iam objects deletion issue (ordering required)

[shivpathak]

iam objects deletion issue (ordering required)

[redradrat]

@shivpathak I'm not sure what we can do about that on operator side? Of course we cannot delete a Policy before a PolicyAttachment. But the user has to be aware of that order. Right now the operator should give an error, if you try to delete in the wrong order. Is this not the case?

I think the operator should throw an error if you're trying to delete in the wrong order, and once you delete the right object, it should finish deletion.

Here we check for existing Attachments:

aws-iam-operator/controllers/policy_controller.go

Lines 160 to 175 in 54e6ee5

	// Returns a function, that does everything necessary before we can delete our actual Policy (cleanup)
	func policyCleanup(r *PolicyReconciler, ctx context.Context, policy *iamv1beta1.Policy) func() error {
	return func() error {
	attachments := iamv1beta1.PolicyAttachmentList{}
	if err := r.List(ctx, &attachments); err != nil {
	return err
	}
	for _, att := range attachments.Items {
	if att.Spec.PolicyReference.Name == policy.Name && att.Spec.PolicyReference.Namespace == policy.Namespace {
	err := fmt.Errorf(fmt.Sprintf("cannot delete policy due to existing PolicyAttachment '%s/%s'", att.Name, att.Namespace))
	return err
	}
	}
	return nil
	}
	}

Here we fail if there was a "cleanup" error:

aws-iam-operator/controllers/policy_controller.go

Lines 89 to 114 in 54e6ee5

	cleanupFunc := policyCleanup(r, ctx, &policy)
	// Check Deletion and finalizer
	if policy.ObjectMeta.DeletionTimestamp.IsZero() {
	// The object is not being deleted, so if it does not have our finalizer,
	// then lets add the finalizer and update the object. This is equivalent
	// registering our finalizer.
	if !containsString(policy.ObjectMeta.Finalizers, policiesFinalizer) {
	policy.ObjectMeta.Finalizers = append(policy.ObjectMeta.Finalizers, policiesFinalizer)
	if err := r.Update(context.Background(), &policy); err != nil {
	log.Error(err, "unable to register finalizer for Policy")
	return ctrl.Result{}, errWithStatus(&policy, err, r.Status(), ctx)
	}
	}
	} else {
	if containsString(policy.ObjectMeta.Finalizers, policiesFinalizer) {
	// our finalizer is present, so lets handle any external dependency
	// delete the actual AWS Object and pass the cleanup function
	statusWriter, err := DeleteAWSObject(iamsvc, ins, cleanupFunc)
	statusWriter(ins, &policy, ctx, r.Status(), log)
	if err != nil {
	// we had an error during AWS Object deletion... so we return here to retry
	log.Error(err, "unable to delete Policy")
	return ctrl.Result{}, err
	}

So as soon as the PolicyAttachment is gone, the deletion should cascade.

[redradrat]

Oh I see the issue,

the reconcile filter filters out the actual re-reuns after failing, due to the generation already being increased. Will move the generation increase to after the reconcile went OK.