Adrian Ludwin

Can't run KIND on ChromeOS Linux VM

17

**What happened**: I tried to run `kind` (v0.4.0) on the Linux VM in Chrome OS 75.0.3770.144: ``` aludwin@penguin:~$ kind create cluster Creating cluster "kind" ... ✓ Ensuring node image (kindest/node:v1.15.0)...

Investigate permanent errors in the object reconcilers

3

I believe that object reconcilers can get into a bad state, e.g. if their CRDs are deleted, which can only be resolved by restarting HNC. These bad states don't necessarily...

Fix flaky quickstart test

3

I've noticed that the following e2e test frequently fails, and always in the same way. Rerunning it generally passes. It's almost certainly just a flake. ``` • Failure [66.126 seconds]...

Fix periodic resync of HRQ

2

Once #183 is merged, we need to fix the periodic resync of RQs and HRQs (see detectIncrementalHRQUsageDrift).

Add condition if managed label (or annotation) conflicts with one of its ancestors

6

/good-first-issue Part of #47 but maybe not critical for HNC v1.0. /cc @erikgb See [this line for labels](https://github.com/kubernetes-sigs/hierarchical-namespaces/blob/22c4260b6aa751bc7a65f74d8d48cd9bd9a3be83/internal/hierarchyconfig/reconciler.go#L553) and [this line for annotations](https://github.com/kubernetes-sigs/hierarchical-namespaces/blob/22c4260b6aa751bc7a65f74d8d48cd9bd9a3be83/internal/hierarchyconfig/reconciler.go#L634). If a namespace has a managed label/annot...

Proposed simplifications and feature removals for the HNC API

8

We have a few features that I believe are rarely used but are hard to implement and maintain in HNC: - Cascading deletion: the ability to remove an entire subtree...

Proposal: remove anchor finalizers as soon as subns starts getting deleted

2

Today, if you delete a subnamespace anchor, the anchor is not fully deleted until the underlying subnamespace is deleted. Namespaces are usually deleted within several seconds, but can sometimes get...

Only create per-object webhooks for configured types

16

We currently create [one almighty "object" webhook](https://github.com/kubernetes-sigs/hierarchical-namespaces/blob/281b24ff4c6d9fbbed59f6ac473b9c3cad79450f/config/webhook/manifests.yaml#L83) that, if broken, can effectively block every object operation in the entire cluster (minus critical system namespaces), even for objects that are not...

See https://github.com/open-policy-agent/cert-controller/blob/d025255429b45249599b36dcbdaf30e09e857ad2/pkg/rotator/rotator.go#L203. kustomize or operators could result in having a webhook config with no webhooks. This shouldn't be an error.

Add documentation for inclusive propagation

3

/assign @mzeevi See https://github.com/kubernetes-sigs/hierarchical-namespaces/pull/217#pullrequestreview-1088726641