Add a finalizer to the NSTemplateTier to prevent its deletion

as long as some spaces are still derived from it.

Author: metlos

controllers/nstemplatetier/finalizer.go

@@ -0,0 +1,34 @@
+package nstemplatetier
+
+import (
+	"context"
+	"fmt"
+
+	toolchainv1alpha1 "github.com/codeready-toolchain/api/api/v1alpha1"
+	"github.com/codeready-toolchain/toolchain-common/pkg/hash"
+	runtimeclient "sigs.k8s.io/controller-runtime/pkg/client"
+	"sigs.k8s.io/controller-runtime/pkg/finalizer"
+)
+
+type nsTemplateTierUsedFinalizer struct {
+	runtimeclient.Client
+}
+
+// Finalize implements finalizer.Finalizer.
+func (n *nsTemplateTierUsedFinalizer) Finalize(ctx context.Context, tier runtimeclient.Object) (finalizer.Result, error) {
+	list := &toolchainv1alpha1.SpaceList{}
+	if err := n.List(ctx, list,
+		runtimeclient.InNamespace(tier.GetNamespace()),
+		runtimeclient.HasLabels{hash.TemplateTierHashLabelKey(tier.GetName())},
+		runtimeclient.Limit(1)); err != nil {
+		return finalizer.Result{}, err
+	}
+
+	if len(list.Items) > 0 {
+		return finalizer.Result{}, fmt.Errorf("the tier is still used by some spaces")
+	}
+
+	return finalizer.Result{}, nil
+}
+
+var _ finalizer.Finalizer = (*nsTemplateTierUsedFinalizer)(nil)

controllers/nstemplatetier/finalizer_test.go

@@ -0,0 +1,78 @@
+package nstemplatetier
+
+import (
+	"context"
+	"fmt"
+	"testing"
+
+	toolchainv1alpha1 "github.com/codeready-toolchain/api/api/v1alpha1"
+	"github.com/codeready-toolchain/toolchain-common/pkg/hash"
+	"github.com/codeready-toolchain/toolchain-common/pkg/test"
+	"github.com/stretchr/testify/require"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+)
+
+func TestNSTemplateTierUsedFinalizer(t *testing.T) {
+	t.Run("succeeds when tier not used", func(t *testing.T) {
+		// given
+		tier := &toolchainv1alpha1.NSTemplateTier{
+			ObjectMeta: metav1.ObjectMeta{
+				Name:      "tier",
+				Namespace: test.HostOperatorNs,
+			},
+		}
+		cl := test.NewFakeClient(t, tier)
+		f := &nsTemplateTierUsedFinalizer{Client: cl}
+
+		// when
+		_, err := f.Finalize(context.TODO(), tier)
+
+		// then
+		require.NoError(t, err)
+	})
+	t.Run("fails when tier used", func(t *testing.T) {
+		// given
+		tier := &toolchainv1alpha1.NSTemplateTier{
+			ObjectMeta: metav1.ObjectMeta{
+				Name:      "tier",
+				Namespace: test.HostOperatorNs,
+			},
+		}
+		space := &toolchainv1alpha1.Space{
+			ObjectMeta: metav1.ObjectMeta{
+				Name:      "test-space",
+				Namespace: tier.Namespace,
+				Labels:    map[string]string{hash.TemplateTierHashLabelKey(tier.Name): "1234"},
+			},
+		}
+		cl := test.NewFakeClient(t, tier, space)
+		f := &nsTemplateTierUsedFinalizer{Client: cl}
+
+		// when
+		_, err := f.Finalize(context.TODO(), tier)
+
+		// then
+		require.Error(t, err)
+	})
+	t.Run("fails on list error", func(t *testing.T) {
+		// given
+		tier := &toolchainv1alpha1.NSTemplateTier{
+			ObjectMeta: metav1.ObjectMeta{
+				Name:      "tier",
+				Namespace: test.HostOperatorNs,
+			},
+		}
+		cl := test.NewFakeClient(t, tier)
+		cl.MockList = func(ctx context.Context, list client.ObjectList, opts ...client.ListOption) error {
+			return fmt.Errorf("fake error")
+		}
+		f := &nsTemplateTierUsedFinalizer{Client: cl}
+
+		// when
+		_, err := f.Finalize(context.TODO(), tier)
+
+		// then
+		require.Error(t, err)
+	})
+}

