Remove dynamic users when pv is remove #466
Conversation
k8s-ci-robot
added
cncf-cla: yes
| def _remove_ceph_user(self, user_id): | ||
| client_entity = "client.{0}".format(user_id) | ||
| ret = self._volume_client._rados_command( | ||
| 'auth rm', |
There was a problem hiding this comment.
interesting, auth rm works but according to doc, should be auth del
| @@ -196,6 +196,15 @@ def cap_update(orig, want, unwanted): | |||
| assert caps[0]['entity'] == client_entity | |||
| return caps[0] | |||
|
|
|||
| def _remove_ceph_user(self, user_id): | |||
| client_entity = "client.{0}".format(user_id) | |||
| ret = self._volume_client._rados_command( | |||
There was a problem hiding this comment.
add try/catch in case user already removed.
ceph/cephfs/cephfs-provisioner.go
Outdated
| @@ -196,6 +200,14 @@ func (p *cephFSProvisioner) Delete(volume *v1.PersistentVolume) error { | |||
| return cmdErr | |||
| } | |||
|
|
|||
| // Remove dynamic user secret | |||
| secretName := generateSecretName(user) | |||
| err = p.client.Core().Secrets(volume.Spec.ClaimRef.Namespace).Delete(secretName, &metav1.DeleteOptions{}) | |||
There was a problem hiding this comment.
use SecretReference.Namespace if exists
see https://github.com/kubernetes-incubator/external-storage/blob/master/vendor/k8s.io/api/core/v1/types.go#L921
|
thanks, can you look into #309 as well? |
|
hi,
How about following the same logic to implement a customized In this customized Doing it in this way, we can avoid hard-coding in |
JrCs
force-pushed
the
remove-dynamic-users
branch
from
75052d6 to
02d388e
Compare
k8s-ci-robot
added
size/M
|
/lgtm |
… entities correctly. See kubernetes-retired#466 (comment).
… entities correctly. See kubernetes-retired#466 (comment).
|
ping @wongma7, can you merge? thanks |
… entities correctly. See kubernetes-retired#466 (comment).
… entities correctly. See kubernetes-retired#466 (comment).
… entities correctly. See kubernetes-retired#466 (comment).
… entities correctly. See kubernetes-retired#466 (comment).
This PR will remove dynamic users create by the provisionner (k8s secret and ceph client auth).
Fixes: #455