Fix finalizers preventing namespace deletion

[djnewbould]

Finalizers on custom resource definitions cause both the factory-plus namespace to be stuck in a terminating state. The added job runs on the helm post delete hook and patches the Kerberos Key to remove the finalizers.

• Fix factory-plus namespace deletion.

How to test

1. Run Helm uninstall acs -n factory-plus.
2. Wait for the job to complete.
3. Run kubectl delete namesapce factory-plus to delete the factory-plus namespace.
4. The namespace should delete and not be stuck in a terminating state.

[amrc-benmorrow]

This looks good. Getting an edge cluster to uninstall cleanly will be less straightforward as there are multiple charts involved, but making the edge-cluster chart uninstall on its own will be a good start.

I presume you've tested that Helm is willing to run a post-delete hook with the kerberos-keys still present? I wasn't sure it would.

When it comes to the LocalSecret resources you may run into an issue as this CRD is not yet installed onto the central cluster. Probably the best way forward is to make sure it is; copy the CRD from acs-krb-keys-operator/crd to deploy/crds.

[djnewbould]

This looks good. Getting an edge cluster to uninstall cleanly will be less straightforward as there are multiple charts involved, but making the edge-cluster chart uninstall on its own will be a good start.

I presume you've tested that Helm is willing to run a post-delete hook with the kerberos-keys still present? I wasn't sure it would.

When it comes to the LocalSecret resources you may run into an issue as this CRD is not yet installed onto the central cluster. Probably the best way forward is to make sure it is; copy the CRD from acs-krb-keys-operator/crd to deploy/crds.

I didn't notice any issues with the local secret resource,. Do you think its worth copying across anyway?

[amrc-benmorrow]

I've moved the edge cluster conversations into a new ticket on our internal Jira.

Ideally this would be rebased onto main to remove the reverted commits, but I'm not going to hold up approving it for that.