Feat/delete os pod by alvlkov · Pull Request #206 · openshift/managed-scripts

alvlkov · 2024-12-13T11:07:29Z

What type of PR is this?

This adds a new managed script to delete a pod from Openshift's reserved namespace.

What this PR does / Why we need it?

This will help fixing errors related to openshift reserved namespaces, essentially when pod restart is required.

Which Jira/Github issue(s) does this PR fix?

OSD_20528

Special notes for your reviewer

Pre-checks (if applicable)

Validated the changes in a ROSA stage cluster
Included documentation changes with PR

openshift-bot · 2025-03-14T01:01:07Z

Issues go stale after 90d of inactivity.

Mark the issue as fresh by commenting /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.
Exclude this issue from closing by commenting /lifecycle frozen.

If this issue is safe to close now please do so with /close.

/lifecycle stale

alvlkov · 2025-03-18T13:16:33Z

/remove-lifecycle stale

iamkirkbater

Requested change relates to the name of the script. The additional check for a replicaset would be more of a nice-to-have, but we can also add that after this is merged so that we can start using this sooner rather than later.

iamkirkbater · 2025-04-01T12:19:06Z

@@ -0,0 +1,21 @@
+# Delete Openshift Pod Script


Can we simplify this to just be delete-pod instead of adding the delete-os-pod? From a UX perspective, it will be easier to remember the closer the syntax name is to the actual OC command.

iamkirkbater · 2025-04-01T12:22:11Z

+
+
+main(){
+ delete_pod


Would it be a huge lift here to validate if a pod is owned by a replicaset before proceeding? We might also need to add a "force" flag/parameter to bypass that as well, but it might be a nice protection for the rare chance that a pod isn't managed in an openshift namespace, this way we can make sure it will come back as a default behavior, but have the option to bypass it if we need to.

iamkirkbater · 2025-04-01T13:07:51Z

+author: Alex Volkov
+allowedGroups:
+ - CEE
+ - SREP


Suggested change
- SREP
- SREP
- MCSTierTwo

added the suggestions, thanks @iamkirkbater

feichashao · 2025-04-01T13:32:15Z

Thanks @iamkirkbater for the review!

I would suggest we add the safeguard in this PR to validate if a pod is backed by a replicaset, otherwise the delete operation can be too wide.
The protection can be "we are not making the situation worse":

If we are deleting a non-healthy pod, go ahead and delete it.
If we are deleting a healthy pod,
- If it is the only healthy pod in the replicaset, stop, raise a ticket and review it.
- If there's another healthy pod besides the one we are going to delete, it is ok to delete.

Another nice-to-have is that we put a list of allowed namespace instead of openshift-*. This sound like a toil but it give us an opportunity to review if we want to allow the deletion when a new namespace comes. (can be next PR for this one).

iamkirkbater · 2025-04-01T13:51:23Z

@feichashao - a few questions:

Can you expand on what you mean by "non-healthy" pod? If we're asking for this in this PR I'd like to be explicit to what we are looking for. For example, if we just mean a "healthy" pod is one in a "Running" state, vs non-healthy which would be "Error", "Completed", "Pending" - etc.
What specifically do you mean by raise a ticket - Do you mean like a JIRA here? Or would exiting out with an Error (if there's not a FORCE parameter set) work here?
For the list of allowed namespaces - one thing I'd like to keep in mind here is that CEE/MCS have a wider scope of what they support than SREP does. While SREP may only limit ourselves to specific managed namespaces, CEE/MCS will be supporting additional things like openshift-virtualization, etc. So limiting them to managed namespaces may not be as efficient as we think it might be.

feichashao · 2025-04-01T14:18:36Z

Can you expand on what you mean by "non-healthy" pod? If we're asking for this in this PR I'd like to be explicit to what we are looking for. For example, if we just mean a "healthy" pod is one in a "Running" state, vs non-healthy which would be "Error", "Completed", "Pending" - etc.