controllers/nstemplatetier/nstemplatetier_controller.go

@@ -10,7 +10,7 @@ import (
 	"github.com/codeready-toolchain/host-operator/controllers/toolchainconfig"
 	"github.com/codeready-toolchain/host-operator/pkg/templates/nstemplatetiers"
 	"github.com/codeready-toolchain/toolchain-common/pkg/condition"
-	"github.com/redhat-cop/operator-utils/pkg/util"
+	"github.com/codeready-toolchain/toolchain-common/pkg/finalizers"
 	corev1 "k8s.io/api/core/v1"
 
 	"k8s.io/apimachinery/pkg/api/errors"
@@ -29,6 +29,10 @@ import (
 
 // SetupWithManager sets up the controller with the Manager.
 func (r *Reconciler) SetupWithManager(mgr manager.Manager) error {
+	if err := r.RegisterFinalizers(); err != nil {
+		return err
+	}
+
 	return ctrl.NewControllerManagedBy(mgr).
 		For(&toolchainv1alpha1.NSTemplateTier{}, builder.WithPredicates(predicate.GenerationChangedPredicate{})).
 		Watches(&toolchainv1alpha1.TierTemplate{},
@@ -38,15 +42,24 @@ func (r *Reconciler) SetupWithManager(mgr manager.Manager) error {
 
 // Reconciler reconciles a NSTemplateTier object (only when this latter's specs were updated)
 type Reconciler struct {
-	Client runtimeclient.Client
-	Scheme *runtime.Scheme
+	Client     runtimeclient.Client
+	Scheme     *runtime.Scheme
+	finalizers finalizers.Finalizers
 }
 
 //+kubebuilder:rbac:groups=toolchain.dev.openshift.com,resources=nstemplatetiers,verbs=get;list;watch;create;update;patch;delete
 //+kubebuilder:rbac:groups=toolchain.dev.openshift.com,resources=spaces,verbs=get;list;watch
 //+kubebuilder:rbac:groups=toolchain.dev.openshift.com,resources=nstemplatetiers/status,verbs=get;update;patch
 //+kubebuilder:rbac:groups=toolchain.dev.openshift.com,resources=nstemplatetiers/finalizers,verbs=update
 
+// RegisterFinalizers should only be called from the unit tests. At runtime, it is called during SetupWithManager.
+func (r *Reconciler) RegisterFinalizers() error {
+	if err := r.finalizers.RegisterWithStandardName(&nsTemplateTierUsedFinalizer{Client: r.Client}); err != nil {
+		return fmt.Errorf("failed to register the NSTemplateTier finalizer (this should not happen): %w", err)
+	}
+	return nil
+}
+
 // Reconcile takes care of fetching the NSTemplateTier
 func (r *Reconciler) Reconcile(ctx context.Context, request ctrl.Request) (ctrl.Result, error) {
 	logger := log.FromContext(ctx)
@@ -62,9 +75,8 @@ func (r *Reconciler) Reconcile(ctx context.Context, request ctrl.Request) (ctrl.
 		logger.Error(err, "unable to get the current NSTemplateTier")
 		return reconcile.Result{}, fmt.Errorf("unable to get the current NSTemplateTier: %w", err)
 	}
-	// if the NSTemplateTier is being deleted, then do nothing
-	if util.IsBeingDeleted(tier) {
-		return reconcile.Result{}, nil
+	if updated, err := r.finalizers.FinalizeAndUpdate(ctx, r.Client, tier); updated || err != nil {
+		return reconcile.Result{}, err
 	}
 
 	_, err := toolchainconfig.GetToolchainConfig(r.Client)
@@ -183,7 +195,6 @@ func (r *Reconciler) ensureTTRforTemplate(ctx context.Context, nsTmplTier *toolc
 		return false, "", err
 	}
 	return true, ttrName, nil
-
 }
 
 func (r *Reconciler) createNewTierTemplateRevision(ctx context.Context, nsTmplTier *toolchainv1alpha1.NSTemplateTier, tierTemplate *toolchainv1alpha1.TierTemplate) (string, error) {