fix: Add missing owns/watches and test early-exit reconcile

CHANGELOG.md

@@ -29,13 +29,16 @@ All notable changes to this project will be documented in this file.
 - Fix a longstanding problem of including empty `categories`, `shortNames` and `additionalPrinterColumns` in the CRDs,
   which could cause problems with GitOps tools (e.g. ArgoCD) reporting a diff in the custom resources.
   See [our internal issue](https://github.com/stackabletech/hdfs-operator/issues/626) and [the fix](https://github.com/kube-rs/kube/pull/2042) for details ([#814]).
+- The operator now watches all resources that it creates and early-exits the reconcile action when the
+  cluster is marked for deletion ([#821]).
 
 [#801]: https://github.com/stackabletech/hdfs-operator/pull/801
 [#806]: https://github.com/stackabletech/hdfs-operator/pull/806
 [#810]: https://github.com/stackabletech/hdfs-operator/pull/810
 [#811]: https://github.com/stackabletech/hdfs-operator/pull/811
 [#814]: https://github.com/stackabletech/hdfs-operator/pull/814
 [#819]: https://github.com/stackabletech/hdfs-operator/pull/819
+[#821]: https://github.com/stackabletech/hdfs-operator/pull/821
 
 ## [26.7.0] - 2026-07-21
 

deploy/helm/hdfs-operator/templates/clusterrole-operator.yaml

@@ -13,13 +13,15 @@ rules:
       - nodes/proxy
     verbs:
       - get
-  # Manage core workload resources created per HdfsCluster.
-  # All resources are applied via Server-Side Apply (create + patch) and tracked for
-  # orphan cleanup (list + delete).
+  # Manage core workload resources created per HdfsCluster (the ServiceAccount
+  # provides workload pod identity). All resources are applied via Server-Side Apply
+  # (create + patch), tracked for orphan cleanup (list + delete) and watched by the
+  # controller.
   - apiGroups:
       - ""
     resources:
       - configmaps
+      - serviceaccounts
       - services
     verbs:
       - create
@@ -28,18 +30,8 @@ rules:
       - list
       - patch
       - watch
-  # serviceaccounts are applied via SSA and tracked for orphan cleanup.
-  - apiGroups:
-      - ""
-    resources:
-      - serviceaccounts
-    verbs:
-      - create
-      - delete
-      - get
-      - list
-      - patch
-  # rolebindings are applied via SSA and tracked for orphan cleanup.
+  # rolebindings are applied via SSA and tracked for orphan cleanup
+  # and watched by the controller.
   - apiGroups:
       - rbac.authorization.k8s.io
     resources:
@@ -50,6 +42,7 @@ rules:
       - get
       - list
       - patch
+      - watch
   # statefulsets are applied via SSA, tracked for orphan cleanup.
   - apiGroups:
       - apps
@@ -62,7 +55,8 @@ rules:
       - list
       - patch
       - watch
-  # poddisruptionbudgets are applied via SSA and tracked for orphan cleanup.
+  # poddisruptionbudgets are applied via SSA and tracked for orphan cleanup
+  # and watched by the controller.
   - apiGroups:
       - policy
     resources:
@@ -73,6 +67,7 @@ rules:
       - get
       - list
       - patch
+      - watch
   # Required for maintaining the CRDs within the operator (including the conversion webhook info).
   # Also for the startup condition check before the controller can run.
   - apiGroups:

rust/operator-binary/src/hdfs_controller.rs

@@ -84,6 +84,10 @@ pub async fn reconcile_hdfs(
 ) -> HdfsOperatorResult<Action> {
     tracing::info!("Starting reconcile");
 
