fix: Add missing owns/watches and test early-exit reconcile

CHANGELOG.md

@@ -27,6 +27,8 @@
   See [our internal issue](https://github.com/stackabletech/hdfs-operator/issues/626) and [the fix](https://github.com/kube-rs/kube/pull/2042) for details ([#792]).
 - BREAKING: The app.kubernetes.io/managed-by label value changed from hbase.stackable.com_hbasecluster to
   hbase.stackable.tech_hbasecluster, aligning with all other operators ([#795]).
+- The operator now watches all resources that it creates and early-exits the reconcile action when the
+  cluster is marked for deletion ([#797]).
 - BREAKING: The rest-server listener PVC template now carries the recommended labels without the
   version label, so that the labels stay stable across upgrades.
   Existing rest-server StatefulSets must be deleted once before the new operator can reconcile them ([#799]).
@@ -37,6 +39,7 @@
 [#787]: https://github.com/stackabletech/hbase-operator/pull/787
 [#792]: https://github.com/stackabletech/hbase-operator/pull/792
 [#795]: https://github.com/stackabletech/hbase-operator/pull/795
+[#797]: https://github.com/stackabletech/hbase-operator/pull/797
 [#799]: https://github.com/stackabletech/hbase-operator/pull/799
 
 ## [26.7.0] - 2026-07-21

Cargo.toml

@@ -18,6 +18,7 @@ clap = "4.6"
 const_format = "0.2"
 fnv = "1.0"
 futures = { version = "0.3", features = ["compat"] }
+http = "1.3"
 indoc = "2.0"
 rstest = "0.26"
 serde = { version = "1.0", features = ["derive"] }

deploy/helm/hbase-operator/templates/clusterrole-operator.yaml

@@ -31,7 +31,7 @@ rules:
       - patch
       - watch
   # ServiceAccount created per HbaseCluster for workload pod identity.
-  # Applied via SSA and tracked for orphan cleanup.
+  # Applied via SSA, tracked for orphan cleanup and watched by the controller.
   - apiGroups:
       - ""
     resources:
@@ -42,8 +42,9 @@ rules:
       - get
       - list
       - patch
+      - watch
   # RoleBinding created per HbaseCluster to bind the product ClusterRole to the workload
-  # ServiceAccount. Applied via SSA and tracked for orphan cleanup.
+  # ServiceAccount. Applied via SSA, tracked for orphan cleanup and watched by the controller.
   - apiGroups:
       - rbac.authorization.k8s.io
     resources:
@@ -54,6 +55,7 @@ rules:
       - get
       - list
       - patch
+      - watch
   # Required to bind the product ClusterRole to the per-cluster ServiceAccount.
   - apiGroups:
       - rbac.authorization.k8s.io
@@ -75,7 +77,8 @@ rules:
       - list
       - patch
       - watch
-  # PodDisruptionBudget created per role. Applied via SSA and tracked for orphan cleanup.
+  # PodDisruptionBudget created per role. Applied via SSA, tracked for orphan cleanup and
+  # watched by the controller.
   - apiGroups:
       - policy
     resources:
@@ -86,6 +89,7 @@ rules:
       - get
       - list
       - patch
+      - watch
   # Required for maintaining the CRDs within the operator (including the conversion webhook info).
   # Also for the startup condition check before the controller can run.
   - apiGroups:

rust/operator-binary/Cargo.toml

@@ -29,5 +29,6 @@ tracing.workspace = true
 built.workspace = true
 
 [dev-dependencies]
+http.workspace = true
 rstest.workspace = true
 serde_yaml.workspace = true

rust/operator-binary/src/hbase_controller.rs

@@ -12,6 +12,7 @@ use stackable_operator::{
     cli::OperatorEnvironmentOptions,
     cluster_resources::ClusterResourceApplyStrategy,
     kube::{
+        Resource,
         core::{DeserializeGuard, error_boundary},
         runtime::controller::Action,
     },
@@ -76,6 +77,10 @@ pub async fn reconcile_hbase(
 ) -> Result<Action> {
     tracing::info!("Starting reconcile");
 
