Skip to content

fix(kubernetes): delete orphaned resources in new post-delete job - #3856

Open
Ray Low (crossRT) wants to merge 1 commit into
cozystack:mainfrom
crossRT:delete-k8s-orphaned-resources
Open

fix(kubernetes): delete orphaned resources in new post-delete job#3856
Ray Low (crossRT) wants to merge 1 commit into
cozystack:mainfrom
crossRT:delete-k8s-orphaned-resources

Conversation

@crossRT

@crossRT Ray Low (crossRT) commented Aug 16, 2026 •
edited by coderabbitai Bot
Loading

Copy link
Copy Markdown

What this PR does

When tenant deletes the kubernetes cluster, 2 resources are orphaned and leftover in the tenant namespace.

  • jobs/-oidc-bootstrap
  • secrets/-talos-ca
  • secrets/-talos-tls-cert

This PR adds a new post-delete cleanup job and delete these resources manually.

Downstream repositories

Release note

fix(kubernetes): Fixed the `<name>-talos-ca` and `<name>-talos-tls-cert` Secrets and the `<name>-oidc-bootstrap` Job being left in the tenant namespace after a Kubernetes cluster is deleted.

Summary by CodeRabbit

  • New Features

    • Added automatic cleanup after application deletion.
    • Removes orphaned Talos PKI Secrets and the OIDC bootstrap Job.
    • Cleanup runs securely with restricted permissions and non-root execution.

  • Tests

    • Added coverage verifying cleanup ordering, targeted resource deletion, permissions, and service account usage.

@crossRT
fix(kubernetes): delete orphaned resources (Talos certificate secrets…
7403aec 
… and oidc-bootstrap job) in new post-delete cleanup
@github-actions github-actions Bot added size/L This PR changes 100-499 lines, ignoring generated files area/kubernetes Issues or PRs related to the tenant Kubernetes app kind/bug Categorizes issue or PR as related to a bug labels Aug 16, 2026
@coderabbitai

coderabbitai Bot commented Aug 16, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Review Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: bbd2f5d0-f1ed-461e-b4ad-50aaaa99f02e

📥 Commits

Reviewing files that changed from the base of the PR and between 9e3f66f and 7403aec.

📒 Files selected for processing (2)
  • packages/apps/kubernetes/templates/post-delete.yaml
  • packages/apps/kubernetes/tests/post_delete_cleanup_test.yaml

Included review availability: Your plan includes up to 8 reviews per rolling hour; 6 remain after this review.

📝 Walkthrough

Walkthrough

The Helm chart adds a post-delete cleanup Job with dedicated RBAC resources. The Job deletes orphaned Talos PKI Secrets and the OIDC bootstrap Job. Helm tests verify hook annotations, cleanup commands, resource restrictions, and ServiceAccount wiring.

Changes

Post-delete cleanup

Layer / File(s) Summary
Cleanup hook execution
packages/apps/kubernetes/templates/post-delete.yaml		 The chart adds a post-delete Job that uses a restricted kubectl container to delete release-specific Talos Secrets and the OIDC bootstrap Job.
Cleanup access and validation
packages/apps/kubernetes/templates/post-delete.yaml, packages/apps/kubernetes/tests/post_delete_cleanup_test.yaml		 The chart adds a dedicated ServiceAccount, namespaced Role, and RoleBinding. Tests verify hook placement, cleanup commands, restricted permissions, and ServiceAccount wiring.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Merge Risk: 🟡 Moderate · up to 7403a

The new cleanup job may lose its ServiceAccount and permissions before it starts, leaving the targeted Kubernetes resources orphaned and making the fix ineffective. This should be corrected before merging.

Sequence Diagram(s)

sequenceDiagram
  participant Helm
  participant CleanupJob
  participant KubernetesAPI
  Helm->>CleanupJob: Run post-delete hook
  CleanupJob->>KubernetesAPI: Delete Talos Secrets and OIDC bootstrap Job
  KubernetesAPI-->>CleanupJob: Return success or missing-resource status
Loading

Possibly related PRs

Suggested labels: area/testing

Suggested reviewers: ivanhunters

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly and concisely describes the main change: adding a Kubernetes post-delete job to remove orphaned resources.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@coderabbitai coderabbitai Bot mentioned this pull request Aug 19, 2026
Open
11 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@IvanHunters IvanHunters Awaiting requested review from IvanHunters IvanHunters is a code owner
@kvaps Andrei Kvapil (kvaps) Awaiting requested review from kvaps kvaps is a code owner
@myasnikovdaniil myasnikovdaniil Awaiting requested review from myasnikovdaniil myasnikovdaniil is a code owner
@lexfrei Aleksei Sviridkin (lexfrei) Awaiting requested review from lexfrei lexfrei is a code owner
@lllamnyp Timofei Larkin (lllamnyp) Awaiting requested review from lllamnyp lllamnyp is a code owner

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

area/kubernetes Issues or PRs related to the tenant Kubernetes app kind/bug Categorizes issue or PR as related to a bug size/L This PR changes 100-499 lines, ignoring generated files

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@crossRT