Repository navigation
bug: APIBinding lock on crd deletion is not removed from logicalCluster annotation #3799
Description
Describe the bug
When adding and deleting a crd in a workspace the GRV lock does not gets cleaned up, so one cannot create an APIBinding for the same apigroup (refer to slack thread https://kubernetes.slack.com/archives/C021U8WSAFK/p1769013090663529).
I suspect there is an issue that the expiry property is not written in the logicalcluster annotation: https://github.com/kcp-dev/kcp/blob/release-0.29/pkg/reconciler/apis/apibinding/logical_cluster_lock.go
Steps To Reproduce
- Create an example CRD
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
name: networks.foo.bar.com
spec:
group: foo.bar.com
versions:
- name: v1alpha1
served: true
storage: true
schema:
openAPIV3Schema:
type: object
properties:
spec:
type: object
properties:
foo:
type: string
bar:
type: integer
scope: Namespaced
names:
plural: networks
singular: network
kind: Network- Delete the created CRD
- Take a look at the logicalCluster annotation:
kubectl get logicalcluster cluster -o jsonpath='{.metadata.annotations.internal\.apis\.kcp\.io\/resource-bindings}'There is an entry "networks.foo.bar":{"c":true} showing the binded crd although it is deleted and there is no "e" property set.
- Even after waiting the suggested 30s the entry is not cleaned up.
Expected Behaviour
When a CRD is deleted the annotation is cleaned up (maybe with a delay allowed by CRDExpiry) so one can create an APIBinding for the same apigroup.
Additional Context
No response
Metadata
Metadata
Assignees
Labels
Type
Projects
- Status
Activity
AutuSnow commentedon Jan 24, 2026
/assign
kcp-ci-bot commentedon Apr 24, 2026
Issues go stale after 90d of inactivity.
After a furter 30 days, they will turn rotten.
Mark the issue as fresh with
/remove-lifecycle stale.If this issue is safe to close now please do so with
/close./lifecycle stale
kcp-ci-bot commentedon Jun 11, 2026
Stale issues rot after 30d of inactivity.
Mark the issue as fresh with
/remove-lifecycle rotten.Rotten issues close after an additional 30d of inactivity.
If this issue is safe to close now please do so with
/close./lifecycle rotten
fix(apibinding): release CRD resource lock when the CRD is deleted
BergCyrill commentedon Jun 27, 2026
/remove-lifecycle rotten
BergCyrill commentedon Jun 27, 2026
/assign
fix(apibinding): release CRD resource lock when the CRD is deleted