88 "context"
99 "fmt"
1010 "os"
11+ "strings"
1112 "time"
1213
1314 druidcorev1alpha1 "github.com/gardener/etcd-druid/api/core/v1alpha1"
@@ -20,10 +21,13 @@ import (
2021 webhookcmd "github.com/gardener/gardener/extensions/pkg/webhook/cmd"
2122 "github.com/gardener/gardener/pkg/client/kubernetes"
2223 gardenerhealthz "github.com/gardener/gardener/pkg/healthz"
24+ kutil "github.com/gardener/gardener/pkg/utils/kubernetes"
2325 machinev1alpha1 "github.com/gardener/machine-controller-manager/pkg/apis/machine/v1alpha1"
26+ "github.com/go-logr/logr"
2427 monitoringv1 "github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring/v1"
2528 "github.com/spf13/cobra"
2629 corev1 "k8s.io/api/core/v1"
30+ rbacv1 "k8s.io/api/rbac/v1"
2731 metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
2832 vpaautoscalingv1 "k8s.io/autoscaler/vertical-pod-autoscaler/pkg/apis/autoscaling.k8s.io/v1"
2933 "k8s.io/component-base/version/verflag"
@@ -273,6 +277,13 @@ func NewControllerManagerCommand(ctx context.Context) *cobra.Command {
273277 return fmt .Errorf ("error running manager: %w" , err )
274278 }
275279
280+ // TODO (kon-angelo): Remove after the release of version 1.68.0
281+ if err := mgr .Add (manager .RunnableFunc (func (ctx context.Context ) error {
282+ return purgeTerraformerRBACResources (ctx , mgr .GetClient (), log )
283+ })); err != nil {
284+ return fmt .Errorf ("error adding terraformer migrations: %w" , err )
285+ }
286+
276287 return nil
277288 },
278289 }
@@ -282,3 +293,75 @@ func NewControllerManagerCommand(ctx context.Context) *cobra.Command {
282293
283294 return cmd
284295}
296+
297+ // TODO (kon-angelo): Remove after the release of version 1.68.0
298+ func purgeTerraformerRBACResources (ctx context.Context , c client.Client , log logr.Logger ) error {
299+ log .Info ("Starting the deletion of obsolete terraformer resources" )
300+
301+ const (
302+ terraformerRoleName = "gardener.cloud:system:terraformer"
303+ )
304+
305+ var (
306+ roleBindingList = & rbacv1.RoleBindingList {}
307+ roleList = & rbacv1.RoleList {}
308+ serviceAccountList = & corev1.ServiceAccountList {}
309+ )
310+
311+ // list serviceAccount bindings in all namespaces
312+ if err := c .List (ctx , roleBindingList ); err != nil {
313+ return fmt .Errorf ("failed to list RoleBindings: %w" , err )
314+ }
315+
316+ for _ , roleBinding := range roleBindingList .Items {
317+ if strings .EqualFold (roleBinding .Name , terraformerRoleName ) {
318+ log .Info ("Deleting RoleBinding" , "roleBinding" , client .ObjectKeyFromObject (& roleBinding ))
319+ if err := kutil .DeleteObject (
320+ ctx ,
321+ c ,
322+ & rbacv1.RoleBinding {ObjectMeta : metav1.ObjectMeta {Namespace : roleBinding .Namespace , Name : roleBinding .Name }},
323+ ); err != nil {
324+ return fmt .Errorf ("failed to delete roleBinding %s: %w" , client .ObjectKeyFromObject (& roleBinding ), err )
325+ }
326+ }
327+ }
328+ log .Info ("Successfully deleted the obsolete RoleBindings for terraformer" )
329+
330+ if err := c .List (ctx , roleList ); err != nil {
331+ return fmt .Errorf ("failed to list roles: %w" , err )
332+ }
333+
334+ for _ , role := range roleList .Items {
335+ if strings .EqualFold (role .Name , terraformerRoleName ) {
336+ log .Info ("Deleting Role" , "role" , client .ObjectKeyFromObject (& role ))
337+ if err := kutil .DeleteObject (
338+ ctx ,
339+ c ,
340+ & rbacv1.Role {ObjectMeta : metav1.ObjectMeta {Namespace : role .Namespace , Name : role .Name }},
341+ ); err != nil {
342+ return fmt .Errorf ("failed to delete Role %s: %w" , client .ObjectKeyFromObject (& role ), err )
343+ }
344+ }
345+ }
346+ log .Info ("Successfully deleted the obsolete Roles for terraformer" )
347+
348+ if err := c .List (ctx , serviceAccountList ); err != nil {
349+ return fmt .Errorf ("failed to list roles: %w" , err )
350+ }
351+
352+ for _ , serviceAccount := range serviceAccountList .Items {
353+ if strings .EqualFold (serviceAccount .Name , "terraformer" ) {
354+ log .Info ("Deleting ServiceAccount" , "serviceAccount" , client .ObjectKeyFromObject (& serviceAccount ))
355+ if err := kutil .DeleteObject (
356+ ctx ,
357+ c ,
358+ & corev1.ServiceAccount {ObjectMeta : metav1.ObjectMeta {Namespace : serviceAccount .Namespace , Name : serviceAccount .Name }},
359+ ); err != nil {
360+ return fmt .Errorf ("failed to delete ServiceAccount %s: %w" , client .ObjectKeyFromObject (& serviceAccount ), err )
361+ }
362+ }
363+ }
364+ log .Info ("Successfully deleted the obsolete ServiceAccounts for terraformer" )
365+
366+ return nil
367+ }
0 commit comments