carvel-dev / carvel-dev/kapp-controller

Enable kapp-controller to delete App when namespace is deleted

Open
#1,132 8 comments 6 reactions 1 assignee Claimed by @praveenrewar View on GitHub
carvel-accepted enhancement
Dominant language
Go
Stars
323
Forks
127
Avg merge
2d 16h
Merged PRs (30d)
4

Description

**Description**
Deleting namespace gets stuck in `Terminating` state as kapp-controller won't delete an application without valid service account

**What steps did you take:**

* Created a minikube cluster on local machine (I used k8s version `1.26.1`)
* Installed kapp-controller using:
```
kubectl apply -f https://github.com/carvel-dev/kapp-controller/releases/download/v0.44.6/release.yml
```
* Create a `dev` namespace
```
kubectl create ns dev
```
* Create a sample config map to use later while creating an app, and a serviceaccount and rolebindings
```
kubectl apply -f https://raw.githubusercontent.com/atmandhol/tap-nsp-gitops/main/random/app/app-permissions.yaml
kubectl apply -f https://raw.githubusercontent.com/atmandhol/tap-nsp-gitops/main/random/app/app-config.yaml
```
* Create an `App`
```
kubectl apply -f https://raw.githubusercontent.com/atmandhol/tap-nsp-gitops/main/random/app/app.yaml
```
I now have an `App` that is successfully deployed.

Next, I attempt deletion of the namespace as I no longer need it
```
kubectl delete ns dev
```

**What happened:**
When I ran the delete command
* ServiceAccount `default-ns-sa` that I was using for the app is deleted as part of the namespace deletion
* Namespace `dev` gets stuck in the `Terminating` state until the `App` is deleted.
* `App` gets stuck and fails to delete with the following error
```
Preparing kapp: Getting service account: serviceaccounts "default-ns-sa" not found
```

**What did you expect:**
If the namespace in which the `App` resides is in `Terminating` state, kapp-controller should delete the `App` and should not need the `ServiceAccount` that the `App` was using as the user/some process is clearly signaling that it is not needed (because user/some process deleted the namespace).

**Anything else you would like to add:**
In large scale kubernetes deployments where there are developer portals or some automated processes that creates and deletes namespaces for users, It's not going to be feasible for operators to manually inspect namespaces and delete all existing `Apps` before deleting the namespace itself.

**Environment:**

- kapp Controller version `0.44.6`
- Kubernetes version `1.26.1`

---
Vote on this request

This is an invitation to the community to vote on issues, to help us prioritize our backlog. Use the "smiley face" up to the right of this comment to vote.

👍 "I would like to see this addressed as soon as possible"
👎 "There are other more important things to focus on right now"

We are also happy to receive and review Pull Requests if you want to help working on this issue.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.