fix(registry): remove k8s registry secrets when registries are removed [EE-5768] (#10369)

api/http/handler/registries/registry_delete.go

@@ -1,14 +1,18 @@
 package registries
 
 import (
+	"fmt"
 	"net/http"
 
 	portainer "github.com/portainer/portainer/api"
 	httperrors "github.com/portainer/portainer/api/http/errors"
 	"github.com/portainer/portainer/api/http/security"
+	"github.com/portainer/portainer/api/pendingactions"
 	httperror "github.com/portainer/portainer/pkg/libhttp/error"
 	"github.com/portainer/portainer/pkg/libhttp/request"
 	"github.com/portainer/portainer/pkg/libhttp/response"
+
+	"github.com/rs/zerolog/log"
 )
 
 // @id RegistryDelete
@@ -38,11 +42,9 @@ func (handler *Handler) registryDelete(w http.ResponseWriter, r *http.Request) *
 		return httperror.BadRequest("Invalid registry identifier route variable", err)
 	}
 
-	_, err = handler.DataStore.Registry().Read(portainer.RegistryID(registryID))
-	if handler.DataStore.IsErrObjectNotFound(err) {
-		return httperror.NotFound("Unable to find a registry with the specified identifier inside the database", err)
-	} else if err != nil {
-		return httperror.InternalServerError("Unable to find a registry with the specified identifier inside the database", err)
+	registry, err := handler.DataStore.Registry().Read(portainer.RegistryID(registryID))
+	if err != nil {
+		return httperror.InternalServerError(fmt.Sprintf("Unable to load registry %q from the database", registry.Name), err)
 	}
 
 	err = handler.DataStore.Registry().Delete(portainer.RegistryID(registryID))
@@ -50,5 +52,57 @@ func (handler *Handler) registryDelete(w http.ResponseWriter, r *http.Request) *
 		return httperror.InternalServerError("Unable to remove the registry from the database", err)
 	}
 
+	err = handler.deleteKubernetesSecrets(registry)
+	if err != nil {
+		return httperror.InternalServerError("Unable to delete registry secrets", err)
+	}
+
 	return response.Empty(w)
 }
+
+func (handler *Handler) deleteKubernetesSecrets(registry *portainer.Registry) error {
+
+	for endpointId, access := range registry.RegistryAccesses {
+		if access.Namespaces != nil {
+			// Obtain a kubeclient for the endpoint
+			endpoint, err := handler.DataStore.Endpoint().Endpoint(endpointId)
+			if err != nil {
+				// Skip environments that can't be loaded from the DB
+				log.Warn().Err(err).Msgf("Unable to load the environment with id %d from the database", endpointId)
+				continue
+			}
+
+			cli, err := handler.K8sClientFactory.GetKubeClient(endpoint)
+			if err != nil {
+				// Skip environments that can't get a kubeclient from
+				log.Warn().Err(err).Msgf("Unable to get kubernetes client for environment %d", endpointId)
+				continue
+			}
+
+			failedNamespaces := make([]string, 0)
+			for _, ns := range access.Namespaces {
+				err = cli.DeleteRegistrySecret(registry.ID, ns)
+				if err != nil {
+					failedNamespaces = append(failedNamespaces, ns)
+					log.Warn().Err(err).Msgf("Unable to delete registry secret %q from namespace %q for environment %d. Retrying offline", cli.RegistrySecretName(registry.ID), ns, endpointId)
+				}
+			}
+
+			if len(failedNamespaces) > 0 {
+				handler.PendingActionsService.Create(portainer.PendingActions{
+					EndpointID: endpointId,
+					Action:     pendingactions.DeletePortainerK8sRegistrySecrets,
+
+					// When extracting the data, this is the type we need to pull out
+					// i.e. pendingactions.DeletePortainerK8sRegistrySecretsData
+					ActionData: pendingactions.DeletePortainerK8sRegistrySecretsData{
+						RegistryID: registry.ID,
+						Namespaces: failedNamespaces,
+					},
+				})
+			}
+		}
+	}
+
+	return nil
+}