feat: hub-side referenced-data companion cleanup (Components 3+4+5)

Remove the cell-side CompanionGCReconciler — deleting a Karmada-owned cell
copy directly causes a permanent delete/recreate thrash because the Work
object immediately re-applies the manifest. Hub-side cleanup is the only
correct layer.

Component 5: Delete companion_gc_controller.go and its test, and remove the
--enable-cell-controllers registration block from cmd/main.go.

Component 3: After deleting a hub companion (ref-count reaches zero), the
downstreamCompanionWriter now also deletes the companion's Karmada
ResourceBinding via hubClient. RB name follows the Karmada binding-controller
convention: "{companionName}-{configmap|secret}". Deleting the RB cascades:
binding-controller removes the Work, execution-controller removes the cell
copy permanently. IgnoreNotFound tolerates Karmada beating us to it.
localCompanionWriter (single-cluster dev mode) is a no-op.

Component 4: New OrphanRBReconciler runs on the Karmada hub federation
manager (alongside InstanceProjector). It watches ResourceBindings and
deletes any that are orphaned companion RBs — name ends with "-configmap" or
"-secret" AND propagationpolicy.karmada.io/name starts with "city-" AND the
hub companion no longer exists. WD RBs (suffix "-workloaddeployment") and
non-city-PP RBs are never touched. A periodic sweep Runnable fires every 5
minutes to catch RBs orphaned before the controller started, which will
automatically clean the existing stranded lab RBs on first deployment.

RBAC: add delete to work.karmada.io/resourcebindings in downstream-rbac
(hub ClusterRole). karmada-io/api work/v1alpha2 types added to global
scheme so the federation client can serialize ResourceBinding objects.

Tests: unit tests for Component 3 (RB teardown fires on ConfigMap/Secret
companion deletion, tolerates NotFound, no-op on localCompanionWriter) and
Component 4 (orphan detection, skip live/terminating companions, tight scope
guards against WD RBs and non-city-PP RBs, name pattern parsing).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
(cherry picked from commit ac25bf7)

Author: scotwells

cmd/main.go

@@ -36,6 +36,7 @@ import (
 
 	karmadaclusterv1alpha1 "github.com/karmada-io/api/cluster/v1alpha1"
 	karmadapolicyv1alpha1 "github.com/karmada-io/api/policy/v1alpha1"
+	karmadaworkv1alpha2 "github.com/karmada-io/api/work/v1alpha2"
 	computev1alpha "go.datum.net/compute/api/v1alpha"
 	"go.datum.net/compute/internal/config"
 	"go.datum.net/compute/internal/controller"
@@ -83,6 +84,7 @@ func init() {
 	utilruntime.Must(quotav1alpha1.AddToScheme(scheme))
 	utilruntime.Must(karmadapolicyv1alpha1.Install(scheme))
 	utilruntime.Must(karmadaclusterv1alpha1.Install(scheme))
+	utilruntime.Must(karmadaworkv1alpha2.Install(scheme))
 
 	// +kubebuilder:scaffold:scheme
 }
@@ -315,13 +317,6 @@ func main() {
 		}
 	}
 
-	if enableCellControllers {
-		if err = (&controller.CompanionGCReconciler{}).SetupWithManager(mgr); err != nil {
-			setupLog.Error(err, "unable to create controller", "controller", "CompanionGC")
-			os.Exit(1)
-		}
-	}
-
 	// WorkloadDeploymentFederator and InstanceProjector are management-plane
 	// controllers that run on the control-plane cluster. The fail-loud guard above
 	// ensures federationRestConfig is non-nil when enableManagementControllers is
@@ -535,6 +530,15 @@ func setupManagementControllers(mgr mcmanager.Manager, federationClient client.C
 		return nil, fmt.Errorf("InstanceProjector: %w", err)
 	}
 
+	// OrphanRBReconciler sweeps Karmada ResourceBindings whose hub companion is
+	// gone, ensuring Works and cell copies are cleaned up even when Karmada's
+	// event-driven cascade misses the companion-deletion event (e.g. PP deleted
+	// before binding-controller reconcile completed). Runs on the hub federation
+	// manager alongside InstanceProjector.
+	if err = controller.SetupOrphanRBWithManager(federationMgr, federationClient); err != nil {
+		return nil, fmt.Errorf("OrphanRBReconciler: %w", err)
+	}
+
 	return []manager.Runnable{federationMgr}, nil
 }
 

config/base/downstream-rbac/rbac.yaml

@@ -24,7 +24,7 @@ rules:
     verbs: ["get", "list", "watch"]
   - apiGroups: ["work.karmada.io"]
     resources: ["resourcebindings", "clusterresourcebindings"]
-    verbs: ["get", "list", "watch"]
+    verbs: ["get", "list", "watch", "delete"]
   - apiGroups: ["config.karmada.io"]
     resources: ["resourceinterpreterwebhookconfigurations", "resourceinterpretercustomizations"]
     verbs: ["get", "list", "watch"]