[Risk Mitigation] Create cleanup script for removing redundant ClusterRoleBinding which were previously labeled with managed-by: reconciler

[tobiscr]

Description

After migration from provisioner to KIM is completed, we have to remove redundant ClusterRoleBindings which were initially managed by reconciler (marked by the managed-by: provisioner label).

This is the follow-up action of #556 to remove replaced ClusterRoleBindings.

Before the deletion of a ClusterRoleBinding happens, following conditions have to be fulfilled:

1. Check if an equivalent ClusterRoleBinding exists which is managed by KIM:
   • if YES -> delete CRB and we are done
   • if NO -> go ahead with step 2
2. If not ClusterRoleBinding exists which is managed by KIM, check in RuntimeCR if the referenced User in CRB is still member of the administrator list.
   • If NO -> delete CRB and we are done
   • if YES -> should never happen! FAILURE case, report error to @kyma-project/framefrog team.

AC:

• redundant / outdated ClusterRoleBinding with label managed-by: provisioner are removed from SKR if one of the conditions is fulfilled:
  • the same ClusterRoleBinding is provided by KIM
  • the referenced User in the CRB is no longer an administrator (not member of administrator list in RuntimeCR)

Reasons

Remove redundant ClusterRoleBindings from SKRs.

Attachments