I would say Healthy = A pod with all containers in running state; The other should be non-healthy, eg, pending, crashloopbackoff, pod in running state but not all containers are running, showing like:

kube-apiserver-ip-10-119-135-4.ec2.internal 4/5 Running

(I mocked this)

…pt name

alvlkov · 2025-04-07T16:37:50Z

Added replicaset check and --force flag.

- Successfully deleted pod owned by replicaset regardless --force flag
- Couldn't delete a pod not owned by a replicaset without --force flag
- Successfully deleted pod not owned by replicaset with --force flag

alvlkov · 2025-07-02T07:33:52Z

/retest

typeid · 2025-07-10T12:15:40Z

+ clusterRoleRules:
+ - apiGroups:
+ - ""
+ resources:
+ - "pods"
+ verbs:
+ - "delete"
+ - "get"


This is valid for all namespaces. There's no limitation to from openshift's reserved namespace. as mentioned above.
This permission extends beyond the scope even SRE-P has.

The above limitation applies to the NAMESPACE parameter, to avoid deleting Openshift related pods. AFAIK I cant scope namespaces within clusterRoleRules. Please elaborate about the suggestion.

Co-authored-by: typeid <github@typeid.org>

typeid · 2025-07-22T08:55:54Z

/retest

typeid · 2025-07-28T07:38:12Z

/lgtm

typeid · 2025-07-28T07:39:28Z

Code LGTM. Pending approval from compliance: https://issues.redhat.com/browse/HCMSEC-611

typeid · 2025-07-28T07:39:37Z

/hold for compliance approve

typeid · 2025-09-18T20:43:43Z

/unhold

Merging this as we have not received any feedback from compliance. This does not provide read access to customer data so I'm okay just stamping this off.

typeid · 2025-09-18T20:46:43Z

/retest

openshift-bot · 2025-12-19T01:00:44Z

Issues go stale after 90d of inactivity.

Mark the issue as fresh by commenting /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.
Exclude this issue from closing by commenting /lifecycle frozen.

If this issue is safe to close now please do so with /close.

/lifecycle stale

openshift-bot · 2026-01-18T08:31:06Z

Stale issues rot after 30d of inactivity.

Mark the issue as fresh by commenting /remove-lifecycle rotten.
Rotten issues close after an additional 30d of inactivity.
Exclude this issue from closing by commenting /lifecycle frozen.

If this issue is safe to close now please do so with /close.

/lifecycle rotten
/remove-lifecycle stale

openshift-bot · 2026-02-18T00:01:02Z

Rotten issues close after 30d of inactivity.

Reopen the issue by commenting /reopen.
Mark the issue as fresh by commenting /remove-lifecycle rotten.
Exclude this issue from closing again by commenting /lifecycle frozen.

/close

openshift-ci · 2026-02-18T00:03:28Z

@openshift-bot: Closed this PR.

Details

In response to this:

Rotten issues close after 30d of inactivity.
Reopen the issue by commenting /reopen.
Mark the issue as fresh by commenting /remove-lifecycle rotten.
Exclude this issue from closing again by commenting /lifecycle frozen.
/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

alvlkov · 2026-02-26T15:51:50Z

/reopen

alvlkov · 2026-02-26T15:52:18Z

/remove-lifecycle rotten

openshift-ci · 2026-02-26T15:54:18Z

@alvlkov: Reopened this PR.