+    if hbase.meta().deletion_timestamp.is_some() {
+        return Ok(Action::await_change());
+    }
+
     let hbase = hbase
         .0
         .as_ref()
@@ -126,3 +131,124 @@ pub fn error_policy(
         _ => Action::requeue(*Duration::from_secs(5)),
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use stackable_operator::{
+        client::Client,
+        kube::{Client as KubeClient, Config},
+    };
+
+    use super::*;
+    use crate::test_utils;
+
+    /// A [`Ctx`] whose client points at a closed port. Any API call made through it fails the
+    /// reconciliation, so an `Ok` result proves the reconciler returned before touching the
+    /// Kubernetes API.
+    fn unreachable_ctx() -> Arc<Ctx> {
+        let config = Config::new(
+            "http://127.0.0.1:1"
+                .parse::<http::Uri>()
+                .expect("valid static URI"),
+        );
+        let kube_client = KubeClient::try_from(config).expect("client from static config");
+
+        Arc::new(Ctx {
+            client: Client::new(
+                kube_client,
+                None,
+                "default".to_owned(),
+                test_utils::cluster_info(),
+            ),
+            operator_environment: OperatorEnvironmentOptions {
+                operator_namespace: "stackable-operators".to_owned(),
+                operator_service_name: "hbase-operator".to_owned(),
+                image_repository: "oci.stackable.tech/sdp".to_owned(),
+            },
+        })
+    }
+
+    /// Drives the async reconciler from the synchronous tests used in this repo.
+    /// The [`Ctx`] is built inside `block_on` because the kube client needs a running reactor
+    /// already at construction time.
+    fn reconcile(hbase: DeserializeGuard<v1alpha1::HbaseCluster>) -> Result<Action> {
+        tokio::runtime::Builder::new_current_thread()
+            .enable_all()
+            .build()
+            .expect("current-thread tokio runtime")
+            .block_on(async { reconcile_hbase(Arc::new(hbase), unreachable_ctx()).await })
+    }
+
+    #[test]
+    fn reconcile_exits_early_for_deleted_cluster() {
+        let hbase = serde_yaml::from_str(
+            r#"
+apiVersion: hbase.stackable.tech/v1alpha1
+kind: HbaseCluster
+metadata:
+  name: hbase
+  namespace: default
+  deletionTimestamp: "2026-08-14T12:00:00Z"
+spec:
+  image:
+    productVersion: 2.6.3
+  clusterConfig:
+    hdfsConfigMapName: simple-hdfs
+    zookeeperConfigMapName: simple-znode
+"#,
+        )
+        .expect("valid HbaseCluster YAML");
+
+        let action = reconcile(hbase).expect("a deleted cluster reconciles without any API call");
+
+        assert_eq!(action, Action::await_change());
+    }
+
+    #[test]
+    fn reconcile_exits_early_for_deleted_cluster_with_invalid_spec() {
+        let hbase = serde_yaml::from_str(
+            r#"
+apiVersion: hbase.stackable.tech/v1alpha1
+kind: HbaseCluster
+metadata:
+  name: hbase
+  namespace: default
+  deletionTimestamp: "2026-08-14T12:00:00Z"
+spec: {}
+"#,
+        )
+        .expect("YAML parses; the invalid spec is captured inside the DeserializeGuard");
+
+        let action =
+            reconcile(hbase).expect("a deleted cluster reconciles even when its spec is invalid");
+
+        assert_eq!(action, Action::await_change());
+    }
+
+    #[test]
+    fn reconcile_proceeds_for_live_cluster() {
+        let hbase = serde_yaml::from_str(
+            r#"
+apiVersion: hbase.stackable.tech/v1alpha1
+kind: HbaseCluster
+metadata:
+  name: hbase
+  namespace: default
+spec:
+  image:
+    productVersion: 2.6.3
+  clusterConfig:
+    hdfsConfigMapName: simple-hdfs
+    zookeeperConfigMapName: simple-znode
+"#,
+        )
+        .expect("valid HbaseCluster YAML");
+
+        let result = reconcile(hbase);
+
+        assert!(
+            matches!(result, Err(Error::Dereference { .. })),
+            "a live cluster must reach the API but when dereferencing against the unreachable test server: {result:?}"
+        );
+    }
+}

rust/operator-binary/src/main.rs

@@ -14,7 +14,9 @@ use stackable_operator::{
     eos::EndOfSupportChecker,
     k8s_openapi::api::{
         apps::v1::StatefulSet,
-        core::v1::{ConfigMap, Service},
+        core::v1::{ConfigMap, Service, ServiceAccount},
+        policy::v1::PodDisruptionBudget,
+        rbac::v1::RoleBinding,
     },
     kube::{
         CustomResourceExt, ResourceExt,
@@ -126,10 +128,26 @@ async fn main() -> anyhow::Result<()> {
             );
             let config_map_store = hbase_controller.store();
             let hbase_controller = hbase_controller
+                .owns(
+                    watch_namespace.get_api::<ConfigMap>(&client),
+                    watcher::Config::default(),
+                )
+                .owns(
+                    watch_namespace.get_api::<PodDisruptionBudget>(&client),
+                    watcher::Config::default(),
+                )
+                .owns(
+                    watch_namespace.get_api::<RoleBinding>(&client),
+                    watcher::Config::default(),
+                )
                 .owns(
                     watch_namespace.get_api::<Service>(&client),
                     watcher::Config::default(),
                 )
+                .owns(
+                    watch_namespace.get_api::<ServiceAccount>(&client),
+                    watcher::Config::default(),
+                )
                 .owns(
                     watch_namespace.get_api::<StatefulSet>(&client),
                     watcher::Config::default(),