search

redradrat / aws-iam-operator

AWS IAM Operator for Kubernetes
Apache License 2.0
32 stars 7 forks source link

EntityAlreadyExists thrown and then deletion leads to Role 'xxxx' not yet created #21

Open jayzalowitz opened 3 years ago

jayzalowitz commented 3 years ago

kubectl get role.aws-iam.redradrat.xyz -A

jay nginx-deployment-role EntityAlreadyExists: Role with name nginx-deployment-role already exists. status code: 409, request id: 042007ff-baf9-47d3-8960-b8bf9209c6ee ERROR
jay role-sample EntityAlreadyExists: Role with name role-sample already exists. status code: 409, request id: 23bf242d-4a05-4668-b1e8-de3aa0538306 ERROR
test nginx-deployment-role arn:aws:iam::....:role/nginx-deployment-role Succesfully reconciled
test role-sample arn:aws:iam::....:role/role-sample Succesfully reconciled OK

jayzalowitz$ kubectl delete -f deployment.yaml -n jay deployment.apps "nginx-deployment" deleted role.aws-iam.redradrat.xyz "nginx-deployment-role" deleted role.aws-iam.redradrat.xyz "role-sample" deleted

SFO-WXLVCF:application jayzalowitz$ kubectl get role.aws-iam.redradrat.xyz -A

jay nginx-deployment-role Role 'nginx-deployment-role' not yet created
jay role-sample Role 'role-sample' not yet created
test nginx-deployment-role arn:aws:iam::....:role/nginx-deployment-role Succesfully reconciled
test role-sample arn:aws:iam::.....:role/role-sample Succesfully reconciled

kubectl delete -f deployment.yaml -n test deployment.apps "nginx-deployment" deleted role.aws-iam.redradrat.xyz "nginx-deployment-role" deleted role.aws-iam.redradrat.xyz "role-sample" deleted

kubectl get role.aws-iam.redradrat.xyz -A jay nginx-deployment-role Role 'nginx-deployment-role' not yet created ERROR 11 Feb 21 22:33 +0000 jay role-sample Role 'role-sample' not yet created ERROR 11 Feb 21 22:33 +0000

redradrat commented 3 years ago

Hi @jayzalowitz, sorry for the late response... I'm not actually sure I'm following the flow correctly here. You're saying the Role resource isn't ever created? Or just in the scenario where the running controller has detected it as already existing?

jayzalowitz commented 3 years ago

I basically need a mode that deletes role regardless of if all other actions are completed before it. I have several creation and deletion problems. Would you consider adding a flag that says "just delete" or "ignore if already created"

redradrat commented 3 years ago

Ok, I think I get your point... I mean the operator cannot detect the exact details of the existing role yet. It only understands that it exists and thus fails, as the understanding of whether that existing Role is actually right is not there...

So that's why the controller really want's to create the role from the beginning. And thus shouldn't touch it, if it is not able to properly "adopt" it.

redradrat commented 3 years ago

I wonder if one could just alter the Custom Resource to include the status in a way, that makes the operator think it did create the resource. But yeah, it would be a hack.