fix: Add missing owns/watches and test early-exit reconcile

CHANGELOG.md

@@ -27,6 +27,8 @@
   See [our internal issue](https://github.com/stackabletech/hdfs-operator/issues/626) and [the fix](https://github.com/kube-rs/kube/pull/2042) for details ([#792]).
 - BREAKING: The app.kubernetes.io/managed-by label value changed from hbase.stackable.com_hbasecluster to
   hbase.stackable.tech_hbasecluster, aligning with all other operators ([#795]).
+- The operator now watches all resources that it creates and early-exits the reconcile action when the
+  cluster is marked for deletion ([#797]).
 - BREAKING: The rest-server listener PVC template now carries the recommended labels without the
   version label, so that the labels stay stable across upgrades.
   Existing rest-server StatefulSets must be deleted once before the new operator can reconcile them ([#799]).
@@ -37,6 +39,7 @@
 [#787]: https://github.com/stackabletech/hbase-operator/pull/787
 [#792]: https://github.com/stackabletech/hbase-operator/pull/792
 [#795]: https://github.com/stackabletech/hbase-operator/pull/795
+[#797]: https://github.com/stackabletech/hbase-operator/pull/797
 [#799]: https://github.com/stackabletech/hbase-operator/pull/799
 
 ## [26.7.0] - 2026-07-21

deploy/helm/hbase-operator/templates/clusterrole-operator.yaml

@@ -18,10 +18,13 @@ rules:
   # orphan cleanup (list + delete).
   # - configmaps: role group configuration and discovery configmap
   # - services: role group headless and metrics services
+  # - serviceaccounts created per HbaseCluster for workload pod identity.
+  #   Applied via SSA, tracked for orphan cleanup and watched by the controller.
   - apiGroups:
       - ""
     resources:
       - configmaps
+      - serviceaccounts
       - services
     verbs:
       - create
@@ -30,20 +33,8 @@ rules:
       - list
       - patch
       - watch
-  # ServiceAccount created per HbaseCluster for workload pod identity.
-  # Applied via SSA and tracked for orphan cleanup.
-  - apiGroups:
-      - ""
-    resources:
-      - serviceaccounts
-    verbs:
-      - create
-      - delete
-      - get
-      - list
-      - patch
   # RoleBinding created per HbaseCluster to bind the product ClusterRole to the workload
-  # ServiceAccount. Applied via SSA and tracked for orphan cleanup.
+  # ServiceAccount. Applied via SSA, tracked for orphan cleanup and watched by the controller.
   - apiGroups:
       - rbac.authorization.k8s.io
     resources:
@@ -54,6 +45,7 @@ rules:
       - get
       - list
       - patch
+      - watch
   # Required to bind the product ClusterRole to the per-cluster ServiceAccount.
   - apiGroups:
       - rbac.authorization.k8s.io
@@ -75,7 +67,8 @@ rules:
       - list
       - patch
       - watch
-  # PodDisruptionBudget created per role. Applied via SSA and tracked for orphan cleanup.
+  # PodDisruptionBudget created per role. Applied via SSA, tracked for orphan cleanup and
+  # watched by the controller.
   - apiGroups:
       - policy
     resources:
@@ -86,6 +79,7 @@ rules:
       - get
       - list
       - patch
+      - watch
   # Required for maintaining the CRDs within the operator (including the conversion webhook info).
   # Also for the startup condition check before the controller can run.
   - apiGroups:

rust/operator-binary/src/hbase_controller.rs

@@ -12,6 +12,7 @@ use stackable_operator::{
     cli::OperatorEnvironmentOptions,
     cluster_resources::ClusterResourceApplyStrategy,
     kube::{
+        Resource,
         core::{DeserializeGuard, error_boundary},
         runtime::controller::Action,
     },
@@ -76,6 +77,10 @@ pub async fn reconcile_hbase(
 ) -> Result<Action> {
     tracing::info!("Starting reconcile");
 
