SANDBOX-559 K8s 1 27 member

controllers/idler/idler_controller_test.go

@@ -80,9 +80,11 @@ func TestReconcile(t *testing.T) {
 		idler := &toolchainv1alpha1.Idler{
 			ObjectMeta: metav1.ObjectMeta{
 				Name:              "being-deleted",
+				Finalizers:        []string{"toolchain.dev.openshift.com"},
 				DeletionTimestamp: &now,
 			},
-			Spec: toolchainv1alpha1.IdlerSpec{TimeoutSeconds: 30},
+			Spec:   toolchainv1alpha1.IdlerSpec{TimeoutSeconds: 30},
+			Status: toolchainv1alpha1.IdlerStatus{Conditions: make([]toolchainv1alpha1.Condition, 0)},
 		}
 		reconciler, req, _, _, _ := prepareReconcile(t, "being-deleted", getHostCluster, idler)
 
@@ -635,7 +637,7 @@ func TestEnsureIdlingFailed(t *testing.T) {
 		require.NoError(t, err)
 
 		// second reconcile to delete pods and create notification
-		cl.MockStatusUpdate = func(ctx context.Context, obj client.Object, opts ...client.UpdateOption) error {
+		cl.MockStatusUpdate = func(ctx context.Context, obj client.Object, opts ...client.SubResourceUpdateOption) error {
 			return fmt.Errorf("cannot set status to fail")
 		}
 		_, err = reconciler.Reconcile(context.TODO(), req)
@@ -935,7 +937,7 @@ func TestCreateNotification(t *testing.T) {
 		nsTmplSet := newNSTmplSet(test.MemberOperatorNs, "alex", "advanced", "abcde11", namespaces, usernames)
 		mur := newMUR("alex")
 		reconciler, _, cl, _, _ := prepareReconcile(t, idler.Name, getHostCluster, idler, nsTmplSet, mur)
-		cl.MockStatusUpdate = func(ctx context.Context, obj client.Object, opts ...client.UpdateOption) error {
+		cl.MockStatusUpdate = func(ctx context.Context, obj client.Object, opts ...client.SubResourceUpdateOption) error {
 			return errors.New("can't update condition")
 		}
 		//when
@@ -1327,7 +1329,7 @@ func createPods(t *testing.T, r *Reconciler, owner metav1.Object, startTime meta
 	return podsToTrack
 }
 
-func prepareReconcile(t *testing.T, name string, getHostClusterFunc func(fakeClient client.Client) cluster.GetHostClusterFunc, initIdlerObjs ...runtime.Object) (*Reconciler, reconcile.Request, *test.FakeClient, *test.FakeClient, *fakedynamic.FakeDynamicClient) {
+func prepareReconcile(t *testing.T, name string, getHostClusterFunc func(fakeClient client.Client) cluster.GetHostClusterFunc, initIdlerObjs ...client.Object) (*Reconciler, reconcile.Request, *test.FakeClient, *test.FakeClient, *fakedynamic.FakeDynamicClient) {
 	s := scheme.Scheme
 	err := apis.AddToScheme(s)
 	require.NoError(t, err)

controllers/memberoperatorconfig/mapper.go

@@ -1,6 +1,7 @@
 package memberoperatorconfig
 
 import (
+	"context"
 	corev1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/types"
 	ctrl "sigs.k8s.io/controller-runtime"
@@ -11,8 +12,8 @@ import (
 var mapperLog = ctrl.Log.WithName("SecretToMemberOperatorConfigMapper")
 
 // MapSecretToMemberOperatorConfig maps secrets to the singular instance of MemberOperatorConfig named "config"
-func MapSecretToMemberOperatorConfig() func(object client.Object) []reconcile.Request {
-	return func(obj client.Object) []reconcile.Request {
+func MapSecretToMemberOperatorConfig() func(context context.Context, object client.Object) []reconcile.Request {
+	return func(ctx context.Context, obj client.Object) []reconcile.Request {
 		if secret, ok := obj.(*corev1.Secret); ok {
 			mapperLog.Info("Secret mapped to MemberOperatorConfig", "name", secret.Name)
 			return []reconcile.Request{{NamespacedName: types.NamespacedName{Namespace: secret.Namespace, Name: "config"}}}

controllers/memberoperatorconfig/mapper_test.go

@@ -1,6 +1,7 @@
 package memberoperatorconfig
 
 import (
+	"context"
 	"testing"
 
