gatekeeper CRD is not getting removed when operator is removed

[ycao56]

gatekeeper CRD is not getting removed when operator is removed

[tchughesiv]

yes... because removing an operator does not remove an installed CR, nor should it.

[ycao56]

If this is not something installed manually by user, then it should be automatically removed. Having leftovers is not good IMHO.

[tchughesiv]

An installed CR, by a user, is something the operator does not own, nor should it. An operator can be removed but the resulting gatekeeper deployment will/should remain in the cluster unless a user specifically chooses to uninstall it. The operator is merely there to reconcile the install/upgrade/maintenance based on the CR. The CR stands on its own and depends on the CRD to remain in the cluster. That said, OLM will apply patches/changes to a CRD with future releases so there's no concern with an older CRD version remaining on a cluster.

[ycao56]

If the operator has been removed, what's the purpose of leaving CRD and CR in cluster? They are orphans.
Also for uninstall scenario, if user decides to remove gatekeeper operator entirely, user will have to manually remove gatekeeper CRD. Since this is not a resource user installs, there is a big chance that he is not even aware of it.

[tchughesiv]

The key differentiator here, and how I prefer to think about it, is... the Gatekeeper Operator & the Gatekeeper are two separate products serving two separate purposes. Choosing to remove the operator is not the same as choosing to remove the gatekeeper itself. IDK if that helps.

[ycao56]

I look at this in a way how resources are related to each other. To me Gatekeeper CR and Gatekeeper CRD belongs to Gatekeeper Operator not Gatekeeper.

Let's go through the install/uninstall experience from user perspective:

Install flow:

1. User installs Gatekeeper Operator using OLM
2. User creates Gatekeeper CR to install Gatekeeper

So to user, he only knows about the Gatekeeper Operator and the Gatekeeper CR

Uninstall flow A:

1. User deletes Gatekeeper CR to remove gatekeeper
2. User deletes Gatekeeper Operator

Now user ends of having Gatekeeper CRD leaving on the cluster. He has no idea about Gatekeeper CRD

Uninstall flow B:
For some reason, user decides to leave Gatekeeper running in cluster but remove Gatekeeper Operator (not sure if this is a valid case we should support. but let's assume it works)

1. User only deletes Gatekeeper Operator

Gatekeeper is stilling running in the cluster. Gatekeeper CR is in the cluster. Gatekeeper CRD is also in the cluster.
Gatekeeper CR and Gatekeeper CRD are not necessary for Gatekeeper to continue to run in the cluster.

In either case, Gatekeeper CRD should be removed automatically.