+    if hbase.meta().deletion_timestamp.is_some() {
+        return Ok(Action::await_change());
+    }
+
     let hbase = hbase
         .0
         .as_ref()
@@ -126,3 +131,56 @@ pub fn error_policy(
         _ => Action::requeue(*Duration::from_secs(5)),
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use indoc::indoc;
+    use stackable_operator::{
+        client::Client,
+        kube::{Client as KubeClient, Config},
+    };
+
+    use super::*;
+    use crate::test_utils;
+
+    /// The client points at a closed port, so any API call would fail the reconciliation: an `Ok`
+    /// proves that a cluster being deleted returns before the reconciler touches the Kubernetes
+    /// API, and because the spec is invalid, before the [`DeserializeGuard`] is unwrapped.
+    #[tokio::test]
+    async fn reconcile_exits_early_for_deleted_cluster() {
+        let hbase = serde_yaml::from_str(indoc! {r#"
+            ---
+            apiVersion: hbase.stackable.tech/v1alpha1
+            kind: HbaseCluster
+            metadata:
+              name: hbase
+              namespace: default
+              deletionTimestamp: "2026-08-14T12:00:00Z"
+            spec: {}
+        "#})
+        .expect("YAML parses; the invalid spec is captured inside the DeserializeGuard");
+
+        let ctx = Arc::new(Ctx {
+            client: Client::new(
+                KubeClient::try_from(Config::new(
+                    "http://127.0.0.1:1".parse().expect("valid static URI"),
+                ))
+                .expect("client from static config"),
+                None,
+                "default".to_owned(),
+                test_utils::cluster_info(),
+            ),
+            operator_environment: OperatorEnvironmentOptions {
+                operator_namespace: "stackable-operators".to_owned(),
+                operator_service_name: "hbase-operator".to_owned(),
+                image_repository: "oci.stackable.tech/sdp".to_owned(),
+            },
+        });
+
+        let action = reconcile_hbase(Arc::new(hbase), ctx)
+            .await
+            .expect("a deleted cluster reconciles without any API call");
+
+        assert_eq!(action, Action::await_change());
+    }
+}

rust/operator-binary/src/main.rs

@@ -14,7 +14,9 @@ use stackable_operator::{
     eos::EndOfSupportChecker,
     k8s_openapi::api::{
         apps::v1::StatefulSet,
-        core::v1::{ConfigMap, Service},
+        core::v1::{ConfigMap, Service, ServiceAccount},
+        policy::v1::PodDisruptionBudget,
+        rbac::v1::RoleBinding,
     },
     kube::{
         CustomResourceExt, ResourceExt,
@@ -126,10 +128,26 @@ async fn main() -> anyhow::Result<()> {
             );
             let config_map_store = hbase_controller.store();
             let hbase_controller = hbase_controller
+                .owns(
+                    watch_namespace.get_api::<ConfigMap>(&client),
+                    watcher::Config::default(),
+                )
+                .owns(
+                    watch_namespace.get_api::<PodDisruptionBudget>(&client),
+                    watcher::Config::default(),
+                )
+                .owns(
+                    watch_namespace.get_api::<RoleBinding>(&client),
+                    watcher::Config::default(),
+                )
                 .owns(
                     watch_namespace.get_api::<Service>(&client),
                     watcher::Config::default(),
                 )
+                .owns(
+                    watch_namespace.get_api::<ServiceAccount>(&client),
+                    watcher::Config::default(),
+                )
                 .owns(
                     watch_namespace.get_api::<StatefulSet>(&client),
                     watcher::Config::default(),

