fix(zitadelctl): implementation for commands in crd mode (#1685)

* fix(zitadelctl): implement takedown command * fix(zitadelctl): correct destroy flow * fix(zitadelctl): correct backup commands to read crds beforehand * fix: add of destroyfile * fix: clean for userlist * fix: determine mode by --gitops flag for backups * refactor: return error instead of higher order function * fix(destroy): needs no self-reconciling Co-authored-by: Elio Bischof <[email protected]> * fix(destroy): needs no self-reconciling Co-authored-by: Elio Bischof <[email protected]> * fix(logs): fix double handled error Co-authored-by: Elio Bischof <[email protected]> * fix(logs): fix double handled error Co-authored-by: Elio Bischof <[email protected]> * fix(logs): fix double handled error Co-authored-by: Elio Bischof <[email protected]> * fix(logs): fix double handled error Co-authored-by: Elio Bischof <[email protected]> * fix(logs): fix double handled error Co-authored-by: Elio Bischof <[email protected]> * fix(logs): fix double handled error Co-authored-by: Elio Bischof <[email protected]> * fix(logs): fix double handled error Co-authored-by: Elio Bischof <[email protected]> * fix(logs): fix double handled error Co-authored-by: Elio Bischof <[email protected]> * fix(logs): fix double handled error Co-authored-by: Elio Bischof <[email protected]> * fix(logs): fix double handled error Co-authored-by: Elio Bischof <[email protected]> * fix(logs): fix double handled error Co-authored-by: Elio Bischof <[email protected]> * fix(logs): fix double handled error Co-authored-by: Elio Bischof <[email protected]> * fix(logs): fix double handled error Co-authored-by: Elio Bischof <[email protected]> * fix(logs): fix double handled error Co-authored-by: Elio Bischof <[email protected]> * fix(logs): fix double handled error Co-authored-by: Elio Bischof <[email protected]> * fix(logs): fix double handled error Co-authored-by: Elio Bischof <[email protected]> * fix(logs): fix double handled error Co-authored-by: Elio Bischof <[email protected]> * fix(logs): fix double handled error Co-authored-by: Elio Bischof <[email protected]> * fix(logs): fix double handled error Co-authored-by: Elio Bischof <[email protected]> * fix(logs): fix double handled error Co-authored-by: Elio Bischof <[email protected]> * fix(logs): fix double handled error Co-authored-by: Elio Bischof <[email protected]> * fix(logs): fix double handled error Co-authored-by: Elio Bischof <[email protected]> * fix(logs): fix double handled error Co-authored-by: Elio Bischof <[email protected]> * fix(logs): fix double handled error Co-authored-by: Elio Bischof <[email protected]> * fix(logs): fix double handled error Co-authored-by: Elio Bischof <[email protected]> * fix(logs): fix double handled error Co-authored-by: Elio Bischof <[email protected]> * fix(logs): fix double handled error Co-authored-by: Elio Bischof <[email protected]> Co-authored-by: Elio Bischof <[email protected]>
2026-11-13 17:35:12 +00:00 · 2021-07-20 15:47:48 +02:00
parent 413ed80611
commit 25c9d7371d
48 changed files with 1084 additions and 275 deletions
@@ -0,0 +1,34 @@
+package database
+
+import (
+	"github.com/caos/orbos/mntr"
+	"github.com/caos/orbos/pkg/git"
+	"github.com/caos/orbos/pkg/kubernetes"
+	"github.com/caos/orbos/pkg/tree"
+	"github.com/caos/zitadel/operator"
+)
+
+func Destroy(
+	monitor mntr.Monitor,
+	gitClient *git.Client,
+	adapt operator.AdaptFunc,
+	k8sClient *kubernetes.Client,
+) error {
+	internalMonitor := monitor.WithField("operator", "database")
+	internalMonitor.Info("Destroy")
+	treeDesired, err := operator.Parse(gitClient, "database.yml")
+	if err != nil {
+		return err
+	}
+	treeCurrent := &tree.Tree{}
+
+	_, destroy, _, _, _, _, err := adapt(internalMonitor, treeDesired, treeCurrent)
+	if err != nil {
+		return err
+	}
+
+	if err := destroy(k8sClient); err != nil {
+		return err
+	}
+	return nil
+}
@@ -2,6 +2,7 @@ package backups

 import (
 	"github.com/caos/orbos/mntr"
+	"github.com/caos/orbos/pkg/kubernetes"
 	"github.com/caos/orbos/pkg/labels"
 	"github.com/caos/orbos/pkg/secret"
 	"github.com/caos/orbos/pkg/tree"
@@ -61,6 +62,7 @@ func Adapt(

 func GetBackupList(
 	monitor mntr.Monitor,
+	k8sClient kubernetes.ClientInt,
 	name string,
 	desiredTree *tree.Tree,
 ) (
@@ -69,7 +71,7 @@ func GetBackupList(
 ) {
 	switch desiredTree.Common.Kind {
 	case "databases.caos.ch/BucketBackup":
-		return bucket.BackupList()(monitor, name, desiredTree)
+		return bucket.BackupList()(monitor, k8sClient, name, desiredTree)
 	default:
 		return nil, errors.Errorf("unknown database kind %s", desiredTree.Common.Kind)
 	}
@@ -116,6 +116,7 @@ func AdaptFunc(
 			namespace,
 			componentLabels,
 			[]string{},
+			[]string{},
 			nodeselector,
 			tolerations,
 			checkDBReady,
@@ -162,6 +163,11 @@ func AdaptFunc(
 					databases = []string{}
 				}

+				users, err := currentDB.GetListUsersFunc()(k8sClient)
+				if err != nil {
+					users = []string{}
+				}
+
 				value, err := read.GetSecretValue(k8sClient, desiredKind.Spec.ServiceAccountJSON, desiredKind.Spec.ExistingServiceAccountJSON)
 				if err != nil {
 					return nil, err
@@ -218,6 +224,7 @@ func AdaptFunc(
 					namespace,
 					componentLabels,
 					databases,
+					users,
 					nodeselector,
 					tolerations,
 					checkDBReady,
@@ -153,7 +153,7 @@ func TestBucket_AdaptBackup(t *testing.T) {

 	assert.NoError(t, err)
 	databases := []string{"test1", "test2"}
-	queried := SetQueriedForDatabases(databases)
+	queried := SetQueriedForDatabases(databases, []string{})
 	ensure, err := query(client, queried)
 	assert.NoError(t, err)
 	assert.NotNil(t, ensure)
@@ -228,7 +228,7 @@ func TestBucket_AdaptInstantBackup(t *testing.T) {

 	assert.NoError(t, err)
 	databases := []string{"test1", "test2"}
-	queried := SetQueriedForDatabases(databases)
+	queried := SetQueriedForDatabases(databases, []string{})
 	ensure, err := query(client, queried)
 	assert.NotNil(t, ensure)
 	assert.NoError(t, err)
@@ -304,7 +304,7 @@ func TestBucket_AdaptRestore(t *testing.T) {

 	assert.NoError(t, err)
 	databases := []string{"test1", "test2"}
-	queried := SetQueriedForDatabases(databases)
+	queried := SetQueriedForDatabases(databases, []string{})
 	ensure, err := query(client, queried)
 	assert.NotNil(t, ensure)
 	assert.NoError(t, err)
@@ -380,7 +380,8 @@ func TestBucket_AdaptClean(t *testing.T) {

 	assert.NoError(t, err)
 	databases := []string{"test1", "test2"}
-	queried := SetQueriedForDatabases(databases)
+	users := []string{"test1", "test2"}
+	queried := SetQueriedForDatabases(databases, users)
 	ensure, err := query(client, queried)
 	assert.NotNil(t, ensure)
 	assert.NoError(t, err)
@@ -30,6 +30,7 @@ func AdaptFunc(
 	namespace string,
 	componentLabels *labels.Component,
 	databases []string,
+	users []string,
 	nodeselector map[string]string,
 	tolerations []corev1.Toleration,
 	checkDBReady operator.EnsureFunc,
@@ -42,7 +43,7 @@ func AdaptFunc(
 	err error,
 ) {

-	command := getCommand(databases)
+	command := getCommand(databases, users)

 	jobDef := getJob(
 		namespace,
@@ -20,6 +20,7 @@ func TestBackup_Adapt1(t *testing.T) {
 	monitor := mntr.Monitor{}
 	namespace := "testNs"
 	databases := []string{"testDb"}
+	users := []string{"testUser"}
 	nodeselector := map[string]string{"test": "test"}
 	tolerations := []corev1.Toleration{
 		{Key: "testKey", Operator: "testOp"}}
@@ -44,6 +45,7 @@ func TestBackup_Adapt1(t *testing.T) {
 		secretKey,
 		getCommand(
 			databases,
+			users,
 		),
 		image,
 	)
@@ -57,6 +59,7 @@ func TestBackup_Adapt1(t *testing.T) {
 		namespace,
 		componentLabels,
 		databases,
+		users,
 		nodeselector,
 		tolerations,
 		checkDBReady,
@@ -78,6 +81,7 @@ func TestBackup_Adapt2(t *testing.T) {
 	monitor := mntr.Monitor{}
 	namespace := "testNs2"
 	databases := []string{"testDb1", "testDb2"}
+	users := []string{"testUser1", "testUser2"}
 	nodeselector := map[string]string{"test2": "test2"}
 	tolerations := []corev1.Toleration{
 		{Key: "testKey2", Operator: "testOp2"}}
@@ -102,6 +106,7 @@ func TestBackup_Adapt2(t *testing.T) {
 		secretKey,
 		getCommand(
 			databases,
+			users,
 		),
 		image,
 	)
@@ -115,6 +120,7 @@ func TestBackup_Adapt2(t *testing.T) {
 		namespace,
 		componentLabels,
 		databases,
+		users,
 		nodeselector,
 		tolerations,
 		checkDBReady,
@@ -4,6 +4,7 @@ import "strings"

 func getCommand(
 	databases []string,
+	users []string,
 ) string {
 	backupCommands := make([]string, 0)
 	for _, database := range databases {
@@ -14,12 +15,12 @@ func getCommand(
 				database,
 			}, " "))
 	}
-	for _, database := range databases {
+	for _, user := range users {
 		backupCommands = append(backupCommands,
 			strings.Join([]string{
 				"/scripts/clean-user.sh",
 				certPath,
-				database,
+				user,
 			}, " "))
 	}
 	backupCommands = append(backupCommands,
@@ -7,8 +7,9 @@ import (

 func TestClean_Command1(t *testing.T) {
 	databases := []string{}
+	users := []string{}

-	cmd := getCommand(databases)
+	cmd := getCommand(databases, users)
 	equals := "/scripts/clean-migration.sh " + certPath

 	assert.Equal(t, equals, cmd)
@@ -16,8 +17,9 @@ func TestClean_Command1(t *testing.T) {

 func TestClean_Command2(t *testing.T) {
 	databases := []string{"test"}
+	users := []string{"test"}

-	cmd := getCommand(databases)
+	cmd := getCommand(databases, users)
 	equals := "/scripts/clean-db.sh " + certPath + " test && /scripts/clean-user.sh " + certPath + " test && /scripts/clean-migration.sh " + certPath

 	assert.Equal(t, equals, cmd)
@@ -25,8 +27,9 @@ func TestClean_Command2(t *testing.T) {

 func TestClean_Command3(t *testing.T) {
 	databases := []string{"test1", "test2", "test3"}
+	users := []string{"test1", "test2", "test3"}

