Repository navigation
Fix group pruning script to remove all inactive users from groups synced from IdPs - #114
Merged
Merged
Conversation
|
🚀 This PR has been released as Triggering workflows 🛠️ Auto tagging enabled with label |
HappyTetrahedron
approved these changes
May 21, 2026
…from an IdP
The previous iteration of the script removed inactive users from all
groups on the cluster, which generated unnecessary ArgoCD reconciles for
groups managed by some ArgoCD and additionally could incorrectly remove
users from manually managed groups.
Additionally, because the previous script's outer loop only iterated
over all `User` resource on the cluster it could incorrectly leave some
inactive users in groups in cases where the inactive user's `User`
resource was deleted at some point in the past without removing the
corresponding entries from any groups.
The refactored script processes all OpenShift gropus which have
annotation `oauth.openshift.io/generated=true`. It iterates through
`.users` of each of those groups and removes any users who don't have an
active oauthaccesstoken on the cluster.
Optionally, groups synced from certain IdPs can be skipped by adding the
OpenShift IdP identifier (i.e. value of `spec.identityProviders[*].name`
in the `oauth.config.openshift.io/cluster` resource) to the environment
variable `${EXCLUDED_IDP}`. The script expects that this variable is
either empty or a valid JSON array.
Note that the script uses `kubectl get -ojson | jq -r '...' | while
read` to process the list of groups and users in each group line by
line. Doing so ensures that groups and users which have a space in their
`.metadata.name` are processed correctly.
The script can be tested without actually making any changes by setting
environment variable `DRY_RUN` to a non-empty string. To test the script
you must be logged in to the target cluster and you must enable
system:admin impersonation.
This allows users to configure the prune cronjob to skip groups synced from certain IdPs.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The previous iteration of the script removed inactive users from all groups on the cluster, which generated unnecessary ArgoCD reconciles for groups managed by some ArgoCD and additionally could incorrectly remove users from manually managed groups.
Additionally, because the previous script's outer loop only iterated over all
Userresource on the cluster it could incorrectly leave some inactive users in groups in cases where the inactive user'sUserresource was deleted at some point in the past without removing the corresponding entries from any groups.The refactored script processes all OpenShift gropus which have annotation
oauth.openshift.io/generated=true. It iterates through.usersof each of those groups and removes any users who don't have an active oauthaccesstoken on the cluster.Optionally, groups synced from certain IdPs can be skipped by adding the OpenShift IdP identifier (i.e. value of
spec.identityProviders[*].namein theoauth.config.openshift.io/clusterresource) to the environment variable${EXCLUDED_IDP}. The script expects that this variable is either empty or a valid JSON array.Note that the script uses
kubectl get -ojson | jq -r '...' | while readto process the list of groups and users in each group line by line. Doing so ensures that groups and users which have a space in their.metadata.nameare processed correctly.The script can be tested without actually making any changes by setting environment variable
DRY_RUNto a non-empty string. To test the script you must be logged in to the target cluster and you must enable system:admin impersonation.The second commit in the PR exposes the ability to skip groups synced from certain IdPs by introducing a new component parameter
groupPrune.excluded_idpswhich is passed to the script as environment variableEXCLUDED_IDP.Fixes #111
Checklist
changelog.
The PR has a meaningful description that sums up the change. It will be
linked in the changelog.
bug,enhancement,documentation,change,breaking,dependencyas they show up in the changelog.