tests/templates/kuttl/cluster-operation/40-assert.yaml

@@ -0,0 +1,174 @@
+---
+# The recreated StatefulSets must bring the cluster back to ready, and the recreated
+# objects must carry an owner reference back to the HbaseCluster so that garbage
+# collection still works for them.
+#
+# The budget is generous on purpose: recreating the role-group ConfigMaps makes the
+# commons-operator restarter roll every pod once more on top of the StatefulSet
+# recreation, and on a node without a cached image a single pull can take minutes.
+apiVersion: kuttl.dev/v1beta1
+kind: TestAssert
+metadata:
+  name: recreate-owned-resources
+timeout: 600
+commands:
+  - script: kubectl -n $NAMESPACE wait --for=condition=available hbaseclusters.hbase.stackable.tech/test-hbase --timeout 601s
+---
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: test-hbase-master-default
+  ownerReferences:
+    - apiVersion: hbase.stackable.tech/v1alpha1
+      controller: true
+      kind: HbaseCluster
+      name: test-hbase
+status:
+  readyReplicas: 1
+  replicas: 1
+---
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: test-hbase-regionserver-default
+  ownerReferences:
+    - apiVersion: hbase.stackable.tech/v1alpha1
+      controller: true
+      kind: HbaseCluster
+      name: test-hbase
+status:
+  readyReplicas: 1
+  replicas: 1
+---
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: test-hbase-restserver-default
+  ownerReferences:
+    - apiVersion: hbase.stackable.tech/v1alpha1
+      controller: true
+      kind: HbaseCluster
+      name: test-hbase
+status:
+  readyReplicas: 1
+  replicas: 1
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: test-hbase-serviceaccount
+  ownerReferences:
+    - apiVersion: hbase.stackable.tech/v1alpha1
+      controller: true
+      kind: HbaseCluster
+      name: test-hbase
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: test-hbase-rolebinding
+  ownerReferences:
+    - apiVersion: hbase.stackable.tech/v1alpha1
+      controller: true
+      kind: HbaseCluster
+      name: test-hbase
+---
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: test-hbase-master
+  ownerReferences:
+    - apiVersion: hbase.stackable.tech/v1alpha1
+      controller: true
+      kind: HbaseCluster
+      name: test-hbase
+---
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: test-hbase-regionserver
+  ownerReferences:
+    - apiVersion: hbase.stackable.tech/v1alpha1
+      controller: true
+      kind: HbaseCluster
+      name: test-hbase
+---
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: test-hbase-restserver
+  ownerReferences:
+    - apiVersion: hbase.stackable.tech/v1alpha1
+      controller: true
+      kind: HbaseCluster
+      name: test-hbase
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: test-hbase
+  ownerReferences:
+    - apiVersion: hbase.stackable.tech/v1alpha1
+      controller: true
+      kind: HbaseCluster
+      name: test-hbase
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: test-hbase-master-default-headless
+  ownerReferences:
+    - apiVersion: hbase.stackable.tech/v1alpha1
+      controller: true
+      kind: HbaseCluster
+      name: test-hbase
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: test-hbase-master-default-metrics
+  ownerReferences:
+    - apiVersion: hbase.stackable.tech/v1alpha1
+      controller: true
+      kind: HbaseCluster
+      name: test-hbase
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: test-hbase-regionserver-default-headless
+  ownerReferences:
+    - apiVersion: hbase.stackable.tech/v1alpha1
+      controller: true
+      kind: HbaseCluster
+      name: test-hbase
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: test-hbase-regionserver-default-metrics
+  ownerReferences:
+    - apiVersion: hbase.stackable.tech/v1alpha1
+      controller: true
+      kind: HbaseCluster
+      name: test-hbase
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: test-hbase-restserver-default-headless
+  ownerReferences:
+    - apiVersion: hbase.stackable.tech/v1alpha1
+      controller: true
+      kind: HbaseCluster
+      name: test-hbase
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: test-hbase-restserver-default-metrics
+  ownerReferences:
+    - apiVersion: hbase.stackable.tech/v1alpha1
+      controller: true
+      kind: HbaseCluster
+      name: test-hbase