 	"github.com/codeready-toolchain/toolchain-common/pkg/test"
@@ -14,6 +15,7 @@ import (
 
 func TestSecretToMemberOperatorConfigMapper(t *testing.T) {
 	// when
+	ctx := context.TODO()
 	secretData := map[string][]byte{
 		"che-admin-username": []byte("cheadmin"),
 		"che-admin-password": []byte("password"),
@@ -24,7 +26,7 @@ func TestSecretToMemberOperatorConfigMapper(t *testing.T) {
 		secret := newSecret("test-secret", secretData)
 
 		// when
-		req := MapSecretToMemberOperatorConfig()(secret)
+		req := MapSecretToMemberOperatorConfig()(ctx, secret)
 
 		// then
 		require.Len(t, req, 1)
@@ -39,7 +41,7 @@ func TestSecretToMemberOperatorConfigMapper(t *testing.T) {
 		pod := &corev1.Pod{}
 
 		// when
-		req := MapSecretToMemberOperatorConfig()(pod)
+		req := MapSecretToMemberOperatorConfig()(ctx, pod)
 
 		// then
 		assert.Empty(t, req)

controllers/memberoperatorconfig/memberoperatorconfig_controller.go

@@ -22,14 +22,13 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/manager"
 	"sigs.k8s.io/controller-runtime/pkg/predicate"
 	"sigs.k8s.io/controller-runtime/pkg/reconcile"
-	"sigs.k8s.io/controller-runtime/pkg/source"
 )
 
 // SetupWithManager sets up the controller with the Manager.
 func (r *Reconciler) SetupWithManager(mgr manager.Manager) error {
 	return ctrl.NewControllerManagedBy(mgr).
 		For(&toolchainv1alpha1.MemberOperatorConfig{}, builder.WithPredicates(predicate.GenerationChangedPredicate{})).
-		Watches(&source.Kind{Type: &corev1.Secret{}},
+		Watches(&corev1.Secret{},
 			handler.EnqueueRequestsFromMapFunc(MapSecretToMemberOperatorConfig())).
 		Complete(r)
 }

controllers/memberoperatorconfig/memberoperatorconfig_controller_test.go

@@ -21,7 +21,6 @@ import (
 	schedulingv1 "k8s.io/api/scheduling/v1"
 	"k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/client-go/kubernetes/scheme"
 	ctrl "sigs.k8s.io/controller-runtime"
 	"sigs.k8s.io/controller-runtime/pkg/client"
@@ -341,7 +340,7 @@ func TestHandleWebConsolePluginDeploy(t *testing.T) {
 	})
 }
 
-func prepareReconcile(t *testing.T, initObjs ...runtime.Object) (*Reconciler, client.Client) {
+func prepareReconcile(t *testing.T, initObjs ...client.Object) (*Reconciler, client.Client) {
 	os.Setenv("WATCH_NAMESPACE", test.MemberOperatorNs)
 	restore := test.SetEnvVarAndRestore(t, "MEMBER_OPERATOR_WEBHOOK_IMAGE", "webhookimage")
 	t.Cleanup(restore)

controllers/memberstatus/memberstatus_controller_test.go

@@ -25,7 +25,6 @@ import (
 	corev1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/api/resource"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apimachinery/pkg/types"
 	"k8s.io/client-go/kubernetes/scheme"
 	"k8s.io/metrics/pkg/apis/metrics/v1beta1"
@@ -714,7 +713,7 @@ func newGetHostClusterNotExist(fakeClient client.Client) cluster.GetHostClusterF
 	return NewGetHostClusterWithProbe(fakeClient, false, corev1.ConditionFalse, metav1.Now())
 }
 
-func prepareReconcile(t *testing.T, requestName string, getHostClusterFunc func(fakeClient client.Client) cluster.GetHostClusterFunc, allNamespacesClient *test.FakeClient, lastGitHubAPICall time.Time, mockedGitHubClient commonclient.GetGitHubClientFunc, initObjs ...runtime.Object) (*Reconciler, reconcile.Request, *test.FakeClient) {
+func prepareReconcile(t *testing.T, requestName string, getHostClusterFunc func(fakeClient client.Client) cluster.GetHostClusterFunc, allNamespacesClient *test.FakeClient, lastGitHubAPICall time.Time, mockedGitHubClient commonclient.GetGitHubClientFunc, initObjs ...client.Object) (*Reconciler, reconcile.Request, *test.FakeClient) {
 	logf.SetLogger(zap.New(zap.UseDevMode(true)))
 	os.Setenv("WATCH_NAMESPACE", test.MemberOperatorNs)
 	fakeClient := test.NewFakeClient(t, initObjs...)
@@ -779,8 +778,8 @@ func withMemoryUsage(usage string) nodeMetricsModifier {
 	}
 }
 
