Fix stale conditions on delete

Signed-off-by: Mangirdas Judeikis <mangirdas@judeikis.lt>
On-behalf-of: @SAP mangirdas.judeikis@sap.com

Author: mjudeikis

pkg/reconciler/apis/apibindingdeletion/apibinding_deletion_controller.go

@@ -261,7 +261,6 @@ func (c *Controller) process(ctx context.Context, key string) error {
 		return remainingErr
 	}
 
-	apibindingCopy = apibinding.DeepCopy()
 	filtered := make([]string, 0, len(apibindingCopy.Finalizers))
 	for i := range apibindingCopy.Finalizers {
 		if apibindingCopy.Finalizers[i] == APIBindingFinalizer {

pkg/reconciler/core/logicalclusterdeletion/deletion/logicalcluster_resource_deletor.go

@@ -50,6 +50,7 @@ import (
 
 	kcpmetadata "github.com/kcp-dev/client-go/metadata"
 	"github.com/kcp-dev/logicalcluster/v3"
+	"github.com/kcp-dev/sdk/apis/apis"
 	"github.com/kcp-dev/sdk/apis/core"
 	corev1alpha1 "github.com/kcp-dev/sdk/apis/core/v1alpha1"
 	tenancyv1alpha1 "github.com/kcp-dev/sdk/apis/tenancy/v1alpha1"
@@ -380,19 +381,31 @@ func (d *logicalClusterResourcesDeleter) deleteAllContent(ctx context.Context, w
 			return d.isBoundResource(logicalcluster.From(ws), group, resource)
 		}},
 	}, resources)
-	groupVersionResources, err := groupVersionResources(deletableResources)
+	allGVRs, err := groupVersionResources(deletableResources)
 	if err != nil {
 		// discovery errors are not fatal.  We often have some set of resources we can operate against even if we don't have a complete list
 		errs = append(errs, err)
 		deletionContentSuccessReason = "GroupVersionParsingFailed"
 	}
 
+	// Split GVRs: delete APIBindings last so their schemas remain available
+	// while namespaces cascade-delete bound resources.
+	apiBindingGVRs := map[schema.GroupVersionResource]sets.Set[string]{}
+	nonAPIBindingGVRs := map[schema.GroupVersionResource]sets.Set[string]{}
+	for gvr, verbs := range allGVRs {
+		if gvr.Group == apis.GroupName && gvr.Resource == "apibindings" {
+			apiBindingGVRs[gvr] = verbs
+		} else {
+			nonAPIBindingGVRs[gvr] = verbs
+		}
+	}
+
 	numRemainingTotals := allGVRDeletionMetadata{
 		gvrToNumRemaining:        map[schema.GroupVersionResource]int{},
 		finalizersToNumRemaining: map[string]int{},
 	}
 	deleteContentErrs := []error{}
-	for gvr, verbs := range groupVersionResources {
+	for gvr, verbs := range nonAPIBindingGVRs {
 		gvrDeletionMetadata, err := d.deleteAllContentForGroupVersionResource(ctx, logicalcluster.From(ws), gvr, verbs, clusterDeletedAt)
 		if err != nil {
 			// If there is an error, hold on to it but proceed with all the remaining
@@ -413,6 +426,28 @@ func (d *logicalClusterResourcesDeleter) deleteAllContent(ctx context.Context, w
 		}
 	}
 
+	// Only delete APIBindings after all other resources have been cleaned up.
+	if len(numRemainingTotals.gvrToNumRemaining) == 0 && len(numRemainingTotals.finalizersToNumRemaining) == 0 && len(deleteContentErrs) == 0 {
+		for gvr, verbs := range apiBindingGVRs {
+			gvrDeletionMetadata, err := d.deleteAllContentForGroupVersionResource(ctx, logicalcluster.From(ws), gvr, verbs, clusterDeletedAt)
+			if err != nil {
+				deleteContentErrs = append(deleteContentErrs, err)
+			}
+			if gvrDeletionMetadata.finalizerEstimateSeconds > estimate {
+				estimate = gvrDeletionMetadata.finalizerEstimateSeconds
+			}
+			if gvrDeletionMetadata.numRemaining > 0 {
+				numRemainingTotals.gvrToNumRemaining[gvr] = gvrDeletionMetadata.numRemaining
+				for finalizer, numRemaining := range gvrDeletionMetadata.finalizersToNumRemaining {
+					if numRemaining == 0 {
+						continue
+					}
+					numRemainingTotals.finalizersToNumRemaining[finalizer] += numRemaining
+				}
+			}
+		}
+	}
+
 	if len(deleteContentErrs) > 0 {
 		errs = append(errs, deleteContentErrs...)
 		deletionContentSuccessReason = "ContentDeletionFailed"