[tenant] Run cleanup job from system namespace #1774

lllamnyp · 2025-12-30T09:50:43Z

What this PR does

The Helm hook that creates a job deleting all applications in a tenant before deleting the tenant itself now runs this job from the cozy-system namespace. This prevents conflicts with resource quotas (not enough resources to run cleanup job) without temporary increases of the quota or similar vulnerability-introducing hacks.

Release note

[tenant] Run cleanup job in system namespace to avoid conflicts on
resource quotas.

Summary by CodeRabbit

Infrastructure Updates
- Updated cleanup job namespace targeting to use a fixed system configuration
- Adjusted cleanup job execution priority level

_{✏️ Tip: You can customize this high-level summary in your review settings.}

## What this PR does The Helm hook that creates a job deleting all applications in a tenant before deleting the tenant itself now runs this job from the cozy-system namespace. This prevents conflicts with resource quotas (not enough resources to run cleanup job) without temporary increases of the quota or similar vulnerability-introducing hacks. ### Release note ```release-note [tenant] Run cleanup job in system namespace to avoid conflicts on resource quotas. ``` Signed-off-by: Timofei Larkin <lllamnyp@gmail.com>

gemini-code-assist · 2025-12-30T09:50:54Z

Summary of Changes

Hello @lllamnyp, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request implements a strategic change to how tenant cleanup jobs are executed within the system. By moving the associated Kubernetes resources (ServiceAccount and Job) to the cozy-system namespace, the system avoids resource quota limitations that previously impacted the reliable deletion of applications before tenant removal. This ensures a more robust and conflict-free cleanup process.

Highlights

Namespace Relocation: The Helm hook responsible for creating the tenant cleanup job has been updated to run this job from the cozy-system namespace instead of the tenant's specific namespace.
Resource Quota Conflict Resolution: This change directly addresses and prevents potential conflicts with resource quotas that could hinder the cleanup job's execution, eliminating the need for temporary quota increases or workarounds.

🧠 New Feature in Public Preview: You can now enable Memory to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	`/gemini review`	Performs a code review for the current pull request in its current state.
Pull Request Summary	`/gemini summary`	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	`/gemini help`	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

coderabbitai · 2025-12-30T09:50:57Z

📝 Walkthrough

Walkthrough

A Kubernetes cleanup job template is updated to use a fixed namespace reference (cozy-system) instead of a dynamic one, and the job's hook-weight annotation is adjusted from -5 to 0.

Changes

Cohort / File(s)	Summary
Kubernetes Manifest Configuration `packages/apps/tenant/templates/cleanup-job.yaml`	Updated ServiceAccount, RoleBinding, and Job namespace references from dynamic `{{ include "tenant.name" . }}` to fixed `cozy-system`. Modified Job hook-weight annotation from `-5` to `0`.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~8 minutes

Poem

🐰 A job that cleans with namespace care,
From dynamic paths to cozy-system there,
The hook-weight shifts with gentle ease,
A rabbit's touch brings Kubernetes peace! 🌿

Pre-merge checks

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and accurately describes the main change: moving the cleanup job execution from the tenant namespace to the system namespace.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

📜 Recent review details

Configuration used: defaults

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 715509f and b94fc6c.

📒 Files selected for processing (1)

packages/apps/tenant/templates/cleanup-job.yaml

🧰 Additional context used

📓 Path-based instructions (2)

packages/apps/**

📄 CodeRabbit inference engine (AGENTS.md)

Use Helm Chart umbrella pattern with vendored upstream charts in charts/ directory

Files:

packages/apps/tenant/templates/cleanup-job.yaml

**/*.yaml

📄 CodeRabbit inference engine (AGENTS.md)

Do NOT directly edit upstream Helm charts in vendored charts directory; use proper chart vendoring mechanisms

Files:

packages/apps/tenant/templates/cleanup-job.yaml

⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)

GitHub Check: Build

🔇 Additional comments (4)

packages/apps/tenant/templates/cleanup-job.yaml (4)

3-10: LGTM: ServiceAccount moved to cozy-system namespace.

The ServiceAccount is correctly moved to cozy-system to match the Job's namespace. This ensures the cleanup job can run without being constrained by tenant resource quotas.

13-24: LGTM: Role correctly remains in tenant namespace.

The Role stays in the tenant namespace, which is correct since Roles can only grant permissions on resources within their own namespace. The RoleBinding will connect this Role to the ServiceAccount in cozy-system.

27-42: LGTM: RoleBinding correctly references ServiceAccount from cozy-system.