-func newNodesAndNodeMetrics(nodeAndMetricsCreators ...nodeAndMetricsCreator) []runtime.Object {
-	var objects []runtime.Object
+func newNodesAndNodeMetrics(nodeAndMetricsCreators ...nodeAndMetricsCreator) []client.Object {
+	var objects []client.Object
 	for _, create := range nodeAndMetricsCreators {
 		node, nodeMetrics := create()
 		objects = append(objects, node, nodeMetrics)

controllers/nstemplateset/client_test.go

@@ -15,7 +15,6 @@ import (
 	appsv1 "k8s.io/api/apps/v1"
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apimachinery/pkg/runtime/serializer"
 	"k8s.io/client-go/kubernetes/scheme"
 	runtimeclient "sigs.k8s.io/controller-runtime/pkg/client"
@@ -330,7 +329,7 @@ func newOptionalDeployment(name, owner string) *appsv1.Deployment {
 	}
 }
 
-func prepareAPIClient(t *testing.T, initObjs ...runtime.Object) (*APIClient, *test.FakeClient) {
+func prepareAPIClient(t *testing.T, initObjs ...runtimeclient.Object) (*APIClient, *test.FakeClient) {
 	s := scheme.Scheme
 	err := apis.AddToScheme(s)
 	require.NoError(t, err)

controllers/nstemplateset/cluster_resources_test.go

@@ -434,7 +434,7 @@ func TestDeleteClusterResources(t *testing.T) {
 	t.Run("delete the second ClusterResourceQuota since the first one has deletion timestamp set", func(t *testing.T) {
 		// given
 		nsTmplSet := newNSTmplSet(namespaceName, spacename, "withemptycrq", withNamespaces("abcde11", "dev"), withClusterResources("abcde11"))
-		crq := newClusterResourceQuota(spacename, "withemptycrq")
+		crq := newClusterResourceQuota(spacename, "withemptycrq", withFinalizer())
 		deletionTS := metav1.NewTime(time.Now())
 		crq.SetDeletionTimestamp(&deletionTS)
 		emptyCrq := newClusterResourceQuota("empty", "withemptycrq")

controllers/nstemplateset/namespaces_test.go

@@ -589,7 +589,7 @@ func TestEnsureNamespacesFail(t *testing.T) {
 		nsTmplSet := newNSTmplSet(namespaceName, spacename, "basic", withNamespaces("abcde11", "dev"))
 		devNS := newNamespace("advanced", spacename, "dev") // NS exists but is missing the resources
 		manager, fakeClient := prepareNamespacesManager(t, nsTmplSet, devNS)
-		fakeClient.MockStatusUpdate = func(ctx context.Context, obj client.Object, opts ...client.UpdateOption) error {
+		fakeClient.MockStatusUpdate = func(ctx context.Context, obj client.Object, opts ...client.SubResourceUpdateOption) error {
 			return errors.New("unable to update NSTmplSet")
 		}
 
@@ -752,6 +752,7 @@ func TestDeleteNamespace(t *testing.T) {
 		// given namespace with deletion timestamp
 		timeStamp := metav1.Now()
 		deletedNS := codeNS.DeepCopy()
+		deletedNS.Finalizers = []string{toolchainv1alpha1.FinalizerName}
 		deletedNS.DeletionTimestamp = &timeStamp
 		manager, _ := prepareNamespacesManager(t, nsTmplSet, deletedNS)
 

