erdii

impersonate-nobody

Example to quickly test who gets impersonated when an empty string is supplied as the user id and an empty list is supplied as groups in restConfig.Impersonate of a controller-runtime client.

# create kind cluster
export KIND_EXPERIMENTAL_PROVIDER=podman
kind create cluster

# run code

erdii

apiVersion: package-operator.run/v1alpha1
kind: Package
metadata:
  name: my-nginx
spec:
  image: quay.io/erdii-test/nginx-package:e9e4e0e
---
apiVersion: package-operator.run/v1alpha1
kind: ObjectSet
metadata:

erdii

  {{ $startLevel := .Site.Params.tocStartLevel | default 2 }}
  {{ $endLevel := .Site.Params.tocEndLevel | default 3 }}
  {{ $tagRe := printf "h[%d-%d]" $startLevel $endLevel }}
  {{ $tocRe := printf "<%s.*?>(.|\n])+?</%s>" $tagRe $tagRe }}
  {{ $headers := findRE $tocRe .Content   }}
  <nav id="TableOfContents">
    <ul>
      <li class="nav-h0"><a href="#page-top">{{.Title}}</a></li>
      {{ range $headers }}
        {{ $tagname := substr . 1 2 }}

erdii

package controllers

import (
	"k8s.io/apimachinery/pkg/runtime/schema"

	corev1alpha1 "package-operator.run/apis/core/v1alpha1"
)

type ControllerOfLookupKey struct {
	schema.GroupKind

erdii

TL;DR the orphan finalizer only ensures that children become orphans. Depending on the orphan finalizer being present during deletion/teardown is racy when there are other finalizers on the same object.

Orphaning deletion adds the orphan finalizer during deletion to ensure that all ownerReferences pointing to this object will be removed BEFORE the object gets deleted.
After all children had their ownerReferences removed, the orphan finalizer gets removed to unblock deletion of the parent object. This means that if the parent has another finalizer and someone watches the parent they:

• Will probably see the orphan finalizer being added on deletion and then removed again afterwards.
• Are not guaranteed to see the orphan finalizer on the deleted object at all.

An illustrated example:

1. create parent configmap: kubectl apply -f parent.yaml

erdii

apiVersion: route.openshift.io/v1
kind: Route
metadata:
  name: proxy
  namespace: default
spec:
  to:
    kind: Service
    name: proxy
---

erdii

package playground

import (
	"errors"
	"fmt"
	"testing"

	"github.com/stretchr/testify/assert"
)

erdii

package dev

import (
	"context"
	"fmt"

	corev1 "k8s.io/api/core/v1"
	"k8s.io/apimachinery/pkg/api/errors"
	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"

erdii

#!/bin/bash
set -euxo pipefail

PKO_NAMESPACE="package-operator-system"
PKO_POD_SELECTOR="app.kubernetes.io/name=package-operator"
PKO_COS_SELECTOR="package-operator.run/package=package-operator"

# get rid of currently running PKO
kubectl delete deploy -n "$PKO_NAMESPACE" package-operator-manager

erdii

package retry

import (
	"context"
	"fmt"
	"time"

	"github.com/go-logr/logr"
)