-	cmd := getCommand(databases)
+	cmd := getCommand(databases, users)
 	equals := "/scripts/clean-db.sh " + certPath + " test1 && /scripts/clean-db.sh " + certPath + " test2 && /scripts/clean-db.sh " + certPath + " test3 && " +
 		"/scripts/clean-user.sh " + certPath + " test1 && /scripts/clean-user.sh " + certPath + " test2 && /scripts/clean-user.sh " + certPath + " test3 && " +
 		"/scripts/clean-migration.sh " + certPath
@@ -4,6 +4,8 @@ import (
 	"cloud.google.com/go/storage"
 	"context"
 	"github.com/caos/orbos/mntr"
+	"github.com/caos/orbos/pkg/kubernetes"
+	"github.com/caos/orbos/pkg/secret/read"
 	"github.com/caos/orbos/pkg/tree"
 	"github.com/caos/zitadel/operator/database/kinds/backups/core"
 	"github.com/pkg/errors"
@@ -13,7 +15,7 @@ import (
 )

 func BackupList() core.BackupListFunc {
-	return func(monitor mntr.Monitor, name string, desired *tree.Tree) ([]string, error) {
+	return func(monitor mntr.Monitor, k8sClient kubernetes.ClientInt, name string, desired *tree.Tree) ([]string, error) {
 		desiredKind, err := ParseDesiredV0(desired)
 		if err != nil {
 			return nil, errors.Wrap(err, "parsing desired state failed")
@@ -24,7 +26,12 @@ func BackupList() core.BackupListFunc {
 			monitor.Verbose()
 		}

-		return listFilesWithFilter(desiredKind.Spec.ServiceAccountJSON.Value, desiredKind.Spec.Bucket, name)
+		value, err := read.GetSecretValue(k8sClient, desiredKind.Spec.ServiceAccountJSON, desiredKind.Spec.ExistingServiceAccountJSON)
+		if err != nil {
+			return nil, err
+		}
+
+		return listFilesWithFilter(value, desiredKind.Spec.Bucket, name)
 	}
 }

@@ -13,9 +13,9 @@ import (
 	"k8s.io/apimachinery/pkg/runtime/schema"
 )

-func SetQueriedForDatabases(databases []string) map[string]interface{} {
+func SetQueriedForDatabases(databases, users []string) map[string]interface{} {
 	queried := map[string]interface{}{}
-	core.SetQueriedForDatabaseDBList(queried, databases)
+	core.SetQueriedForDatabaseDBList(queried, databases, users)

 	return queried
 }
@@ -2,7 +2,8 @@ package core

 import (
 	"github.com/caos/orbos/mntr"
+	"github.com/caos/orbos/pkg/kubernetes"
 	"github.com/caos/orbos/pkg/tree"
 )

-type BackupListFunc func(monitor mntr.Monitor, name string, desired *tree.Tree) ([]string, error)
+type BackupListFunc func(monitor mntr.Monitor, k8sClient kubernetes.ClientInt, name string, desired *tree.Tree) ([]string, error)
@@ -45,7 +45,7 @@ func SetQueriedForDatabase(queried map[string]interface{}, databaseCurrent *tree
 	queried[queriedName] = databaseCurrent
 }

-func SetQueriedForDatabaseDBList(queried map[string]interface{}, databases []string) {
+func SetQueriedForDatabaseDBList(queried map[string]interface{}, databases, users []string) {
 	currentDBList := &CurrentDBList{
 		Common: &tree.Common{
 			Kind:    "DBList",
@@ -53,6 +53,7 @@ func SetQueriedForDatabaseDBList(queried map[string]interface{}, databases []str
 		},
 		Current: &DatabaseCurrentDBList{
 			Databases: databases,
+			Users:     users,
 		},
 	}

