Skip to content

Image-builder / image-puller rolebindings remain in the cluster #1585

@dkwon17

Description

@dkwon17

Description

How To Reproduce

When using the backup and restore functionality, old role bindings persist in the cluster, for example:

$ oc get rolebinding | grep workspace
devworkspace-default-rolebinding                                  Role/devworkspace-default-role                                   5d2h
devworkspace-image-builder-workspace459b0abd7c144687              ClusterRole/system:image-puller                                  4d2h
devworkspace-image-builder-workspacec2f9df1c974a4b84              ClusterRole/system:image-puller                                  4d2h
devworkspace-job-runner-workspace459b0abd7c144687-image-builder   ClusterRole/system:image-builder                                 4d

even though there is no workspace workspacec2f9df1c974a4b84 anymore on the cluster:

$ oc get dw
NAME                                  DEVWORKSPACE ID             PHASE     INFO
test-devworkspace-should-get-backup   workspace459b0abd7c144687   Stopped   Stopped

Expected behavior

These image-puller / image-builder role bindings should probably have an owner reference to their associated DevWorkspace, which would allow them to be garbage collected once the DevWorkspace is deleted.

Additional context

Metadata

Metadata

Assignees

Labels

No labels
No labels

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions