Skip to content

Conversation

@lindnerby
Copy link
Member

@lindnerby lindnerby commented Dec 2, 2025

Description

Changes proposed in this pull request:

  • Provide usecase for the deletion of skr-webhook resources
  • Provide usecase for the deletion of the watcher cert setup (certificate and secret)

@lindnerby lindnerby requested a review from a team as a code owner December 2, 2025 09:01
@lindnerby lindnerby changed the title skr webhook deletion feat: SKR webhook & Cert setup deletion Dec 3, 2025
@lindnerby lindnerby linked an issue Dec 3, 2025 that may be closed by this pull request
3 tasks
@lindnerby lindnerby changed the title feat: SKR webhook & Cert setup deletion feat: SKR Webhook & Watcher Cert Setup Deletion Dec 3, 2025
@lindnerby lindnerby requested a review from c-pius December 3, 2025 09:33
Comment on lines 151 to 152
name: "Nothing for UseCaseDeleteWatcherCertificate",
useCase: usecase.DeleteWatcherCertificate,
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
name: "Nothing for UseCaseDeleteWatcherCertificateSetup",
useCase: usecase.DeleteWatcherCertificateSetup,

Comment on lines -573 to -578
if r.WatcherEnabled() {
if err := r.SKRWebhookManager.Remove(ctx, kyma); err != nil {
return ctrl.Result{}, err
}
}

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think this one we wanted to keep for now?

}

func (u *RemoveSkrWebhookResources) IsApplicable(ctx context.Context, kyma *v1beta2.Kyma) (bool, error) {
if kyma.DeletionTimestamp.IsZero() || kyma.Status.State != shared.StateDeleting {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In the other use cases, I only checked for the deletion timestamp, not the state. Do you think we should introduce this state check for all other use cases as well?


resourcesExist, err := u.skrWebhookResourcesRepo.ResourcesExist(kyma.Name)
if err != nil {
return false, errors.Join(err, errFailedToDetermineApplicability)
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should this rather be errors.Join(errFailedToDetermineApplicability, err)? If I am not wrong, calling Error() on the resulting error would read "err.Err() => errFailedToDetermineApplicability.Err()" so oldest to newest instead of newest to oldest.

if err != nil {
return result.Result{
UseCase: u.Name(),
Err: errors.Join(err, errFailedToRemoveSkrWebhookResources),
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

See above

resourceExists := make(chan bool, 1)

for idx := range r.resources {
resIdx := idx
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why the additional var?

Namespace: r.remoteSyncNamespace,
}

skrClient := r.skrClientCache.Get(kymaNamespacedName)
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

see comment above

errGrp, grpCtx := errgroup.WithContext(ctx)

for idx := range r.resources {
resIdx := idx
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

see comment above

Comment on lines +153 to +156
err := skrClient.Delete(grpCtx, resource)
if err != nil {
return fmt.Errorf("failed to delete resource %s: %w", ref.Name, err)
}
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think we already need to ignore not found here. If I understant the errGrp.Wait correclty, it returns the first non nill error. If we have something like:

  • err1: not found
  • err2: some real error

Then the err below is err1 and since we ignore not found there, we would miss the real error in err2.

assert.Contains(t, err.Error(), "failed to check resource")
})

t.Run("short-circuits on first found resource", func(t *testing.T) {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What is this test adding on to pof the returns true when at least one resource exists?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Implement a dedicated service for handling Kyma deprovisioning

2 participants