@@ -16,6 +16,7 @@ type CurrentDBList struct {

 type DatabaseCurrentDBList struct {
 	Databases []string
+	Users     []string
 }

 func (c *CurrentDBList) GetURL() string {
@@ -53,7 +54,9 @@ func (c *CurrentDBList) GetListDatabasesFunc() func(k8sClient kubernetes.ClientI
 }

 func (c *CurrentDBList) GetListUsersFunc() func(k8sClient kubernetes.ClientInt) ([]string, error) {
-	return nil
+	return func(k8sClient kubernetes.ClientInt) ([]string, error) {
+		return c.Current.Users, nil
+	}
 }

 func (c *CurrentDBList) GetAddUserFunc() func(user string) (operator.QueryFunc, error) {
@@ -2,6 +2,7 @@ package databases

 import (
 	"github.com/caos/orbos/mntr"
+	"github.com/caos/orbos/pkg/kubernetes"
 	"github.com/caos/orbos/pkg/labels"
 	"github.com/caos/orbos/pkg/secret"
 	"github.com/caos/orbos/pkg/tree"
@@ -65,6 +66,7 @@ func Adapt(

 func GetBackupList(
 	monitor mntr.Monitor,
+	k8sClient kubernetes.ClientInt,
 	desiredTree *tree.Tree,
 ) (
 	[]string,
@@ -72,7 +74,7 @@ func GetBackupList(
 ) {
 	switch desiredTree.Common.Kind {
 	case "databases.caos.ch/CockroachDB":
-		return managed.BackupList()(monitor, desiredTree)
+		return managed.BackupList()(monitor, k8sClient, desiredTree)
 	case "databases.caos.ch/ProvidedDatabse":
 		return nil, errors.Errorf("no backups supported for database kind %s", desiredTree.Common.Kind)
 	default:
@@ -142,22 +142,11 @@ func Adapter(
 			cockroachHTTPPort,
 		)

-		//externalName := "cockroachdb-public." + namespaceStr + ".svc.cluster.local"
-		//queryES, destroyES, err := service.AdaptFunc("cockroachdb-public", "default", labels, []service.Port{}, "ExternalName", map[string]string{}, false, "", externalName)
-		//if err != nil {
-		//	return nil, nil, err
-		//}
-
 		queryPDB, err := pdb.AdaptFuncToEnsure(namespace, labels.MustForName(componentLabels, pdbName), cockroachSelector, "1")
 		if err != nil {
 			return nil, nil, nil, nil, nil, false, err
 		}

-		destroyPDB, err := pdb.AdaptFuncToDestroy(namespace, pdbName)
-		if err != nil {
-			return nil, nil, nil, nil, nil, false, err
-		}
-
 		currentDB := &Current{
 			Common: &tree.Common{
 				Kind:    "databases.caos.ch/CockroachDB",
@@ -188,7 +177,6 @@ func Adapter(

 		if isFeatureDatabase {
 			destroyers = append(destroyers,
-				operator.ResourceDestroyToZitadelDestroy(destroyPDB),
 				destroyS,
 				operator.ResourceDestroyToZitadelDestroy(destroySFS),
 				destroyRBAC,
@@ -88,7 +88,7 @@ func TestManaged_AdaptBucketBackup(t *testing.T) {
 	assert.NoError(t, err)

 	databases := []string{"test1", "test2"}
-	queried := bucket.SetQueriedForDatabases(databases)
+	queried := bucket.SetQueriedForDatabases(databases, []string{})
 	ensure, err := query(k8sClient, queried)
 	assert.NoError(t, err)
 	assert.NotNil(t, ensure)
@@ -128,7 +128,7 @@ func TestManaged_AdaptBucketInstantBackup(t *testing.T) {
 	assert.NoError(t, err)

 	databases := []string{"test1", "test2"}
-	queried := bucket.SetQueriedForDatabases(databases)
+	queried := bucket.SetQueriedForDatabases(databases, []string{})
 	ensure, err := query(k8sClient, queried)
 	assert.NoError(t, err)
 	assert.NotNil(t, ensure)
@@ -169,7 +169,8 @@ func TestManaged_AdaptBucketCleanAndRestore(t *testing.T) {
 	assert.NoError(t, err)

