Resource Deletion Protection
Karmada provides deletion protection for resources, and it is enabled by default.
Resource deletion protection can be applied to any resource type, including but not limited to Kubernetes native resources, CRDs, and more.
When a resource is marked as protected, all delete operations on it will be denied.
Protecting a Resource
Karmada uses Labels to protect resources. If you want to protect a resource, you can label it with resourcetemplate.karmada.io/deletion-protected=Always
.
Protection will be effective when the Value is Always
only.
To protect a Namespace named minio
:
kubectl label namespaces minio resourcetemplate.karmada.io/deletion-protected=Always
When you attempt to delete the protected minio
Namespace, you will see the following output:
[root@cluster1]# kubectl delete namespaces minio
Error from server (Forbidden): admission webhook "resourcedeletionprotection.karmada.io" denied the request: This resource is protected, please make sure to remove the label: resourcetemplate.karmada.io/deletion-protected
Unprotecting a Resource
If you want to remove Karmada's protection from a resource, you only need to remove the resourcetemplate.karmada.io/deletion-protected
Label.
kubectl label namespaces minio resourcetemplate.karmada.io/deletion-protected-
Alternatively, you can directly change its value to a value other than Always
, such as Never
.
kubectl label namespaces minio resourcetemplate.karmada.io/deletion-protected=Never --overwrite
Special Cases
Deleting a Namespace Containing Protected Resources
If a Namespace is not protected but contains protected resources, the deletion of that Namespace will not be successful.
Force Deletion (--force)
Even when using --force
to delete a protected resource, it will not be deleted.
[root@cluster1]# kubectl delete namespace minio --force
Warning: Immediate deletion does not wait for confirmation that the running resource has been terminated. The resource may continue to run on the cluster indefinitely.
Error from server (Forbidden): admission webhook "resourcedeletionprotection.karmada.io" denied the request: This resource is protected, please make sure to remove the label: resourcetemplate.karmada.io/deletion-protected