[BUG] [FEATURE] AppliedWork resource object should not be deleted until the propagated resources are cleaned-up in member clusters

[ArchanaAnand0212]

Describe the bug

A clear and concise description of what the bug is.
AppliedWork CR does not have any clean-up finalizers in member clusters. There is no error propagated back to hub, if the kube-system:garbage-collector fails to delete the orphan resources i.e the resources propagated to member clusters, leaving those orphan leaking resource in member clusters.

I see there is a TODO here that says 'allow orphan resource', was wondering if this is a bug or some feature being worked up

fleet/pkg/controllers/workv1alpha1/apply_controller.go

Line 225 in 51ceeb3

// TODO: allow orphaned manifest

Environment

Please provide the following:

• Hub cluster details: hub-agent v0.8.5
• Member cluster details: member-agent v0.8.5

To Reproduce

Steps to reproduce the behavior:

• Create a CustomResourcePlacement in hub cluster to propagate namspace to one of the member clusters
• Wait until the namespace is propagated
• Write a ValidatingWebhook to disallow the deletion of namespace in member cluster, if there are resources in the namespace
• See that kube-system:garbage-collector does not delete the namespace but deletes all the associated resources created by fleet agent in member and hub clusters.
• There is no status of error propagated back to hub, leaving the orphan resources in member clusters.

Expected behavior

A clear and concise description of what you expected to happen.

• Expectation is that the parent resource i.e Applied should not be deleted until the propagated resources are cleaned-up.
• If there is error in cleaning up child resources, the error should be propagated to CustomResourcePlacement CR appropriately.

Screenshots

If applicable, add screenshots to help explain your problem.

Additional context

Add any other context about the problem here.

[ryanzhang-oss]

@ArchanaAnand0212 we would love to see a fix for this