Closed bradkwadsworth-mw closed 2 days ago
See the Usages
alpha feature to define deletion dependencies between resources: https://docs.crossplane.io/latest/concepts/usages/
See the
Usages
alpha feature to define deletion dependencies between resources: https://docs.crossplane.io/latest/concepts/usages/
I actually tried Usages, but from what I can see you cannot point it to a Connection Detail secret.
I actually tried Usages, but from what I can see you cannot point it to a Connection Detail secret.
Right - you want to point it at the MR or XR resource that creates the Connection Detail
If I set a Usage for XDatabase
which is my XR, it prevents Grants from being deleted.
cannot delete bound composite resource: admission webhook "nousages.apiextensions.crossplane.io" denied the request: This resource is in-use by 2 Usage(s), including the Usage "test-postgres-g6qlx-tv9zr" by resource Grant/test-postgres-g6qlx-b65wp
Here's one of my usages
spec:
by:
apiVersion: postgresql.sql.crossplane.io/v1alpha1
kind: Grant
resourceRef:
name: test-postgres-g6qlx-b65wp
of:
apiVersion: dbaas.idp.example.edu/v1alpha1
kind: XDatabase
resourceRef:
name: test-postgres-g6qlx
replayDeletion: true
That Usage
will block deletion of the XDatabase
resource as long as the Grant
resource exists. Once the Grant
has been deleted the XDatabase
can be deleted. If the Grant
is being created by the XDatabase
composite you probably want the Usage
to point at an MR within the composite rather than the composite itself.
What would you point to for a Connection Details secret, though? It's composed of secrets from multiple MRs and the secret is deleted as soon as the XR is deleted.
Are there MRs within the Composite that are consuming the Connection Details secret? Or are the consumers of the secret external to the XR?
The reconciler removes the ConnectionDetails as soon as the Composite is marked deleted: https://github.com/crossplane/crossplane/blob/master/internal/controller/apiextensions/composite/reconciler.go#L504
Yes, the providerconfig for the sql-provider is using the Connection Details secret for its credentials. I wonder if like providerConfigUsage, there should be a connectionDetailsUsage to determine if the secret is being referenced in any provider credentials?
I would create a Usage
that specifies the ProviderConfig
is using the base DB resource that is generating the credentials. That should block deletion of the DB resource as long as the ProviderConfig
exists and is in use.
Actually that might not help since it's the connectiondetails Secret
that is being used. You may need to create a dedicated Secret
for the ProviderConfig
to reference (and a Usage
to define the dependency), or put all of the DB instance resources into a separate composite from the ProviderConfig
and then specify the dependency between the ProviderConfig
and the DB composite.
hmm.. that may be something to think about.
@bradkwadsworth-mw were you able to resolve your use case with the dedicated Secret
approach?
I'm closing this issue for now due to inactivity, but feel free to reopen it if you feel it needs to be discussed further.
What happened?
I'm currently writing a composition that creates a GCP Cloud SQL database instance, users, databases, and connection details. I'm also creating database grants using provider-sql. After the database instance is created, a providerconfig using the connection details secret is used for the sql-provider credentials. This works as expected for creation, but on deletion of the XRD the connection detail secret is deleted before the grant resources that depend on it are removed. This leaves the grant resources hanging and erroring because its providerconfig cannot find the required secret.
How can we reproduce it?
definition.yaml
composition.yaml
example XR
What environment did it happen in?
Crossplane version: v1.15.2