已开启
fix(controller): cleanup per-model ClusterRole/ClusterRoleBinding on deletion #258
luochen01创建于 9月29日
fix(controller): cleanup per-model ClusterRole/ClusterRoleBinding on deletion #258
已开启
共 2 个文件变更+15-7
| @@ -159,8 +159,9 @@ func (r *InferNexServiceReconciler) Reconcile(ctx context.Context, req ctrl.Requ | |||
| 159 | return r.reconcilePersistStatus(ctx, req, desired, effectiveSpec, mode) | 159 | return r.reconcilePersistStatus(ctx, req, desired, effectiveSpec, mode) |
| 160 | } | 160 | } |
| 161 | 161 | ||
| 162 | -// reconcileInferNexServiceDeletion removes Gateway API objects created by this controller (ownership / infernex labels), | 162 | +// reconcileInferNexServiceDeletion removes Gateway API objects and per-owner component |
| 163 | -// then drops the InferNexService finalizer so garbage collection can complete. | 163 | +// RBAC created by this controller (ownership / infernex labels), then drops the |
| 164 | +// InferNexService finalizer so garbage collection can complete. | ||
| 164 | func (r *InferNexServiceReconciler) reconcileInferNexServiceDeletion( | 165 | func (r *InferNexServiceReconciler) reconcileInferNexServiceDeletion( |
| 165 | ctx context.Context, | 166 | ctx context.Context, |
| 166 | infsvc *infernexv1alpha1.InferNexService, | 167 | infsvc *infernexv1alpha1.InferNexService, |
| @@ -177,6 +178,9 @@ func (r *InferNexServiceReconciler) reconcileInferNexServiceDeletion( | |||
| 177 | if err := r.deleteManagedGatewayRouting(ctx, infsvc); err != nil { | 178 | if err := r.deleteManagedGatewayRouting(ctx, infsvc); err != nil { |
| 178 | return ctrl.Result{}, err | 179 | return ctrl.Result{}, err |
| 179 | } | 180 | } |
| 181 | + // Cluster-scoped ClusterRole/ClusterRoleBinding have no ownerReferences and are not | ||
| 182 | + // garbage-collected; release per-owner component RBAC (and shared singleton ServiceAccount | ||
| 183 | + // owner refs) explicitly before dropping the finalizer. | ||
| 180 | if err := r.releaseSingletonOwnerReferences(ctx, infsvc); err != nil { | 184 | if err := r.releaseSingletonOwnerReferences(ctx, infsvc); err != nil { |
| 181 | return ctrl.Result{}, err | 185 | return ctrl.Result{}, err |
| 182 | } | 186 | } |
| @@ -193,14 +197,15 @@ func (r *InferNexServiceReconciler) reconcileInferNexServiceDeletion( | |||
| 193 | return ctrl.Result{}, nil | 197 | return ctrl.Result{}, nil |
| 194 | } | 198 | } |
| 195 | 199 | ||
| 200 | +// releaseSingletonOwnerReferences releases per-owner component controller RBAC created for | ||
| 201 | +// this InferNexService. Cluster-scoped ClusterRole/ClusterRoleBinding have no ownerReferences | ||
| 202 | +// and are not garbage-collected, so they must be removed explicitly; shared singleton | ||
| 203 | +// ServiceAccounts use additive non-controller owner references and are pruned, not deleted. | ||
| 196 | func (r *InferNexServiceReconciler) releaseSingletonOwnerReferences( | 204 | func (r *InferNexServiceReconciler) releaseSingletonOwnerReferences( |
| 197 | ctx context.Context, | 205 | ctx context.Context, |
| 198 | owner *infernexv1alpha1.InferNexService, | 206 | owner *infernexv1alpha1.InferNexService, |
| 199 | ) error { | 207 | ) error { |
| 200 | - // Mooncake Deployments and Services are namespace singletons and are not | 208 | + return r.syncComponentControllerRBACCleanup(ctx, owner, nil) |
| 201 | - // owner-referenced by an InferNexService. ServiceAccounts remain shared and | ||
| 202 | - // use additive non-controller owner references. | ||
| 203 | - return r.syncSingletonComponentSAOwnerRefsCleanup(ctx, owner, nil) | ||
| 204 | } | 209 | } |
| 205 | 210 | ||
| 206 | // reconcileFetchInferNexService loads the InferNexService or ensures one from a linked LLMInferenceService when missing. | 211 | // reconcileFetchInferNexService loads the InferNexService or ensures one from a linked LLMInferenceService when missing. |
| @@ -6,6 +6,7 @@ import ( | |||
| 6 | 6 | ||
| 7 | appsv1 "k8s.io/api/apps/v1" | 7 | appsv1 "k8s.io/api/apps/v1" |
| 8 | corev1 "k8s.io/api/core/v1" | 8 | corev1 "k8s.io/api/core/v1" |
| 9 | + rbacv1 "k8s.io/api/rbac/v1" | ||
| 9 | metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" | 10 | metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" |
| 10 | "k8s.io/apimachinery/pkg/apis/meta/v1/unstructured" | 11 | "k8s.io/apimachinery/pkg/apis/meta/v1/unstructured" |
| 11 | "k8s.io/apimachinery/pkg/runtime" | 12 | "k8s.io/apimachinery/pkg/runtime" |
| @@ -39,6 +40,9 @@ func gatewayTestScheme(t *testing.T) *runtime.Scheme { | |||
| 39 | if err := appsv1.AddToScheme(s); err != nil { | 40 | if err := appsv1.AddToScheme(s); err != nil { |
| 40 | t.Fatal(err) | 41 | t.Fatal(err) |
| 41 | } | 42 | } |
| 43 | + if err := rbacv1.AddToScheme(s); err != nil { | ||
| 44 | + t.Fatal(err) | ||
| 45 | + } | ||
| 42 | if err := lwsv1.AddToScheme(s); err != nil { | 46 | if err := lwsv1.AddToScheme(s); err != nil { |
| 43 | t.Fatal(err) | 47 | t.Fatal(err) |
| 44 | } | 48 | } |
| @@ -335,4 +339,3 @@ func TestEnsureDefaultNodePortEnvoyProxyRef(t *testing.T) { | |||
| 335 | t.Fatal("expected existing default ref recognized") | 339 | t.Fatal("expected existing default ref recognized") |
| 336 | } | 340 | } |
| 337 | } | 341 | } |
| 338 | - | ||