Tenant Owner Reference on namespaces is lost after restoring from Velero backup

[bsctl]

Bug description

The Tenant Owner Reference on namespaces is lost after restoring from backup using Velero.

[Velero requires cluster admin permission, so the restore is performed by the cluster admin and not by the tenant owner. Strictly speaking it's not a bug, since it works by design. However we should address this in some way because it is a requirement from project adopters].

How to reproduce

1. As cluster admin, create a tenant

apiVersion: capsule.clastix.io/v1alpha1
kind: Tenant
metadata:
  name: oil
spec:
  owner:
    name: alice
    kind: User

2. As tenant owner, alice, create one or more namespaces in the tenant

$ kubectl --as alice --as-group capsule.clastix.io create ns oil-production
$ kubectl --as alice --as-group capsule.clastix.io create ns oil-development
$ kubectl --as alice --as-group capsule.clastix.io create ns oil-marketing

3. namespaces have correctly the Owner Reference set

apiVersion: v1
kind: Namespace
metadata:
  annotations:
    capsule.clastix.io/allowed-registries: docker.io,quay.io
    capsule.clastix.io/ingress-classes: cmp,haproxy
    capsule.clastix.io/storage-classes: standard
    scheduler.alpha.kubernetes.io/node-selector: pool=cmp
  labels:
    capsule.clastix.io/tenant: oil
    name: oil-marketing
  name: oil-marketing
  ownerReferences:
  - apiVersion: capsule.clastix.io/v1alpha1
    blockOwnerDeletion: true
    controller: true
    kind: Tenant
    name: oil
spec:
  finalizers:
  - kubernetes

4. Tenant state is correctly updated

$ kubectl get tnt oil
NAME   NAMESPACE QUOTA   NAMESPACE COUNT   OWNER NAME   OWNER KIND   NODE SELECTOR    AGE
oil    9                 3                 alice        User         {"pool":"cmp"}   12h

5. As cluster admin, take a backup of the tenant, using Velero for example

$ velero create backup oil --include-namespaces='oil-production,oil-development,oil-marketing'

6. As tenant owner, delete a namespace

$ kubectl --as alice --as-group capsule.clastix.io delete ns oil-marketing

7. As cluster admin, restore from previous backup

$ kubectl get ns -l capsule.clastix.io/tenant=oil
NAME              STATUS   AGE
oil-development   Active   11h
oil-production    Active   11h

$ velero create restore --from-backup oil

$ kubectl get ns -l capsule.clastix.io/tenant=oil
NAME              STATUS   AGE
oil-development   Active   11h
oil-marketing     Active   11m
oil-production    Active   11h

8. the restored namespace misses the Tenant Owner Reference

apiVersion: v1
kind: Namespace
metadata:
  annotations:
    capsule.clastix.io/allowed-registries: docker.io,quay.io
    capsule.clastix.io/ingress-classes: cmp,haproxy
    capsule.clastix.io/storage-classes: standard
    scheduler.alpha.kubernetes.io/node-selector: pool=cmp
  labels:
    capsule.clastix.io/tenant: oil
    name: oil-marketing
  name: oil-marketing
spec:
  finalizers:
  - kubernetes

and the Tenant namespace count is not updated

$ kubectl get tnt oil
NAME   NAMESPACE QUOTA   NAMESPACE COUNT   OWNER NAME   OWNER KIND   NODE SELECTOR    AGE
oil    9                 2                 alice        User         {"pool":"cmp"}   12h

Expected behavior

After restore, the namespaces should keep the Tenant Owner Reference even if the restore is made by cluster admin and not by tenant owner.

Logs

If applicable, please provide logs of capsule.

In a standard stand-alone installation of Capsule,
you'd get this by running kubectl -n capsule-system logs deploy/capsule-controller-manager.

Additional context

• Capsule version: v0.1.0-rc2
• Helm Chart version: (helm list -n capsule-system)
• Kubernetes version: (kubectl version)

[prometherion]

Velero dropping the OwnerReferences is reasonable, although not effective from the developer experience perspective.

Capsule is entirely based on the OwnerReference field for bounding Namespace resources to the Tenant one and changing this approach would require a huge refactoring since that would mean re-engineering the solution, also considering the fact this is a limitation by Velero itself, tho.

To avoid this issue I guess we could easily create a sort of utility, outside of the Capsule Controller Manager code-base that should patch the Namespace resources with the desired OwnerReferences.

We could get the list of the Tenants, extracting their names and UIDs. With the name, we just need to get the list of Namespace resources (kubectl get namespaces -l capsule.clastix.io/tenant=${TENANT_NAME}) and patch each resource (kubectl patch namespaces ${NAMESPACE} --type=json -p '[{"op": "add", "path": "/metadata/ownerReferences", "value": [{"apiVersion": "capsule.clastix.io/v1alpha1", "blockOwnerDeletion": true, "controller": true, "kind": "Tenant", "name": "${TENANT_NAME}", "uid": "${TENANT_UID}"}]}]').

This bash script could be executed by the Cluster Administrator upon Velero backup restore.