Cleanup of resources requires deletecollection permission

[amalagaura]

What did you do to encounter the bug?
Steps to reproduce the behavior:

1. Delete existing resource

What did you expect?
Cleanup of affected resources

What happened instead?
Resources are not cleaned up

Screenshots

Operator Information

• Operator Version: 1.4
• MongoDB Image used

Kubernetes Cluster Information

Additional context
We have watchedNamespaces = '*' so we are using the cluster roles

Operator logs give errors that deletecollection is not allowed for Service, ConfigMap, StatefulSet and Secrets

I believe this API call: https://github.com/mongodb/mongodb-kubernetes/blob/master/controllers/operator/mongodbopsmanager_controller.go#L787 uses deletecollection

[fealebenpae]

Hey @amalagaura, thanks for reporting this!

I've taken a look at the relevant code paths in the MongoDBOpsManager controller and they should only execute in a multi-cluster operator deployment where the kubectl plugin that configures the operator for multi-cluster already applies delete collection where necessary. In a single-cluster deployment we populate the ownerReferences field of dependent resources that causes them to automatically be deleted when the MongoDBOpsManager resource they depend on is deleted. The manual deletion code path shouldn't even be taken in single-cluster deployments - I've filed a bug in our internal issue tracker to resolve this.

In the mean time I think you should be able to safely ignore this, because even though the manual deletion inside the operator fails, the Kubernetes api server should clean up the dependent resources based on their ownerReferences anyway.

[amalagaura]

That makes sense. However resources are not being deleted. I am on version 1.4.0 of Mongodb Kubernetes Operator and after deleting a MongoDB cluster the ConfigMap -state is still there 20 minutes later.

[amalagaura]

I just deleted another cluster and the Stateful Set is still there. Please try it on your end. This is a single cluster installation and I am deleting a Sharded Cluster MongoDB.

[amalagaura]

For now in our installation we are adding the deletecollection permission in the cluster roles like my PR to have things working. Is there a code fix planned for this?

[nammn]

hey @amalagaura i saw multiple places in our configmap where we didn't add ownerrefs, I coildn't find the same for statefulsets. Can you verify the ownerrefs of the sts for me?

  kubectl get statefulset <statefulset-name> -n <namespace> -o jsonpath='{.metadata.ownerReferences}'