Warning "Secret '[...]' not registered with controller !" for secrets created by rook ceph ObjectBucketClaim

[phihos]

After upgrading the IC from 1.11 to 3.0 we suddenly got this warning two times:

WARNING store/events.go:250  Secret '[...]' not registered with controller !

In both cases it was a secret generated for a ObjectBucketClaim resource. It is apparent that this is not intended.

Theory: Both secrets have an owner reference like this:

  ownerReferences:
  - apiVersion: objectbucket.io/v1alpha1
    blockOwnerDeletion: true
    controller: true
    kind: ObjectBucketClaim

Could it be that the IC watches an overly broad selector which checks for ownerReferences[*].controller==true or similar?

[hdurand0710]

Hi @phihos

As IC still supports ingressClass in annotations, it's not possible to define a watch selector.
As it got deprecated since k8s 1.18, the plan is to add a deprecation warning in IC logs in the current versions and remove totally this support in the next versions, allowing to define a watch selector.

[phihos]

Hi @hdurand0710,
ok that makes sense of course. But in that case I argue that the warning log message should be suppressed. The ObjectBucketClaim secrets are not related to any Ingress resource.

[hdurand0710]

@phihos : agreed!