@@ -1032,20 +1032,40 @@ func (r *KustomizationReconciler) prune(ctx context.Context,
10321032 return false , nil
10331033}
10341034
1035+ // finalizerShouldDeleteResources determines if resources should be deleted
1036+ // based on the object's inventory and deletion policy.
1037+ // A suspended Kustomization or one without an inventory will not delete resources.
10351038func finalizerShouldDeleteResources (obj * kustomizev1.Kustomization ) bool {
1036- if obj .GetDeletionPolicy () == kustomizev1 .DeletionPolicyMirrorPrune {
1039+ if obj .Spec .Suspend {
1040+ return false
1041+ }
1042+
1043+ if obj .Status .Inventory == nil || len (obj .Status .Inventory .Entries ) == 0 {
1044+ return false
1045+ }
1046+
1047+ switch obj .GetDeletionPolicy () {
1048+ case kustomizev1 .DeletionPolicyMirrorPrune :
10371049 return obj .Spec .Prune
1050+ case kustomizev1 .DeletionPolicyDelete :
1051+ return true
1052+ case kustomizev1 .DeletionPolicyWaitForTermination :
1053+ return true
1054+ default :
1055+ return false
10381056 }
1039- return obj .Spec .DeletionPolicy == kustomizev1 .DeletionPolicyDelete
10401057}
10411058
1059+ // finalize handles the finalization logic for a Kustomization resource during its deletion process.
1060+ // Managed resources are pruned based on the deletion policy and suspended state of the Kustomization.
1061+ // When the policy is set to WaitForTermination, the function blocks and waits for the resources
1062+ // to be terminated by the Kubernetes Garbage Collector for the specified timeout duration.
1063+ // If the service account used for impersonation is no longer available or if a timeout occurs
1064+ // while waiting for resources to be terminated, an error is logged and the finalizer is removed.
10421065func (r * KustomizationReconciler ) finalize (ctx context.Context ,
10431066 obj * kustomizev1.Kustomization ) (ctrl.Result , error ) {
10441067 log := ctrl .LoggerFrom (ctx )
1045- if finalizerShouldDeleteResources (obj ) &&
1046- ! obj .Spec .Suspend &&
1047- obj .Status .Inventory != nil &&
1048- obj .Status .Inventory .Entries != nil {
1068+ if finalizerShouldDeleteResources (obj ) {
10491069 objects , _ := inventory .List (obj .Status .Inventory )
10501070
10511071 var impersonatorOpts []runtimeClient.ImpersonatorOption
@@ -1098,7 +1118,21 @@ func (r *KustomizationReconciler) finalize(ctx context.Context,
10981118 }
10991119
11001120 if changeSet != nil && len (changeSet .Entries ) > 0 {
1121+ // Emit event with the resources marked for deletion.
11011122 r .event (obj , obj .Status .LastAppliedRevision , obj .Status .LastAppliedOriginRevision , eventv1 .EventSeverityInfo , changeSet .String (), nil )
1123+
1124+ // Wait for the resources marked for deletion to be terminated.
1125+ if obj .GetDeletionPolicy () == kustomizev1 .DeletionPolicyWaitForTermination {
1126+ if err := resourceManager .WaitForSetTermination (changeSet , ssa.WaitOptions {
1127+ Interval : 2 * time .Second ,
1128+ Timeout : obj .GetTimeout (),
1129+ }); err != nil {
1130+ // Emit an event and log the error if a timeout occurs.
1131+ msg := "failed to wait for resources termination"
1132+ log .Error (err , msg )
1133+ r .event (obj , obj .Status .LastAppliedRevision , obj .Status .LastAppliedOriginRevision , eventv1 .EventSeverityError , msg , nil )
1134+ }
1135+ }
11021136 }
11031137 } else {
11041138 // when the account to impersonate is gone, log the stale objects and continue with the finalization
0 commit comments