Repository navigation
Add OP-10 Principal and Tenant removal skill - #29
Merged
Merged
Conversation
sagoyal22
requested review from
ansa-xx,
manasvik06,
snirvan and
varikooty
as code owners
November 11, 2026 01:01
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why?
Added OP-10: Remove Principal or Tenant, a new Kerberator operational skill for safely offboarding resources using native Kubernetes commands.
The skill includes four Python scripts:
precheck.py— Validates resource existence, Kubernetes permissions, and dependencies before deletion.inspect_dependencies.py— Identifies associated Principals, Secrets, and Tenant-managed resources.remove_resource.py— Reruns safety checks, requires target-specific confirmation, and executes the approved deletion.verify_removal.py— Independently verifies deletion, with bounded polling to handle Kubernetes finalizers and asynchronous cleanup.Principal deletion uses orphan propagation, while Tenant deletion uses background cascading deletion to clean up Kubernetes-owned child resources.
How was this tested?
kerberator-project).Test 1 — Disabled test Principal (
op10-e2e-2005)Created a disposable Principal, completed dependency inspection, obtained explicit deletion approval, and successfully deleted it. Independently confirmed
RESULT: VERIFIED.Test 2 — Enabled Principal (
uid-2004)Tested removal of an enabled Principal with an existing keytab Secret. Copilot inspected accessible workload references, requested approval, and successfully deleted the Principal. Independent verification returned
RESULT: VERIFIED, and the three remaining Principals were confirmed healthy.Both tests demonstrated approval handling, dependency checks, and successful deletion without automatically removing referenced Secrets.
Breaking changes
This PR adds a new operational skill without modifying the Kerberator API or CRD schemas.
Docs
SKILL.mddocumenting the complete OP-10 workflow, approval requirements, and safety restrictions.Safety and limitations
Deletion requires explicit approval for the exact resource, namespace, and context. The scripts perform read-only prechecks before modifying resources and independently verify results.
Tenant deletion is implemented but has not yet been tested end-to-end. Testing is pending availability of a suitable test Tenant. Current RBAC restrictions also prevent full inspection of certain Tenant-owned resources, so incomplete cleanup verification is reported rather than assumed successful.
The bounded polling logic has passed syntax and mocked checks, but live testing of the pending-to-verified transition remains outstanding.