post-delete hook to include a step for deleting LoadBalancer services.
Resource Renaming & Scope Broadening: Renames the cleanup Job, ServiceAccount, Role, and RoleBinding from "-datavolume-cleanup" to "-cleanup" and moves the delete.yaml file, indicating a more generalized cleanup mechanism.
Permissions Update: Updates the associated Kubernetes Role to grant necessary permissions (get, list, delete) for services resources.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	`/gemini review`	Performs a code review for the current pull request in its current state.
Pull Request Summary	`/gemini summary`	Provides a summary of the current pull request in its current state.
Comment	Gemini (@gemini-code-assist)	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	`/gemini help`	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on Gemini (@gemini-code-assist) comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

coderabbitai · 2025-11-13T13:30:23Z

Walkthrough

This pull request modifies the Kubernetes delete template to rename cleanup resources from datavolume-cleanup to cleanup and extends RBAC permissions to enable deletion of LoadBalancer services during post-delete operations.

Changes

Cohort / File(s)	Summary
Kubernetes Cleanup Template `packages/apps/kubernetes/templates/delete.yaml`	Renames resources and service account from `datavolume-cleanup` to `cleanup`; adds kubectl delete command for LoadBalancer services; extends RBAC rules with get/list/delete permissions on services resource.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10–15 minutes

Verify kubectl delete services syntax and label selector correctness
Confirm RBAC rules align with service deletion requirements
Check consistency of renamed references across all resource sections (ServiceAccount, RoleBinding, Role)

Suggested labels

enhancement, size:L

Suggested reviewers

kvaps
nbykov0

Poem

🐰 The cleanup dance now spans so wide,
Services deleted with proper pride,
Permissions granted, names aligned,
Post-delete flows perfectly refined! 🧹✨

Pre-merge checks and finishing touches

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title directly and clearly summarizes the main change: adding cleanup logic for LoadBalancer services in Kubernetes templates.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Post copyable unit tests in a comment
Commit unit tests in branch fix/cleanup-tenant-k8s-lb

📜 Recent review details

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 2b4afde and 1651d94.

📒 Files selected for processing (1)

packages/apps/kubernetes/templates/delete.yaml (5 hunks)

🧰 Additional context used

🧠 Learnings (1)

📚 Learning: 2025-10-13T16:47:33.093Z

Learnt from: lllamnyp
Repo: cozystack/cozystack PR: 1515
File: packages/system/lineage-controller-webhook/templates/rbac.yaml:1-8
Timestamp: 2025-10-13T16:47:33.093Z
Learning: The lineage-controller-webhook requires wildcard read permissions (apiGroups: ['*'], resources: ['*'], verbs: ["get", "list", "watch"]) because it must traverse entire ownership chains via ownerReferences, which can include any resource type, including third-party CRDs like kubevirt's VirtualMachineInstance.

Applied to files:

packages/apps/kubernetes/templates/delete.yaml

🪛 YAMLlint (1.37.1)

packages/apps/kubernetes/templates/delete.yaml

[error] 9-9: syntax error: expected , but found ''

(syntax)

⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)

GitHub Check: Build

🔇 Additional comments (3)

packages/apps/kubernetes/templates/delete.yaml (3)

31-34: Verify LoadBalancer service cleanup logic.

The --field-selector spec.type=LoadBalancer filter correctly targets only LoadBalancer services. Confirm that this selector syntax is compatible with your Kubernetes API version, particularly if using field selectors with nested spec fields.

64-71: RBAC additions are appropriate.

The extension of Role rules to grant get, list, and delete verbs on services (core API group) is correctly scoped and necessary to enable the new LoadBalancer service cleanup during post-delete operations.

9-9: Naming consistency: datavolume-cleanup → cleanup.

All references have been consistently renamed across metadata, serviceAccountName, Role, RoleBinding, and subject definitions. This improves clarity of the cleanup job's broader scope (now handling both DataVolumes and LoadBalancer services, not just DataVolumes).

