FxKu commented 4 months ago

This a follow up to #2199 with some greater changes. The most important part of owner references is the cascaded removal of child resources which bypasses the delete protection offered by our operator.

Quick reminder about delete protection: this checks pre-defined annotations before calling delete code but cannot block the actual kubectl delete call itself. This you could only achieve with a K8s admission controller which, for example, does the same annotation checks.

We use the latter at Zalando, but some folks out there might rely on the protection by the operator. Therefore, we should not enable owner references by default but make it configurable.

2199 also lacked code to update existing resources once you start using owner references or vice versa remove them. Like with the recently added annotation inheritance, this produced many code extensions. I’ve also found some oversights from #2657 which I’ve fixed along the way. All owner references syncs are done with Update API calls, which requires extending the RBAC.

A new e2e test is added which tests syncing owner references in both directions and deleting the acid-test-cluster cascadingly which was previously done in the multi namespace test. Some unit test were extended, too.

closes #2199 fixes #498