Where finalizers should be set?

[Segflow]

I have a question wrt setting finalizers, the book example sets in the controller reconcile loop but I do have the impression that setting the finalizer in the mutating webhook (if you already have one) is also an option

What other people think?

[camilamacedo86]

I would recommend you add it after you fetch the CR and ensure that it exists. You might want to check here: https://sdk.operatorframework.io/docs/building-operators/golang/advanced-topics/#external-resources some examples

[FillZpp]

@Segflow There can be always two places to update a resource object, in controller reconcile or in mutating webhook. My suggestion is, do it in controller reconcile as much as possible, unless the object has to be modified during its request to APIServer.

So back to your question, it depends on what you want to do with the finalizers.

1. If the object should be protected once it created so that it can be reconciled to do something cleanup when it has been deleted, you should set the finalizer in mutating webhook.
2. If the object has no need to be protected once it created, but only needs to block deletion after it is reconciled and has some cleanup to do, you should set the finalizer in your controller reconcile.

Usually most cases are (2).

[Segflow]

@FillZpp I like that approach of thinking thanks!

One other pros I can found when doing the initialization (e.g setting finalizers) in the controller is that it also work if you have webhook disabled (e.g when doing local dev)

[FillZpp]

Yeah, it is very difficult to test webhook locally, unless the kube-apiserver could connect to the local IP and the clientConfig of webhook configuration should be configured as a URL instead of a service.

[camilamacedo86]

Closing since it is answered.