fix(vm): tolerate concurrent finalizer changes when releasing PVC protection#2659
Merged
Conversation
…tection
ProtectionService.RemoveProtection built its merge patch from a possibly stale
(informer cache) copy and resent the whole finalizers list. On a terminating
PersistentVolumeClaim this could re-add kubernetes.io/pvc-protection that the
built-in pvc-protection controller had already dropped, which the API server
rejects with 422 ("no new finalizers can be added if the object is being
deleted"). The VM deletion handler surfaced this as "failed to release PVC
protection" and never removed the VM cleanup finalizer, so VM deletion hung.
Re-read a fresh copy and patch it under an optimistic lock, retrying on
conflict, so only our finalizer is removed and no other finalizer is
resurrected.
Signed-off-by: Dmitry Rakitin <dmitry.rakitin@flant.com>
danilrwx
approved these changes
Jul 14, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
ProtectionService.RemoveProtectionre-reads a fresh copy of the object andremoves only our finalizer under an optimistic lock, retrying on conflict,
instead of resending the whole (possibly stale) finalizers list.
Why do we need it, and what problem does it solve?
On a terminating PVC the built-in
pvc-protectioncontroller stripskubernetes.io/pvc-protection. Patching from a stale copy resent it, and theAPI server rejected the update:
no new finalizers can be added if the object is being deleted. The VM deletion handler surfaced this asfailed to release PVC protection, never removed the VM cleanup finalizer, and VM deletion hung.What is the expected result?
Deleting a VM whose block-device PVC is terminating completes cleanly; the
errors above no longer appear in the vm-controller log.
Checklist
Changelog entries