+    if hdfs.meta().deletion_timestamp.is_some() {
+        return Ok(Action::await_change());
+    }
+
     let hdfs = hdfs
         .0
         .as_ref()
@@ -160,13 +164,25 @@ mod test {
     use std::str::FromStr;
 
     use stackable_operator::{
-        builder::pod::PodBuilder, commons::networking::DomainName, kube::api::ObjectMeta,
-        kvp::Labels, utils::cluster_info::KubernetesClusterInfo,
+        builder::pod::PodBuilder,
+        client::Client,
+        commons::networking::DomainName,
+        kube::{
+            Client as KubeClient, Config,
+            api::ObjectMeta,
+            runtime::{
+                controller::Action,
+                events::{Recorder, Reporter},
+            },
+        },
+        kvp::Labels,
+        utils::cluster_info::KubernetesClusterInfo,
         v2::types::operator::RoleGroupName,
     };
 
     use super::*;
     use crate::{
+        HDFS_FULL_CONTROLLER_NAME,
         controller::build::container::ContainerConfig,
         test_support::{deserialize_cluster, role_group_config, validate_cluster},
     };
@@ -261,4 +277,63 @@ spec:
             Some("group-value".to_string())
         );
     }
+
+    /// The client points at a closed port, so any API call would fail the reconciliation: an `Ok`
+    /// proves that a cluster being deleted returns before the reconciler touches the Kubernetes
+    /// API, and because the spec is invalid, before the [`DeserializeGuard`] is unwrapped.
+    #[test]
+    fn reconcile_exits_early_for_deleted_cluster() {
+        let hdfs = serde_yaml::from_str(
+            r#"
+apiVersion: hdfs.stackable.tech/v1alpha1
+kind: HdfsCluster
+metadata:
+  name: hdfs
+  namespace: default
+  deletionTimestamp: "2026-08-14T12:00:00Z"
+spec: {}
+"#,
+        )
+        .expect("YAML parses; the invalid spec is captured inside the DeserializeGuard");
+
+        let action = tokio::runtime::Builder::new_current_thread()
+            .enable_all()
+            .build()
+            .expect("current-thread tokio runtime")
+            .block_on(async {
+                let kube_client = KubeClient::try_from(Config::new(
+                    "http://127.0.0.1:1".parse().expect("valid static URI"),
+                ))
+                .expect("client from static config");
+
+                let ctx = Arc::new(Ctx {
+                    client: Client::new(
+                        kube_client.clone(),
+                        None,
+                        "default".to_owned(),
+                        KubernetesClusterInfo {
+                            cluster_domain: DomainName::from_str("cluster.local")
+                                .expect("valid cluster domain"),
+                        },
+                    ),
+                    event_recorder: Arc::new(Recorder::new(
+                        kube_client,
+                        Reporter {
+                            controller: HDFS_FULL_CONTROLLER_NAME.to_string(),
+                            instance: None,
+                        },
+                    )),
+                    operator_environment: OperatorEnvironmentOptions {
+                        operator_namespace: "stackable-operators".to_owned(),
+                        operator_service_name: "hdfs-operator".to_owned(),
+                        image_repository: "oci.stackable.tech/sdp".to_owned(),
+                    },
+                });
+
+                reconcile_hdfs(Arc::new(hdfs), ctx).await
+            })
+            .expect("a deleted cluster reconciles without any API call");
+
+        assert_eq!(action, Action::await_change());
+    }
 }

rust/operator-binary/src/main.rs

@@ -17,7 +17,9 @@ use stackable_operator::{
     eos::EndOfSupportChecker,
     k8s_openapi::api::{
         apps::v1::StatefulSet,
-        core::v1::{ConfigMap, Service},
+        core::v1::{ConfigMap, Service, ServiceAccount},
+        policy::v1::PodDisruptionBudget,
+        rbac::v1::RoleBinding,
     },
     kube::{
         Api, CustomResourceExt, ResourceExt,
@@ -156,15 +158,27 @@ async fn main() -> anyhow::Result<()> {
             let hdfs_cluster_store = hdfs_controller.store();
             let hdfs_controller = hdfs_controller
                 .owns(
-                    watch_namespace.get_api::<DeserializeGuard<StatefulSet>>(&client),
+                    watch_namespace.get_api::<DeserializeGuard<ConfigMap>>(&client),
+                    watcher::Config::default(),
+                )
+                .owns(
+                    watch_namespace.get_api::<DeserializeGuard<PodDisruptionBudget>>(&client),
+                    watcher::Config::default(),
+                )
+                .owns(
+                    watch_namespace.get_api::<DeserializeGuard<RoleBinding>>(&client),
                     watcher::Config::default(),
                 )
                 .owns(
                     watch_namespace.get_api::<DeserializeGuard<Service>>(&client),
                     watcher::Config::default(),
                 )
                 .owns(
-                    watch_namespace.get_api::<DeserializeGuard<ConfigMap>>(&client),
+                    watch_namespace.get_api::<DeserializeGuard<ServiceAccount>>(&client),
+                    watcher::Config::default(),
+                )
+                .owns(
+                    watch_namespace.get_api::<DeserializeGuard<StatefulSet>>(&client),
                     watcher::Config::default(),
                 )
                 .watches(

