Certain resources should be ignored once they have a deletionTimestamp

[enj]

The following resources should not be honored once they are awaiting deletion:

1. oauthclientauthorization
2. ??

xref #14978 (comment)

@openshift/security

[pweil-]

@mfojtik I believe I saw a PR from @deads2k that started addressing this

[deads2k]

@mfojtik I believe I saw a PR from @deads2k that started addressing this

I fixed up three resources in three spots for authentication, but not the large problem. oauthclientauthorizations are still outstanding.

I also fixed the GC finalizers being added to non-gc-able resources, but that doesn't stop someone (anyone with update powers) from adding more finalizers.

[adelton]

I fixed up three resources in three spots for authentication, but not the large problem. oauthclientauthorizations are still outstanding.

@deads2k, could you please point me to the change where you addressed it for those three resources, and where you think things should be addressed for oauthclientauthorization?

[enj]

@adelton see #14978

oauthclientauthorization are cluster scoped which means that they are not GC'd (as far as I know). Tracking issue: #15120

Unlike the stuff that David already fixed, oauthclientauthorizations are not secrets, and while we should add special logic to ignore them if they have a deletion timestamp, the bigger issue is they should go away if their "pointers" are invalid. #15121 is related to this as well.

HasAuthorizedClient in pkg/auth/oauth/registry/grantchecker.go around line 32 is probably where the deletion check should be added.

[openshift-bot]

Issues go stale after 90d of inactivity.

Mark the issue as fresh by commenting /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.
Exclude this issue from closing by commenting /lifecycle frozen.

If this issue is safe to close now please do so with /close.

/lifecycle stale

[openshift-bot]

Stale issues rot after 30d of inactivity.

Mark the issue as fresh by commenting /remove-lifecycle rotten.
Rotten issues close after an additional 30d of inactivity.
Exclude this issue from closing by commenting /lifecycle frozen.

If this issue is safe to close now please do so with /close.

/lifecycle rotten
/remove-lifecycle stale

[openshift-bot]

Rotten issues close after 30d of inactivity.

Reopen the issue by commenting /reopen.
Mark the issue as fresh by commenting /remove-lifecycle rotten.
Exclude this issue from closing again by commenting /lifecycle frozen.

/close

[enj]

/unassign

@stlaz @sttts @mfojtik