✨ Sweep resources orphaned by deleted runs

[ibolton336]

Summary

• audit and test the existing AgentRun → Sandbox/Secret/ConfigMap and AgentWorkflowRun → stage AgentRun ownership chain
• sweep labeled Sandboxes, Pods, ConfigMaps, Secrets, and stage AgentRuns when their owning run is gone
• confirm cache misses against the API server and preserve resources controlled by another owner
• add the required cleanup watches, RBAC, and changelog fragment

Testing

• go vet ./...
• KUBEBUILDER_ASSETS=bin/k8s/1.36.2-linux-arm64 go test $(go list ./... | grep -v /e2e) -coverprofile cover.out
• YQ=bin/yq hack/changelog.sh validate

Fixes #200

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Team

Run ID: 455d0532-d317-4ae7-b3bd-837e203b5831

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[djzager]

Reviewed the full change against the surrounding controller code — nice work. The owner-reference-first / label-sweep-as-recovery framing is sound, the apiReader re-check before deleting correctly guards against unordered cross-type informer events, and mayDeleteForMissingOwner properly refuses to touch objects controlled by another controller. I confirmed all swept types (Sandbox, params + inline-skill ConfigMaps, ACP Secret) carry both app.kubernetes.io/managed-by and konveyor.io/agentrun at creation, so the sweep selector actually finds them, and that apiReader is wired on both reconcilers.

A few non-blocking notes:

1. Test gap: the pod deletion guard's production path isn't exercised.
In agentrun_controller_test.go, the swept Pod is created ownerless, so it deletes via the ownerless branch of mayDeleteForMissingOwner. In production the pod is owned by the Sandbox, so deletion goes through the apiVersion == "agents.x-k8s.io/v1beta1" && Kind == "Sandbox" && Name == run.Name branch — which has no coverage. If any of those strings drift, pods would silently stop being swept and the tests would stay green. Worth a case with a pod that has a Sandbox controller owner reference.

2. sandboxAPIVersion/sandboxKind are hardcoded, unlike the AgentRun side.
run_cleanup.go derives the AgentRun owner apiVersion from konveyoriov1alpha1.GroupVersion.String() but hardcodes sandboxAPIVersion = "agents.x-k8s.io/v1beta1". It matches agent-sandbox v0.5.0 today, but a dependency bump would silently break the pod guard in (1) with no compile error. Deriving it from sandboxv1beta1.GroupVersion.String() keeps the two in lockstep.

3. Minor: categorization. :sparkles: + kind: enhancement is consistent with issue #200's label, but the behavior (stop leaking dangling Sandboxes/Pods/ConfigMaps/Secrets) reads like a bugfix. Purely a labeling judgment call — take it or leave it.

Nothing here blocks merge from my side.