Improve resource condition/error when deletion is not permitted in Azure

v2/internal/controllers/crd_dataprotection_backupinstance_20231101_test.go

@@ -10,6 +10,7 @@ import (
 	"testing"
 
 	. "github.com/onsi/gomega"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 
 	"sigs.k8s.io/controller-runtime/pkg/client"
 
@@ -71,6 +72,8 @@ func Test_DataProtection_BackupInstance_20231101_CRUD(t *testing.T) {
 		},
 	}
 
+	addAnnotation(&blobService.ObjectMeta, "serviceoperator.azure.com/reconcile-policy", "detach-on-delete")
+
 	blobContainer := &storage.StorageAccountsBlobServicesContainer{
 		ObjectMeta: tc.MakeObjectMeta("velero"),
 		Spec: storage.StorageAccountsBlobServicesContainer_Spec{
@@ -308,3 +311,17 @@ func newBackupInstanceManagedCluster(tc *testcommon.KubePerTestContext, rg *reso
 	}
 	return cluster
 }
+
+func addAnnotation(
+	obj *v1.ObjectMeta,
+	key string,
+	value string,
+) {
+	annotations := obj.GetAnnotations()
+	if annotations == nil {
+		annotations = make(map[string]string)
+	}
+
+	annotations[key] = value
+	obj.SetAnnotations(annotations)
+}

v2/internal/reconcilers/arm/azure_generic_arm_reconciler.go

@@ -38,8 +38,9 @@ const (
 type DeleteAction string
 
 const (
-	DeleteActionBeginDelete   = DeleteAction("BeginDelete")
-	DeleteActionMonitorDelete = DeleteAction("MonitorDelete")
+	DeleteActionBeginDelete        = DeleteAction("BeginDelete")
+	DeleteActionMonitorDelete      = DeleteAction("MonitorDelete")
+	DeleteActionNotPossibleInAzure = DeleteAction("NotPossibleInAzure")
 )
 
 type (

v2/internal/reconcilers/arm/azure_generic_arm_reconciler_instance.go

@@ -26,6 +26,7 @@ import (
 	"github.com/Azure/azure-service-operator/v2/internal/reconcilers/arm/errorclassification"
 	"github.com/Azure/azure-service-operator/v2/internal/reflecthelpers"
 	"github.com/Azure/azure-service-operator/v2/internal/resolver"
+	"github.com/Azure/azure-service-operator/v2/pkg/common/annotations"
 	"github.com/Azure/azure-service-operator/v2/pkg/common/labels"
 	"github.com/Azure/azure-service-operator/v2/pkg/genruntime"
 	"github.com/Azure/azure-service-operator/v2/pkg/genruntime/conditions"
@@ -129,6 +130,11 @@ func (r *azureDeploymentReconcilerInstance) DetermineDeleteAction() (DeleteActio
 		return DeleteActionMonitorDelete, r.MonitorDelete, nil
 	}
 
+	if !genruntime.ResourceOperationDelete.IsSupportedBy(r.Obj) {
+		// Resource doesn't support delete, so we just remove the finalizer and stop managing it
+		return DeleteActionNotPossibleInAzure, r.DeleteNotPossibleInAzure, nil
+	}
+
 	return DeleteActionBeginDelete, r.StartDeleteOfResource, nil
 }
 
@@ -205,6 +211,23 @@ func (r *azureDeploymentReconcilerInstance) MonitorDelete(ctx context.Context) (
 	return ctrl.Result{Requeue: true, RequeueAfter: retryAfter}, nil
 }
 
+// DeleteNotPossibleInAzure is used when the underlying Azure resource doesn't support direct deletion, so we return an error.
+func (r *azureDeploymentReconcilerInstance) DeleteNotPossibleInAzure(ctx context.Context) (ctrl.Result, error) {
+	msg := fmt.Sprintf(
+		"Resource does not support deletion in Azure; set annotation %s: %s to permit deletion in Kubernetes",
+		annotations.ReconcilePolicy,
+		annotations.ReconcilePolicyDetachOnDelete)
+	r.Log.V(Verbose).Info(msg)
+	r.Recorder.Event(r.Obj, v1.EventTypeNormal, string(DeleteActionNotPossibleInAzure), msg)
+
+	// Return a meaningful error so that the Ready condition is updated to show the user why the resource can't yet be deleted.
+	return ctrl.Result{},
+		conditions.NewReadyConditionImpactingError(
+			eris.New(msg),
+			conditions.ConditionSeverityError,
+			conditions.ReasonDeletionNotSupported)
+}
+
 func (r *azureDeploymentReconcilerInstance) BeginCreateOrUpdateResource(
 	ctx context.Context,
 ) (ctrl.Result, error) {

