Kubernetes controller for multi-tenancy. It propagates resources between namespaces accurately and allows tenant users to create/delete sub-namespaces.
If a client is allowed to delete a SubNamespace where the sub-namespace has child namespaces, the controller becomes stuck on the finalization of the SubNamespace. The controller will not be allowed to delete the sub-namespaces by our namespace webhook.
Since Kubernetes has no way to undelete a resource (unset the deletionTimestamp field), all child namespaces must be manually deleted to allow the SubNamespace deletion to be finalized.
This PR introduces handling of DELETE verb to the subnamespaces validating webhook ensuring no subnamespaces can be deleted if the sub-namespace has child namespaces. It seems like there was a minor bug in the validating webhook configuration: it was configured to handle UPDATE verb, but the implementation was only addressing CREATE.
If a client is allowed to delete a
SubNamespacewhere the sub-namespace has child namespaces, the controller becomes stuck on the finalization of theSubNamespace. The controller will not be allowed to delete the sub-namespaces by our namespace webhook.Since Kubernetes has no way to undelete a resource (unset the
deletionTimestampfield), all child namespaces must be manually deleted to allow theSubNamespacedeletion to be finalized.This PR introduces handling of DELETE verb to the subnamespaces validating webhook ensuring no subnamespaces can be deleted if the sub-namespace has child namespaces. It seems like there was a minor bug in the validating webhook configuration: it was configured to handle UPDATE verb, but the implementation was only addressing CREATE.
Close https://github.com/cybozu-go/accurate/issues/144