 	databases := []string{"test1", "test2"}
-	queried := bucket.SetQueriedForDatabases(databases)
+	users := []string{"test1", "test2"}
+	queried := bucket.SetQueriedForDatabases(databases, users)
 	ensure, err := query(k8sClient, queried)
 	assert.NoError(t, err)
 	assert.NotNil(t, ensure)
@@ -2,13 +2,14 @@ package managed

 import (
 	"github.com/caos/orbos/mntr"
+	"github.com/caos/orbos/pkg/kubernetes"
 	"github.com/caos/orbos/pkg/tree"
 	"github.com/caos/zitadel/operator/database/kinds/backups"
 	"github.com/pkg/errors"
 )

-func BackupList() func(monitor mntr.Monitor, desired *tree.Tree) ([]string, error) {
-	return func(monitor mntr.Monitor, desired *tree.Tree) ([]string, error) {
+func BackupList() func(monitor mntr.Monitor, k8sClient kubernetes.ClientInt, desired *tree.Tree) ([]string, error) {
+	return func(monitor mntr.Monitor, k8sClient kubernetes.ClientInt, desired *tree.Tree) ([]string, error) {
 		desiredKind, err := parseDesiredV0(desired)
 		if err != nil {
 			return nil, errors.Wrap(err, "parsing desired state failed")
@@ -22,7 +23,7 @@ func BackupList() func(monitor mntr.Monitor, desired *tree.Tree) ([]string, erro
 		backuplists := make([]string, 0)
 		if desiredKind.Spec.Backups != nil {
 			for name, def := range desiredKind.Spec.Backups {
-				backuplist, err := backups.GetBackupList(monitor, name, def)
+				backuplist, err := backups.GetBackupList(monitor, k8sClient, name, def)
 				if err != nil {
 					return nil, err
 				}
@@ -33,7 +33,7 @@ func AdaptFunc(
 		return nil, nil, err
 	}

-	destroyR, err := role.AdaptFuncToDestroy(namespace, roleLabels.Name())
+	destroyR, err := role.AdaptFuncToDestroy(roleLabels.Name(), namespace)
 	if err != nil {
 		return nil, nil, err
 	}
@@ -91,22 +91,28 @@ func AdaptFunc(
 			return nil, nil, nil, nil, nil, migrate, err
 		}

+		rec, _ := Reconcile(monitor, desiredKind.Spec, gitops)
+
 		destroyers := make([]operator.DestroyFunc, 0)
 		queriers := make([]operator.QueryFunc, 0)
+		dbOrBackup := false
 		for _, feature := range features {
 			switch feature {
 			case "database", backup.Instant, backup.Normal, restore.Instant, clean.Instant:
-				queriers = append(queriers,
-					operator.ResourceQueryToZitadelQuery(queryNS),
-					queryDB,
-				)
-				destroyers = append(destroyers,
-					destroyDB,
-				)
+				if !dbOrBackup {
+					dbOrBackup = true
+					queriers = append(queriers,
+						operator.ResourceQueryToZitadelQuery(queryNS),
+						queryDB,
+					)
+					destroyers = append(destroyers,
+						destroyDB,
+					)
+				}
 			case "operator":
 				queriers = append(queriers,
 					operator.ResourceQueryToZitadelQuery(queryNS),
-					operator.EnsureFuncToQueryFunc(Reconcile(monitor, desiredKind.Spec, gitops)),
+					operator.EnsureFuncToQueryFunc(rec),
 				)
 			}
 		}
@@ -2,13 +2,14 @@ package orb

 import (
 	"github.com/caos/orbos/mntr"
+	"github.com/caos/orbos/pkg/kubernetes"
 	"github.com/caos/orbos/pkg/tree"
 	"github.com/caos/zitadel/operator/database/kinds/databases"
 	"github.com/pkg/errors"
 )

