From ff5656cd0d18c53c65d7cc54e7306358cdc2c5e4 Mon Sep 17 00:00:00 2001 From: Moritz Clasmeier Date: Wed, 28 Oct 2026 15:36:55 +0100 Subject: [PATCH] Wait for scanner-v4-db PVC cleanup --- internal/deployer/deployer.go | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/internal/deployer/deployer.go b/internal/deployer/deployer.go index 9c9ad1a..628775f 100644 --- a/internal/deployer/deployer.go +++ b/internal/deployer/deployer.go @@ -118,6 +118,10 @@ func (d *Deployer) deleteCentralResources(ctx context.Context) error { for _, resource := range []ResourceToDelete{ {Name: "central-db", Kind: "pvc"}, {Name: "central-db-backup", Kind: "pvc"}, + // scanner-v4-db is not managed by the operator's ReconcilePVCExtension, so its ownerReference + // is only cleaned up by K8s GC. On redeploy, GC may not finish before the new CR is created, + // leaving a stale ownerReference that causes the operator to error-loop. See #291. + {Name: "scanner-v4-db", Kind: "pvc", OwnerName: centralCrName}, {Name: "admin-password", Kind: "secret"}, {Name: "scanner-db-password", Kind: "secret", OwnerName: centralCrName}, {Name: "stackrox-central-helm", Kind: "configmap"}, @@ -177,6 +181,10 @@ func (d *Deployer) deleteSecuredClusterResources(ctx context.Context) error { // Delete resources, which are treated special. for _, resource := range []ResourceToDelete{ {Name: "cluster-registration-secret", Kind: "secret"}, + // scanner-v4-db is not managed by the operator's ReconcilePVCExtension, so its ownerReference + // is only cleaned up by K8s GC. On redeploy, GC may not finish before the new CR is created, + // leaving a stale ownerReference that causes the operator to error-loop. See #291. + {Name: "scanner-v4-db", Kind: "pvc", OwnerName: securedClusterCrName}, // We need to make sure that don't accidentally delete a scanner-db-password belonging to the central CR, // when both are deployed into the same namespace. {Name: "scanner-db-password", Kind: "secret", OwnerName: securedClusterCrName},