Delete the registered APIService for "networking" API group

build/yamls/antrea-aks.yml

@@ -590,6 +590,14 @@ rules:
   verbs:
   - get
   - update
+- apiGroups:
+  - apiregistration.k8s.io
+  resourceNames:
+  - v1beta1.networking.antrea.tanzu.vmware.com
+  resources:
+  - apiservices
+  verbs:
+  - delete
 - apiGroups:
   - security.antrea.tanzu.vmware.com
   resources:

build/yamls/antrea-eks.yml

@@ -590,6 +590,14 @@ rules:
   verbs:
   - get
   - update
+- apiGroups:
+  - apiregistration.k8s.io
+  resourceNames:
+  - v1beta1.networking.antrea.tanzu.vmware.com
+  resources:
+  - apiservices
+  verbs:
+  - delete
 - apiGroups:
   - security.antrea.tanzu.vmware.com
   resources:

build/yamls/antrea-gke.yml

@@ -590,6 +590,14 @@ rules:
   verbs:
   - get
   - update
+- apiGroups:
+  - apiregistration.k8s.io
+  resourceNames:
+  - v1beta1.networking.antrea.tanzu.vmware.com
+  resources:
+  - apiservices
+  verbs:
+  - delete
 - apiGroups:
   - security.antrea.tanzu.vmware.com
   resources:

build/yamls/antrea-ipsec.yml

@@ -590,6 +590,14 @@ rules:
   verbs:
   - get
   - update
+- apiGroups:
+  - apiregistration.k8s.io
+  resourceNames:
+  - v1beta1.networking.antrea.tanzu.vmware.com
+  resources:
+  - apiservices
+  verbs:
+  - delete
 - apiGroups:
   - security.antrea.tanzu.vmware.com
   resources:

build/yamls/antrea.yml

@@ -590,6 +590,14 @@ rules:
   verbs:
   - get
   - update
+- apiGroups:
+  - apiregistration.k8s.io
+  resourceNames:
+  - v1beta1.networking.antrea.tanzu.vmware.com
+  resources:
+  - apiservices
+  verbs:
+  - delete
 - apiGroups:
   - security.antrea.tanzu.vmware.com
   resources:

build/yamls/base/controller-rbac.yml

@@ -91,6 +91,16 @@ rules:
     verbs:
       - get
       - update
+  - apiGroups:
+      - apiregistration.k8s.io
+    resources:
+      - apiservices
+    resourceNames:
+      # Add the APIServices for the deprecated APIGroups here. antrea-controller
+      # will try to delete the APIServices if they are registered.
+      - v1beta1.networking.antrea.tanzu.vmware.com
+    verbs:
+      - delete
   - apiGroups:
       - security.antrea.tanzu.vmware.com
     resources:

cmd/antrea-controller/controller.go

@@ -130,6 +130,12 @@ func run(o *Options) error {
 	if err != nil {
 		return fmt.Errorf("error creating API server: %v", err)
 	}
+
+	err = apiserver.CleanupDeprecatedAPIServices(aggregatorClient)
+	if err != nil {
+		return fmt.Errorf("failed to clean up the deprecated APIServices: %v", err)
+	}
+
 	// Set up signal capture: the first SIGTERM / SIGINT signal is handled gracefully and will
 	// cause the stopCh channel to be closed; if another signal is received before the program
 	// exits, we will force exit.

pkg/apiserver/apiserver.go

@@ -15,6 +15,9 @@
 package apiserver
 
 import (
+	"context"
+
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apimachinery/pkg/runtime/schema"
@@ -23,6 +26,7 @@ import (
 	genericapiserver "k8s.io/apiserver/pkg/server"
 	"k8s.io/client-go/informers"
 	"k8s.io/klog"
+	"k8s.io/kube-aggregator/pkg/client/clientset_generated/clientset"
 
 	"github.com/vmware-tanzu/antrea/pkg/apis/controlplane"
 	networkinginstall "github.com/vmware-tanzu/antrea/pkg/apis/controlplane/install"
@@ -165,3 +169,25 @@ func (c completedConfig) New() (*APIServer, error) {
 
 	return s, nil
 }
+
+// CleanupDeprecatedAPIServices deletes the registered APIService resources for
+// the deprecated Antrea API groups.
+func CleanupDeprecatedAPIServices(aggregatorClient clientset.Interface) error {
+	// The APIService of a deprecated API group should be added to the slice.
+	// After Antrea upgrades from an old version to a new version that
+	// deprecates a registered APIService, the APIService should be deleted,
+	// otherwise K8s will fail to delete an existing Namespace.
+	// Also check: https://github.com/vmware-tanzu/antrea/issues/494
+	deprecatedAPIServices := []string{
+		"v1beta1.networking.antrea.tanzu.vmware.com",
+	}
+	for _, as := range deprecatedAPIServices {
+		err := aggregatorClient.ApiregistrationV1().APIServices().Delete(context.TODO(), as, metav1.DeleteOptions{})
+		if err == nil {
+			klog.Infof("Deleted the deprecated APIService %s", as)
+		} else if !apierrors.IsNotFound(err) {
+			return err
+		}
+	}
+	return nil
+}