The cross-namespace RoleBinding is properly configured. It binds the Role (in the tenant namespace) to the ServiceAccount (in cozy-system), allowing the cleanup job to delete helmreleases in the tenant namespace.

44-85: The cozy-system namespace usage is properly supported.

The Job correctly runs from cozy-system namespace as intended, avoiding tenant resource quota constraints. Both prerequisites are met:

The cozy-system namespace is created as part of the cozystack core installer (packages/core/installer/templates/cozystack.yaml) before tenant charts are deployed

The hook-weight ordering (ServiceAccount/RBAC at "-5", Job at "0") ensures proper creation sequencing

No action needed.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

gemini-code-assist

Code Review

This pull request moves the tenant cleanup job to the cozy-system namespace to avoid potential resource quota issues within the tenant namespace. The changes in packages/apps/tenant/templates/cleanup-job.yaml correctly update the namespaces for the ServiceAccount and Job, and adjust the RoleBinding to grant the service account permissions in the tenant namespace. The implementation is sound and correctly configured. The changes look good.

kvaps

LGTM

github-actions · 2025-12-30T11:03:20Z

Successfully created backport PR for release-0.39:

[Backport release-0.39] [tenant] Run cleanup job from system namespace #1777

#1777) # Description Backport of #1774 to `release-0.39`.

## What this PR does The Helm hook that creates a job deleting all applications in a tenant before deleting the tenant itself now runs this job from the cozy-system namespace. This prevents conflicts with resource quotas (not enough resources to run cleanup job) without temporary increases of the quota or similar vulnerability-introducing hacks. ### Release note ```release-note [tenant] Run cleanup job in system namespace to avoid conflicts on resource quotas. ```  ## Summary by CodeRabbit * **Infrastructure Updates** * Updated cleanup job namespace targeting to use a fixed system configuration * Adjusted cleanup job execution priority level <sub>✏️ Tip: You can customize this high-level summary in your review settings.</sub>

lllamnyp requested review from kvaps and nbykov0 as code owners December 30, 2025 09:50

dosubot bot added the size:XS This PR changes 0-9 lines, ignoring generated files. label Dec 30, 2025

lllamnyp linked an issue Dec 30, 2025 that may be closed by this pull request

Tenant with loadbalancer quota cannot be deleted #1746

Closed

gemini-code-assist bot reviewed Dec 30, 2025

View reviewed changes

kvaps added the backport Should change be backported on previus release label Dec 30, 2025

kvaps approved these changes Dec 30, 2025

View reviewed changes

dosubot bot added the lgtm This PR has been approved by a maintainer label Dec 30, 2025

kvaps merged commit dea42d0 into main Dec 30, 2025
28 checks passed

kvaps deleted the fix/tenant-cleanup-quotas branch December 30, 2025 11:03

github-actions bot mentioned this pull request Dec 30, 2025

[Backport release-0.39] [tenant] Run cleanup job from system namespace #1777

Merged

kvaps mentioned this pull request Dec 30, 2025

[tenant] fix destroy when resource limits was reached #1757

Closed

kvaps added a commit that referenced this pull request Dec 30, 2025

[Backport release-0.39] [tenant] Run cleanup job from system namespace (

85a0003

#1777) # Description Backport of #1774 to `release-0.39`.

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

[tenant] Run cleanup job from system namespace #1774

[tenant] Run cleanup job from system namespace #1774

Uh oh!

lllamnyp commented Dec 30, 2025 •

edited by coderabbitai bot

Loading

Uh oh!

gemini-code-assist bot commented Dec 30, 2025

Uh oh!

coderabbitai bot commented Dec 30, 2025 •

edited

Loading

Walkthrough

Changes

Estimated code review effort

Poem

Uh oh!

gemini-code-assist bot left a comment

Uh oh!

kvaps left a comment

Uh oh!

Uh oh!

github-actions bot commented Dec 30, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

[tenant] Run cleanup job from system namespace #1774

[tenant] Run cleanup job from system namespace #1774

Uh oh!

Conversation

lllamnyp commented Dec 30, 2025 • edited by coderabbitai bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What this PR does

Release note

Summary by CodeRabbit

Uh oh!

gemini-code-assist bot commented Dec 30, 2025

Summary of Changes

Highlights

Footnotes

Uh oh!

coderabbitai bot commented Dec 30, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Estimated code review effort

Poem

Pre-merge checks

Uh oh!

gemini-code-assist bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

kvaps left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

github-actions bot commented Dec 30, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

lllamnyp commented Dec 30, 2025 •

edited by coderabbitai bot

Loading

coderabbitai bot commented Dec 30, 2025 •

edited

Loading