Details

In response to this:

/reopen

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

openshift-ci · 2026-02-26T15:56:25Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: alvlkov
Once this PR has been reviewed and has the lgtm label, please ask for approval from typeid. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

openshift-ci · 2026-02-26T16:02:11Z

@alvlkov: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

adding managed script for os pod deletion
4ad4789

openshift-ciBot requested review from MitaliBhalla and samanthajayasinghe December 13, 2024 11:07

adding SREP to allowedGroups
a4275c1

openshift-ciBot added the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Mar 14, 2025

openshift-ciBot removed the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Mar 18, 2025

iamkirkbater requested changes Apr 1, 2025
View reviewed changes

openshift-ciBot assigned iamkirkbater Apr 1, 2025

iamkirkbater reviewed Apr 1, 2025
View reviewed changes

Alex Volkov added 2 commits April 7, 2025 12:50

adding --force flag and replicaset ownership check
eca9f00

adding replicaset check and --force flag for bypassing it, fixed scri…
f65f957
…pt name

alvlkov requested a review from iamkirkbater April 10, 2025 21:19

typeid reviewed Jul 10, 2025
View reviewed changes

Update scripts/CEE/delete-pod/metadata.yaml
86eaec2
Co-authored-by: typeid <github@typeid.org>

openshift-ciBot assigned typeid Jul 28, 2025

openshift-ciBot added the lgtm Indicates that a PR is ready to be merged. label Jul 28, 2025

openshift-ciBot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Jul 28, 2025

openshift-ciBot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Sep 18, 2025

openshift-ciBot added the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Dec 19, 2025

openshift-ciBot added lifecycle/rotten Denotes an issue or PR that has aged beyond stale and will be auto-closed. and removed lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. labels Jan 18, 2026

openshift-ciBot closed this Feb 18, 2026

openshift-ciBot removed the lifecycle/rotten Denotes an issue or PR that has aged beyond stale and will be auto-closed. label Feb 26, 2026

openshift-ciBot reopened this Feb 26, 2026

alvlkov requested a review from typeid June 1, 2026 12:14



		main(){
		delete_pod

Uh oh!

Conversation

alvlkov commented Dec 13, 2024

What type of PR is this?

What this PR does / Why we need it?

Which Jira/Github issue(s) does this PR fix?

Special notes for your reviewer

Pre-checks (if applicable)

Uh oh!

openshift-bot commented Mar 14, 2025

Uh oh!

alvlkov commented Mar 18, 2025

Uh oh!

iamkirkbater left a comment

Choose a reason for hiding this comment

Uh oh!

iamkirkbaterApr 1, 2025

Choose a reason for hiding this comment

Uh oh!

iamkirkbaterApr 1, 2025

Choose a reason for hiding this comment

Uh oh!

iamkirkbaterApr 1, 2025

Choose a reason for hiding this comment

Uh oh!

alvlkovApr 7, 2025

Choose a reason for hiding this comment

Uh oh!

feichashao commented Apr 1, 2025

Uh oh!

iamkirkbater commented Apr 1, 2025

Uh oh!

feichashao commented Apr 1, 2025

Uh oh!

alvlkov commented Apr 7, 2025• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

alvlkov commented Jul 2, 2025

Uh oh!

Uh oh!

typeidJul 10, 2025

Choose a reason for hiding this comment

Uh oh!

alvlkovJul 11, 2025

Choose a reason for hiding this comment

Uh oh!

typeid commented Jul 22, 2025

Uh oh!

typeid commented Jul 28, 2025

Uh oh!

typeid commented Jul 28, 2025

Uh oh!

typeid commented Jul 28, 2025

Uh oh!

typeid commented Sep 18, 2025

Uh oh!

typeid commented Sep 18, 2025

Uh oh!

openshift-bot commented Dec 19, 2025

Uh oh!

openshift-bot commented Jan 18, 2026

Uh oh!

openshift-bot commented Feb 18, 2026

Uh oh!

openshift-ciBot commented Feb 18, 2026

Uh oh!

alvlkov commented Feb 26, 2026

Uh oh!

alvlkov commented Feb 26, 2026

Uh oh!

openshift-ciBot commented Feb 26, 2026

Uh oh!

openshift-ciBot commented Feb 26, 2026

Uh oh!

openshift-ciBot commented Feb 26, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

alvlkov commented Apr 7, 2025•
edited
Loading