just fyi, the certs have the same service labelSelector as the route.

 labels:
    osctlplane-service: nova-novncproxy

two notes on this

• This will delete all certs with the routeBaseName prefixed, which means it will also delete e.g. the internal svc cert, even it is not 1:1 related to the route. In general I think right now that is okish, since we have a single deployment as the backend for the internal and public k8s services. If for some reason we change to have independent deployments and one could still be around when the one for the route get deleted, there would be a not necessary restart since we delete the svc cert when the route is gone, the openstack-op will reconcile, and create the a new cert for it which results in a restart of the deployment.

• some services don't create a route, so this cleanup will not delete the certs their k8s service if they get deleted.

With this I think we want to be explicite in what we delete. We already checked that the public k8s svc is gone. So we can delete the route cert, the public k8s cert and the route. We should also check if the internal k8s svc is gone and only delete the cert when it is.

If it helps to man cleanup task easier, when we create the certs, the serviceCertSelector get passed as a label [1][2][3]. We can add additional labels to filter for public/internal/route and k8s svc object name it was created for, or other use case, like a cell label in [4] to the vencrypt cert to make the cleanup of those easier. Maybe we split it to only focus here on the route, its cert and the k8s svc and handle the vencrypt cert in a follow up.

[1] https://github.com/openstack-k8s-operators/openstack-operator/blob/main/pkg/openstack/common.go#L322
[2] https://github.com/openstack-k8s-operators/openstack-operator/blob/main/pkg/openstack/common.go#L372
[3] https://github.com/openstack-k8s-operators/openstack-operator/blob/main/pkg/openstack/common.go#L609
[4] https://github.com/openstack-k8s-operators/openstack-operator/blob/main/pkg/openstack/nova.go#L305

to cleanup route cert could be just if route.Name+"-route" == cert.Name && object.CheckOwnerRefExist(instance.GetUID(), cert.OwnerReferences) {

With this I think we want to be explicite in what we delete. We already checked that the public k8s svc is gone. So we can delete the route cert, the public k8s cert and the route. We should also check if the internal k8s svc is gone and only delete the cert when it is.

Sounds good to me.

With this I think we want to be explicite in what we delete. We already checked that the public k8s svc is gone. So we can delete the route cert, the public k8s cert and the route. We should also check if the internal k8s svc is gone and only delete the cert when it is.

Sounds good to me.

I think this still has the issue that you could cleanup internal svc cert when it may be still required. lets take barbican as an example:

$ oc get route
NAME                           HOST/PORT                                                 PATH   SERVICES                       PORT                           TERMINATION     WILDCARD
barbican-public                barbican-public-openstack.apps-crc.testing                       barbican-public                barbican-public                edge/Redirect   None

we remove -public which leaves e.g. barbican.

the certs have this naming format:

$ oc get cert
NAME                                 READY   SECRET                                    AGE
barbican-internal-svc                True    cert-barbican-internal-svc                0s
barbican-public-route                True    cert-barbican-public-route                2m19s
barbican-public-svc                  True    cert-barbican-public-svc                  0s

So we'd delete all certs public, route and internal without checking if the internal svc is really gone. I think for now lets just do if _, ok := cert.Labels[serviceCertSelector]; ok && strings.Contains(cert.Name, route.Name) { and keep the internal svc cert. we can follow up with cleaning up the internal svc certs.

ack,
specifically for novncproxy added cert.Spec.CommonName to match with route.Name for now, commonName is not present in all certs.

Also as discussed in slack, I think we should add osctlplane-service for all types of certs.
will fix above too once its added