v2/pkg/genruntime/conditions/ready_condition_builder.go

@@ -39,6 +39,7 @@ var (
 	ReasonReconcileBlocked                = Reason{Name: "ReconciliationBlocked", RetryClassification: retry.Slow}
 	ReasonReconcilePostponed              = Reason{Name: "ReconciliationPostponed", RetryClassification: retry.Slow}
 	ReasonPostReconcileFailure            = Reason{Name: "PostReconciliationFailure", RetryClassification: retry.Slow}
+	ReasonDeletionNotSupported            = Reason{Name: "DeletionNotSupportedInAzure", RetryClassification: retry.None}
 )
 
 // ReasonFailed is a catch-all error code for when we don't have a more specific error classification

v2/samples/dbforpostgresql/v1api20210601/v1api20210601_flexibleserversconfiguration.yaml

@@ -3,6 +3,9 @@ kind: FlexibleServersConfiguration
 metadata:
   name: pgaudit
   namespace: default
+  annotations: 
+    # Can't be directly deleted in Azure, only by deleting the parent server
+    serviceoperator.azure.com/reconcile-policy: detach-on-delete
 spec:
   owner:
     name: samplepostgresql

v2/samples/dbforpostgresql/v1api20220120preview/v1api20220120preview_flexibleserversconfiguration.yaml

@@ -3,6 +3,9 @@ kind: FlexibleServersConfiguration
 metadata:
   name: pgaudit
   namespace: default
+  annotations: 
+    # Can't be directly deleted in Azure, only by deleting the parent server
+    serviceoperator.azure.com/reconcile-policy: detach-on-delete
 spec:
   owner:
     name: samplepostgresql

v2/samples/dbforpostgresql/v1api20221201/v1api20221201_flexibleserversconfiguration.yaml

@@ -3,6 +3,9 @@ kind: FlexibleServersConfiguration
 metadata:
   name: pgaudit
   namespace: default
+  annotations: 
+    # Can't be directly deleted in Azure, only by deleting the parent server
+    serviceoperator.azure.com/reconcile-policy: detach-on-delete
 spec:
   owner:
     name: samplepostgresql

v2/samples/dbforpostgresql/v1api20230601preview/v1api20230601preview_flexibleserversconfiguration.yaml

@@ -3,6 +3,9 @@ kind: FlexibleServersConfiguration
 metadata:
   name: pgaudit
   namespace: default
+  annotations: 
+    # Can't be directly deleted in Azure, only by deleting the parent server
+    serviceoperator.azure.com/reconcile-policy: detach-on-delete
 spec:
   owner:
     name: samplepostgresql

v2/samples/dbforpostgresql/v1api20240801/v1api20240801_flexibleserversconfiguration.yaml

@@ -3,6 +3,9 @@ kind: FlexibleServersConfiguration
 metadata:
   name: pgaudit
   namespace: default
+  annotations: 
+    # Can't be directly deleted in Azure, only by deleting the parent server
+    serviceoperator.azure.com/reconcile-policy: detach-on-delete
 spec:
   owner:
     name: asosampleserver20240801

v2/samples/sql/v1api20211101/refs/v1api20210401_storageaccountsblobservice.yaml

@@ -3,6 +3,9 @@ kind: StorageAccountsBlobService
 metadata:
   name: sqlstorageservice
   namespace: default
+  annotations: 
+    # Can't be directly deleted in Azure, only by deleting the parent storage account
+    serviceoperator.azure.com/reconcile-policy: detach-on-delete
 spec:
   owner:
     name: asotestsqlstorageref

v2/samples/sql/v1api20211101/v1api20211101_serversadvancedthreatprotectionsetting.yaml