-func BackupListFunc() func(monitor mntr.Monitor, desiredTree *tree.Tree) (strings []string, err error) {
-	return func(monitor mntr.Monitor, desiredTree *tree.Tree) (strings []string, err error) {
+func BackupListFunc() func(monitor mntr.Monitor, k8sClient kubernetes.ClientInt, desiredTree *tree.Tree) (strings []string, err error) {
+	return func(monitor mntr.Monitor, k8sClient kubernetes.ClientInt, desiredTree *tree.Tree) (strings []string, err error) {
 		desiredKind, err := ParseDesiredV0(desiredTree)
 		if err != nil {
 			return nil, errors.Wrap(err, "parsing desired state failed")
@@ -19,6 +20,6 @@ func BackupListFunc() func(monitor mntr.Monitor, desiredTree *tree.Tree) (string
 			monitor = monitor.Verbose()
 		}

-		return databases.GetBackupList(monitor, desiredKind.Database)
+		return databases.GetBackupList(monitor, k8sClient, desiredKind.Database)
 	}
 }
@@ -3,6 +3,7 @@ package orb
 import (
 	"github.com/caos/orbos/mntr"
 	"github.com/caos/orbos/pkg/kubernetes"
+	"github.com/caos/orbos/pkg/labels"
 	"github.com/caos/orbos/pkg/tree"
 	"github.com/caos/orbos/pkg/treelabels"
 	"github.com/caos/zitadel/operator"
@@ -14,31 +15,39 @@ func Reconcile(
 	monitor mntr.Monitor,
 	spec *Spec,
 	gitops bool,
-) operator.EnsureFunc {
+) (
+	operator.EnsureFunc,
+	operator.DestroyFunc,
+) {
 	return func(k8sClient kubernetes.ClientInt) (err error) {
-		recMonitor := monitor.WithField("version", spec.Version)
+			recMonitor := monitor.WithField("version", spec.Version)

-		if spec.Version == "" {
-			err := errors.New("No version provided for self-reconciling")
-			recMonitor.Error(err)
-			return err
-		}
-
-		if spec.SelfReconciling {
-			desiredTree := &tree.Tree{
-				Common: &tree.Common{
-					Kind:    "databases.caos.ch/Orb",
-					Version: "v0",
-				},
-			}
-
-			if err := zitadelKubernetes.EnsureDatabaseArtifacts(monitor, treelabels.MustForAPI(desiredTree, mustDatabaseOperator(&spec.Version)), k8sClient, spec.Version, spec.NodeSelector, spec.Tolerations, spec.CustomImageRegistry, gitops); err != nil {
-				recMonitor.Error(errors.Wrap(err, "Failed to deploy database-operator into k8s-cluster"))
+			if spec.Version == "" {
+				err := errors.New("No version provided for self-reconciling")
 				return err
 			}
-			recMonitor.Info("Applied database-operator")
-		}
-		return nil

-	}
+			if spec.SelfReconciling {
+				desiredTree := &tree.Tree{
+					Common: &tree.Common{
+						Kind:    "databases.caos.ch/Orb",
+						Version: "v0",
+					},
+				}
+
+				if err := zitadelKubernetes.EnsureDatabaseArtifacts(monitor, treelabels.MustForAPI(desiredTree, mustDatabaseOperator(&spec.Version)), k8sClient, spec.Version, spec.NodeSelector, spec.Tolerations, spec.CustomImageRegistry, gitops); err != nil {
+					recMonitor.Error(errors.Wrap(err, "Failed to deploy database-operator into k8s-cluster"))
+					return err
+				}
+				recMonitor.Info("Applied database-operator")
+			}
+			return nil
+		}, func(k8sClient kubernetes.ClientInt) error {
+			if err := zitadelKubernetes.DestroyDatabaseOperator(monitor, labels.MustForAPI(labels.NoopOperator("database-operator"), "database", "v0"), k8sClient, gitops); err != nil {
+				monitor.Error(errors.Wrap(err, "Failed to destroy database-operator in k8s-cluster"))
+				return err
+			}
+			monitor.Info("Destroyed database-operator")
+			return nil
+		}
 }