⚠️ Remove the Secret's OwnerReferences before pivot

[tahsinrahman]

What this PR does / why we need it:

Which issue(s) this PR fixes (optional, in fixes #<issue number>(, fixes #<issue_number>, ...) format, will close the issue(s) when PR gets merged):
Fixes #1404

[tahsinrahman]

/cc @vincepri

[detiber]

If we remove the ownerReferences here, then the Secrets will be orphaned if the Cluster is deleted post pivot, since the Secrets are not adopted by the Cluster.

I'm wondering if we should also keep track of which secrets had ownerReferences, and set the proper ownerReferences after the Cluster has been migrated? @vincepri thoughts?

[vincepri]

Maybe we can do that instead, re-setting the owner references after being created, because I don't think they'll be actually reconciled after they're created. @tahsinrahman Do you think you could tackle that as part of the PR?

[tahsinrahman]

sure, i'll try!

[vincepri]

/approve
/assign @detiber

The last change seems to remove only UIDs, which it should be ok to create the secrets with the same owners as before given that these are pivoted last

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: tahsinrahman, vincepri

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [vincepri]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[detiber]

/lgtm

[jdef]

This breaks pivot, which seemed to work just a few days ago:

F0919 14:52:43.716118   50979 alpha_phase_pivot.go:55] unable to pivot Cluster API Components: unable to pivot cluster API objects: Failed to move cluster: default/test1: failed to move Secrets for Cluster default/test1 to target cluster: failed to move Secret default/test1-ca: error copying Secret default/test1-ca to target cluster: error creating Secret default/test1-ca: Secret "test1-ca" is invalid: metadata.ownerReferences.uid: Invalid value: "": uid must not be empty

k --kubeconfig=/tmp/gcp-kubeconfig version
Client Version: version.Info{Major:"1", Minor:"15", GitVersion:"v1.15.3", GitCommit:"2d3c76f9091b6bec110a5e63777c332469e0cba2", GitTreeState:"clean", BuildDate:"2019-09-03T18:55:44Z", GoVersion:"go1.12.9", Compiler:"gc", Platform:"linux/amd64"}
Server Version: version.Info{Major:"1", Minor:"15", GitVersion:"v1.15.3", GitCommit:"2d3c76f9091b6bec110a5e63777c332469e0cba2", GitTreeState:"clean", BuildDate:"2019-08-19T11:05:50Z", GoVersion:"go1.12.9", Compiler:"gc", Platform:"linux/amd64"}

EDIT

in this case, the secret is owned by:

  - apiVersion: bootstrap.cluster.x-k8s.io/v1alpha2
    kind: KubeadmConfig
    name: test1-controlplane-0
    uid: 079cc1bc-7242-4dcc-8375-a401cc9ffa4d

which, in turn, is owned by the first control plane machine of the source cluster:

- apiVersion: bootstrap.cluster.x-k8s.io/v1alpha2
  kind: KubeadmConfig
  metadata:
    creationTimestamp: "2019-09-19T19:14:39Z"
    generation: 1
    name: test1-controlplane-0
    namespace: default
    ownerReferences:
    - apiVersion: cluster.x-k8s.io/v1alpha2
      kind: Machine
      name: test1-controlplane-0
      uid: e206438d-0dad-46d7-985d-2f940977ac05
    resourceVersion: "51174"
    selfLink: /apis/bootstrap.cluster.x-k8s.io/v1alpha2/namespaces/default/kubeadmconfigs/test1-controlplane-0
    uid: 079cc1bc-7242-4dcc-8375-a401cc9ffa4d

[ncdc]

@jdef would you mind filing an issue?

[andrewsykim]

So I think this fails API validation here, because an ownerRef can't have an empty UID.