@@ -3,6 +3,9 @@ kind: ServersAdvancedThreatProtectionSetting
 metadata:
   name: aso-sample-atp
   namespace: default
+  annotations: 
+    # Can't be directly deleted in Azure, only by deleting the parent server
+    serviceoperator.azure.com/reconcile-policy: detach-on-delete
 spec:
   owner:
     name: aso-sample-sqlserver

v2/samples/sql/v1api20211101/v1api20211101_serversauditingsetting.yaml

@@ -3,6 +3,9 @@ kind: ServersAuditingSetting
 metadata:
   name: aso-sample-audit
   namespace: default
+  annotations: 
+    # Can't be directly deleted in Azure, only by deleting the parent server
+    serviceoperator.azure.com/reconcile-policy: detach-on-delete
 spec:
   owner:
     name: aso-sample-sqlserver

v2/samples/sql/v1api20211101/v1api20211101_serversconnectionpolicy.yaml

@@ -3,6 +3,9 @@ kind: ServersConnectionPolicy
 metadata:
   name: aso-sample-connpolicy
   namespace: default
+  annotations: 
+    # Can't be directly deleted in Azure, only by deleting the parent server
+    serviceoperator.azure.com/reconcile-policy: detach-on-delete
 spec:
   owner:
     name: aso-sample-sqlserver

v2/samples/sql/v1api20211101/v1api20211101_serversdatabasesadvancedthreatprotectionsetting.yaml

@@ -3,6 +3,9 @@ kind: ServersDatabasesAdvancedThreatProtectionSetting
 metadata:
   name: aso-sample-atp
   namespace: default
+  annotations: 
+    # Can't be directly deleted in Azure, only by deleting the parent database
+    serviceoperator.azure.com/reconcile-policy: detach-on-delete
 spec:
   owner:
     name: aso-sample-db

v2/samples/sql/v1api20211101/v1api20211101_serversdatabasesauditingsetting.yaml

@@ -3,6 +3,9 @@ kind: ServersDatabasesAuditingSetting
 metadata:
   name: aso-sample-audit
   namespace: default
+  annotations: 
+    # Can't be directly deleted in Azure, only by deleting the parent database
+    serviceoperator.azure.com/reconcile-policy: detach-on-delete
 spec:
   owner:
     name: aso-sample-db

v2/samples/sql/v1api20211101/v1api20211101_serversdatabasesbackuplongtermretentionpolicy.yaml

@@ -3,6 +3,9 @@ kind: ServersDatabasesBackupLongTermRetentionPolicy
 metadata:
   name: aso-sample-longterm-backup-policy
   namespace: default
+  annotations: 
+    # Can't be directly deleted in Azure, only by deleting the parent database
+    serviceoperator.azure.com/reconcile-policy: detach-on-delete
 spec:
   owner:
     name: aso-sample-db

v2/samples/sql/v1api20211101/v1api20211101_serversdatabasesbackupshorttermretentionpolicy.yaml

@@ -3,6 +3,9 @@ kind: ServersDatabasesBackupShortTermRetentionPolicy
 metadata:
   name: aso-sample-shortterm-backup-policy
   namespace: default
+  annotations: 
+    # Can't be directly deleted in Azure, only by deleting the parent database
+    serviceoperator.azure.com/reconcile-policy: detach-on-delete
 spec:
   owner:
     name: aso-sample-db

v2/samples/sql/v1api20211101/v1api20211101_serversdatabasessecurityalertpolicy.yaml

@@ -3,6 +3,9 @@ kind: ServersDatabasesSecurityAlertPolicy
 metadata:
   name: aso-sample-alertpolicy
   namespace: default
+  annotations: 
+    # Can't be directly deleted in Azure, only by deleting the parent database
+    serviceoperator.azure.com/reconcile-policy: detach-on-delete
 spec:
   owner:
     name: aso-sample-db

v2/samples/sql/v1api20211101/v1api20211101_serversdatabasestransparentdataencryption.yaml

@@ -3,6 +3,9 @@ kind: ServersDatabasesTransparentDataEncryption
 metadata:
   name: aso-sample-encrypt
   namespace: default
+  annotations: 
+    # Can't be directly deleted in Azure, only by deleting the parent database
+    serviceoperator.azure.com/reconcile-policy: detach-on-delete
 spec:
   owner:
     name: aso-sample-db

v2/samples/sql/v1api20211101/v1api20211101_serverssecurityalertpolicy.yaml

@@ -3,6 +3,9 @@ kind: ServersSecurityAlertPolicy
 metadata:
   name: aso-sample-alertpolicy
   namespace: default
+  annotations: 
+    # Can't be directly deleted in Azure, only by deleting the parent database
+    serviceoperator.azure.com/reconcile-policy: detach-on-delete
 spec:
   owner:
     name: aso-sample-sqlserver