[BUG] Remove the clusteruserattribute in the controller's handler when the corresponding userattribute no longer exists. about rancher HOT 3 CLOSED

Validation Template

What was fixed, or what change has occurred

Orphaned ClusterUserAttributes are now cleaned up by the corresponding controller.

Areas or cases that should be tested

• Create a downstream cluster with ACE enabled
• Create two users and assign them to the downstream cluster
• Log in by both users and download the kubeconfigs
• On the local cluster change the second user's token to point to the first one
• Delete the second user
• Observe that the ClusterUserAttribute for the second user was left on the downstream cluster
• Restart Rancher or trigger clusteruserattribute controller in other way
• Observe that the ClusterUserAttribute for the second user was removed from the downstream cluster

What areas could experience regressions

• Additional strain on ClusterUserAttribute controller as we now always make a read to check if the corresponding UserAttribute object exists whereas previously we did that only when the refresh was needed.

Are the repro steps accurate/minimal?

N/A.

from rancher.

I am pastin the workaround here... Although a fix for this issue has been developed, it has been targeted to 2.9.next. In the meantime, users encountering this problem can apply the below workaround to resolve it...

What's causing the issue is the orphaned ClusterUserAttribute's on downstream cluster(s)
Customer need to delete those (obviously only the orphaned ones, that the controller is complaining about in the logs).

Checking for offending ClusterUserAttribute's:

KUBECONFIG=<path/to/downstream/kubeconfig> kubectl -n cattle-system get clusteruserattribute <orphaned-clusteruserattribute-name> 

thank you @pmatseykanets

from rancher.

Validated on v2.9-head id 3c48a19. All scenarios in test plan have been executed and passed.

from rancher.