Also applies to: 13-13, 41-41, 54-54, 80-80, 84-84, 87-87

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

gemini-code-assist

Code Review

The pull request effectively addresses the issue of LoadBalancer services persisting after cluster deletion by extending the existing Helm post-delete hook. The renaming of the cleanup resources from "datavolume-cleanup" to a more generic "cleanup" is a good step towards making this hook more versatile. The addition of the kubectl delete services command with the appropriate field selector and the corresponding RBAC permissions are correctly implemented, ensuring proper cleanup of resources.

github-actions · 2025-11-13T14:17:10Z

Successfully created backport PR for release-0.37:

[Backport release-0.37] [kubernetes] Cleanup loadbalancer services #1632

…1632) # Description Backport of #1631 to `release-0.37`.

Timofei Larkin (lllamnyp) requested review from Andrei Kvapil (kvaps) and Nikita (nbykov0) as code owners November 13, 2025 13:30

dosubot Bot added the size/S This PR changes 10-29 lines, ignoring generated files label Nov 13, 2025

Timofei Larkin (lllamnyp) added backport Should change be backported on previous release and removed size/S This PR changes 10-29 lines, ignoring generated files labels Nov 13, 2025

dosubot Bot added the kind/bug Categorizes issue or PR as related to a bug label Nov 13, 2025

gemini-code-assist Bot reviewed Nov 13, 2025

View reviewed changes

dosubot Bot added the size/S This PR changes 10-29 lines, ignoring generated files label Nov 13, 2025

Andrei Kvapil (kvaps) approved these changes Nov 13, 2025

View reviewed changes

dosubot Bot added the lgtm This PR has been approved by a maintainer label Nov 13, 2025

Timofei Larkin (lllamnyp) enabled auto-merge November 13, 2025 13:42

Timofei Larkin (lllamnyp) merged commit a9818a7 into main Nov 13, 2025
39 of 40 checks passed

Timofei Larkin (lllamnyp) deleted the fix/cleanup-tenant-k8s-lb branch November 13, 2025 14:16

github-actions Bot mentioned this pull request Nov 13, 2025

[Backport release-0.37] [kubernetes] Cleanup loadbalancer services #1632

Merged

Timofei Larkin (lllamnyp) added a commit that referenced this pull request Nov 13, 2025

[Backport release-0.37] [kubernetes] Cleanup loadbalancer services (#…

7a261a3

…1632) # Description Backport of #1631 to `release-0.37`.

This was referenced Nov 26, 2025

Add changelogs for v0.37.* and v0.38.0 #1658

Merged

[tenant][kubernetes] Introduce better cleanup logic #1661

Merged

Navigation Menu

Uh oh!

[kubernetes] Cleanup loadbalancer services - #1631

[kubernetes] Cleanup loadbalancer services#1631
Timofei Larkin (lllamnyp) merged 1 commit into
mainfrom
fix/cleanup-tenant-k8s-lb

Timofei Larkin (lllamnyp) commented Nov 13, 2025 •

edited by coderabbitai Bot

Loading

Uh oh!

gemini-code-assist Bot commented Nov 13, 2025

Uh oh!

coderabbitai Bot commented Nov 13, 2025 •

edited

Loading

Uh oh!

gemini-code-assist Bot left a comment

Uh oh!

Uh oh!

github-actions Bot commented Nov 13, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

Timofei Larkin (lllamnyp) commented Nov 13, 2025 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What this PR does

Release note

Summary by CodeRabbit

Uh oh!

gemini-code-assist Bot commented Nov 13, 2025

Summary of Changes

Highlights

Footnotes

Uh oh!

coderabbitai Bot commented Nov 13, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Estimated code review effort

Suggested labels

Suggested reviewers

Poem

Pre-merge checks and finishing touches

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

github-actions Bot commented Nov 13, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Timofei Larkin (lllamnyp) commented Nov 13, 2025 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Nov 13, 2025 •

edited

Loading