opendefensecloud / solution-arsenal / 27812533209

75%

Build Type

push

github

Committed by web-flow

Commit Message

feat(controller): implement deletion protection via controller-managed finalizers (#621)

## What
Implements deletion protection for `ComponentVersion`, `Release`,
`Registry`, and `ReleaseBinding` resources using controller-managed
finalizers, preventing cascade-deletion accidents when upstream
resources are deleted while still referenced.

Closes #308 

## Why
Before this change, deleting a `Component` while `ComponentVersions`
still pointed to it, or a `Release` while active deployments existed,
would cause dangling references and silent failures downstream. This
adds a guard at the API level: referenced resources cannot be deleted
until all their referencers are gone.

## Testing
All 17 envtest/Ginkgo suites pass. Each new controller is covered by
dedicated tests:
- Add-finalizer-on-create (both self-finalizer and protection finalizer)
- Block-deletion-while-referenced (Consistently assert DeletionTimestamp
present, resource not gone)
- Remove-protection-finalizer-when-last-reference-deleted
- Retain-protection-finalizer-when-a-second-referencer-still-exists
(multi-referencer scenario)
- Profile-owned-binding guard: `removeReleaseRefFinalizer` deferred to
Profile controller while `profileFinalizer` is present, verified with a
test-only blocker finalizer

`make test-e2e` timeout bumped from the implicit 10 m Go default to 15
m; new controllers add reconcile cycles to namespace teardown
(previously resources were GC'd immediately).

## Notes for reviewers

**New controllers** — `ComponentVersionReconciler`,
`ReleaseBindingReconciler`, and `RegistryBindingReconciler` are
registered in `solar-controller-manager`. During a rolling upgrade, the
brief window between old pod termination and new pod startup leaves
existing resources unprotected; this is unavoidable with a rolling
deploy and the window is short.

**RBAC changes** — `patch`/`update` verbs added to `components`,
`componentversions`, `profiles`, `registries`, and `registrybindings`;
new `/final... (continued)

Coverage Stats

414 of 657 new or added lines in 7 files covered. (63.01%)

4 existing lines in 1 file now uncovered.

4021 of 5330 relevant lines covered (75.44%)

34.46 hits per line