Add finalizer and reconcileDelete to InstanceHA controller

The controller calls EnsureServiceTopology which places a finalizer on
the referenced Topology CR, but had no mechanism to remove it. Deleting
an InstanceHa CR would permanently orphan the Topology CR finalizer.

Add finalizer lifecycle following the DNSMasq controller pattern:
- Add finalizer on first reconcile (controllerutil.AddFinalizer)
- Check DeletionTimestamp before proceeding with reconciliation
- reconcileDelete removes the Topology CR finalizer via
  EnsureDeletedTopologyRef, then removes the InstanceHa finalizer

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: lmiccini

internal/controller/instanceha/instanceha_controller.go

@@ -176,6 +176,11 @@ func (r *Reconciler) Reconcile(ctx context.Context, req ctrl.Request) (result ct
 	instance.Status.Conditions.Init(&cl)
 	instance.Status.ObservedGeneration = instance.Generation
 
+	// If we're not deleting this and the service object doesn't have our finalizer, add it.
+	if instance.DeletionTimestamp.IsZero() && controllerutil.AddFinalizer(instance, helper.GetFinalizer()) || isNewInstance {
+		return ctrl.Result{}, nil
+	}
+
 	//// mark
 	if instance.Status.NetworkAttachments == nil {
 		instance.Status.NetworkAttachments = map[string][]string{}
@@ -187,6 +192,11 @@ func (r *Reconciler) Reconcile(ctx context.Context, req ctrl.Request) (result ct
 		cl.Set(c)
 	}
 
+	// Handle service delete
+	if !instance.DeletionTimestamp.IsZero() {
+		return r.reconcileDelete(ctx, instance, helper)
+	}
+
 	// Service account, role, binding
 	rbacRules := []rbacv1.PolicyRule{
 		{
@@ -897,6 +907,27 @@ func (r *Reconciler) findObjectsForSrc(ctx context.Context, src client.Object) [
 	return requests
 }
 
+func (r *Reconciler) reconcileDelete(ctx context.Context, instance *instancehav1.InstanceHa, helper *helper.Helper) (ctrl.Result, error) {
+	Log := r.GetLogger(ctx)
+	Log.Info("Reconciling Service delete")
+
+	// Remove finalizer on the Topology CR
+	if ctrlResult, err := topologyv1.EnsureDeletedTopologyRef(
+		ctx,
+		helper,
+		instance.Status.LastAppliedTopology,
+		instance.Name,
+	); err != nil {
+		return ctrlResult, err
+	}
+
+	// Service is deleted so remove the finalizer.
+	controllerutil.RemoveFinalizer(instance, helper.GetFinalizer())
+	Log.Info("Reconciled Service delete successfully")
+
+	return ctrl.Result{}, nil
+}
+
 // GetContainerImage returns the container image to use for the instance, either from
 // the provided containerImage parameter or from the infra-instanceha-config ConfigMap
 func (r *Reconciler) GetContainerImage(

test/functional/instanceha_controller_test.go

@@ -54,6 +54,13 @@ var _ = Describe("InstanceHa Controller", func() {
 				corev1.ConditionFalse,
 			)
 		})
+
+		It("should have the finalizer set on the CR", func() {
+			Eventually(func(g Gomega) {
+				instance := GetInstanceHa(instanceHaName)
+				g.Expect(instance.Finalizers).To(ContainElement("openstack.org/instanceha"))
+			}, timeout, interval).Should(Succeed())
+		})
 	})
 
 	When("prerequisite resources exist", func() {