tests/templates/kuttl/cluster-operation/60-assert.yaml

@@ -0,0 +1,170 @@
+---
+# The recreated StatefulSets must bring the cluster back to ready, and the recreated
+# objects must carry an owner reference back to the HdfsCluster so that garbage
+# collection still works for them.
+apiVersion: kuttl.dev/v1beta1
+kind: TestAssert
+metadata:
+  name: recreate-owned-resources
+timeout: 600
+commands:
+  - script: kubectl -n $NAMESPACE wait --for=condition=available hdfsclusters.hdfs.stackable.tech/hdfs --timeout 601s
+---
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: hdfs-namenode-default
+  ownerReferences:
+    - apiVersion: hdfs.stackable.tech/v1alpha1
+      controller: true
+      kind: HdfsCluster
+      name: hdfs
+status:
+  readyReplicas: 2
+  replicas: 2
+---
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: hdfs-datanode-default
+  ownerReferences:
+    - apiVersion: hdfs.stackable.tech/v1alpha1
+      controller: true
+      kind: HdfsCluster
+      name: hdfs
+status:
+  readyReplicas: 1
+  replicas: 1
+---
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: hdfs-journalnode-default
+  ownerReferences:
+    - apiVersion: hdfs.stackable.tech/v1alpha1
+      controller: true
+      kind: HdfsCluster
+      name: hdfs
+status:
+  readyReplicas: 1
+  replicas: 1
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: hdfs-serviceaccount
+  ownerReferences:
+    - apiVersion: hdfs.stackable.tech/v1alpha1
+      controller: true
+      kind: HdfsCluster
+      name: hdfs
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: hdfs-rolebinding
+  ownerReferences:
+    - apiVersion: hdfs.stackable.tech/v1alpha1
+      controller: true
+      kind: HdfsCluster
+      name: hdfs
+---
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: hdfs-namenode
+  ownerReferences:
+    - apiVersion: hdfs.stackable.tech/v1alpha1
+      controller: true
+      kind: HdfsCluster
+      name: hdfs
+---
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: hdfs-datanode
+  ownerReferences:
+    - apiVersion: hdfs.stackable.tech/v1alpha1
+      controller: true
+      kind: HdfsCluster
+      name: hdfs
+---
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: hdfs-journalnode
+  ownerReferences:
+    - apiVersion: hdfs.stackable.tech/v1alpha1
+      controller: true
+      kind: HdfsCluster
+      name: hdfs
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: hdfs
+  ownerReferences:
+    - apiVersion: hdfs.stackable.tech/v1alpha1
+      controller: true
+      kind: HdfsCluster
+      name: hdfs
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: hdfs-namenode-default
+  ownerReferences:
+    - apiVersion: hdfs.stackable.tech/v1alpha1
+      controller: true
+      kind: HdfsCluster
+      name: hdfs
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: hdfs-namenode-default-metrics
+  ownerReferences:
+    - apiVersion: hdfs.stackable.tech/v1alpha1
+      controller: true
+      kind: HdfsCluster
+      name: hdfs
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: hdfs-datanode-default
+  ownerReferences:
+    - apiVersion: hdfs.stackable.tech/v1alpha1
+      controller: true
+      kind: HdfsCluster
+      name: hdfs
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: hdfs-datanode-default-metrics
+  ownerReferences:
+    - apiVersion: hdfs.stackable.tech/v1alpha1
+      controller: true
+      kind: HdfsCluster
+      name: hdfs
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: hdfs-journalnode-default
+  ownerReferences:
+    - apiVersion: hdfs.stackable.tech/v1alpha1
+      controller: true
+      kind: HdfsCluster
+      name: hdfs
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: hdfs-journalnode-default-metrics
+  ownerReferences:
+    - apiVersion: hdfs.stackable.tech/v1alpha1
+      controller: true
+      kind: HdfsCluster
+      name: hdfs