controllers/nstemplateset/nstemplateset_controller.go

@@ -58,14 +58,14 @@ func (r *Reconciler) SetupWithManager(mgr manager.Manager, allNamespaceCluster r
 	mapToOwnerByLabel := handler.EnqueueRequestsFromMapFunc(commoncontroller.MapToOwnerByLabel("", toolchainv1alpha1.SpaceLabelKey))
 	build := ctrl.NewControllerManagedBy(mgr).
 		For(&toolchainv1alpha1.NSTemplateSet{}, builder.WithPredicates(predicate.GenerationChangedPredicate{})).
-		Watches(&source.Kind{Type: &corev1.Namespace{}}, mapToOwnerByLabel).
-		Watches(source.NewKindWithCache(&rbac.Role{}, allNamespaceCluster.GetCache()), mapToOwnerByLabel, builder.WithPredicates(commonpredicates.LabelsAndGenerationPredicate{})).
-		Watches(source.NewKindWithCache(&rbac.RoleBinding{}, allNamespaceCluster.GetCache()), mapToOwnerByLabel, builder.WithPredicates(commonpredicates.LabelsAndGenerationPredicate{}))
+		Watches(&corev1.Namespace{}, mapToOwnerByLabel).
+		WatchesRawSource(source.Kind(allNamespaceCluster.GetCache(), &rbac.Role{}), mapToOwnerByLabel, builder.WithPredicates(commonpredicates.LabelsAndGenerationPredicate{})).
+		WatchesRawSource(source.Kind(allNamespaceCluster.GetCache(), &rbac.RoleBinding{}), mapToOwnerByLabel, builder.WithPredicates(commonpredicates.LabelsAndGenerationPredicate{}))
 	// watch for all cluster resource kinds associated with an NSTemplateSet
 	for _, clusterResource := range clusterResourceKinds {
 		// only reconcile generation changes for cluster resources and only when the API group is present in the cluster
 		if apiGroupIsPresent(apiGroupList.Groups, clusterResource.gvk) {
-			build = build.Watches(&source.Kind{Type: clusterResource.object}, mapToOwnerByLabel, builder.WithPredicates(commonpredicates.LabelsAndGenerationPredicate{}))
+			build = build.Watches(clusterResource.object, mapToOwnerByLabel, builder.WithPredicates(commonpredicates.LabelsAndGenerationPredicate{}))
 		}
 	}
 

controllers/nstemplateset/nstemplateset_controller_test.go

@@ -1216,7 +1216,7 @@ func TestReconcileProvisionFail(t *testing.T) {
 		// given
 		nsTmplSet := newNSTmplSet(namespaceName, spacename, "basic", withNamespaces("abcde11", "dev", "stage"))
 		r, req, fakeClient := prepareReconcile(t, namespaceName, spacename, nsTmplSet)
-		fakeClient.MockStatusUpdate = func(ctx context.Context, obj client.Object, opts ...client.UpdateOption) error {
+		fakeClient.MockStatusUpdate = func(ctx context.Context, obj client.Object, opts ...client.SubResourceUpdateOption) error {
 			return errors.New("unable to update status")
 		}
 
@@ -1256,7 +1256,7 @@ func TestReconcileProvisionFail(t *testing.T) {
 		rb := newRoleBinding(devNS.Name, "crtadmin-pods", spacename)
 		rb2 := newRoleBinding(stageNS.Name, "crtadmin-pods", spacename)
 		r, req, fakeClient := prepareReconcile(t, namespaceName, spacename, nsTmplSet, devNS, stageNS, rb, rb2)
-		fakeClient.MockStatusUpdate = func(ctx context.Context, obj client.Object, opts ...client.UpdateOption) error {
+		fakeClient.MockStatusUpdate = func(ctx context.Context, obj client.Object, opts ...client.SubResourceUpdateOption) error {
 			if nsTmpl, ok := obj.(*toolchainv1alpha1.NSTemplateSet); ok {
 				if len(nsTmpl.Status.ProvisionedNamespaces) > 0 {
 					return errors.New("unable to update provisioned namespaces list")
@@ -1372,74 +1372,31 @@ func TestDeleteNSTemplateSet(t *testing.T) {
 		require.Empty(t, result)
 	})
 
-	t.Run("delete when there is no finalizer", func(t *testing.T) {
-		// given an NSTemplateSet resource which is being deleted and whose finalizer was already removed
-		nsTmplSet := newNSTmplSet(namespaceName, spacename, "basic", withoutFinalizer(), withDeletionTs(), withClusterResources("abcde11"), withNamespaces("abcde11", "dev", "stage"))
-		r, req, _ := prepareReconcile(t, namespaceName, spacename, nsTmplSet)
-
-		// when a reconcile loop is triggered
-		_, err := r.Reconcile(context.TODO(), req)
-
-		// then
-		require.NoError(t, err)
-		AssertThatNSTemplateSet(t, namespaceName, spacename, r.Client).
-			DoesNotHaveFinalizer() // finalizer was not added and nothing else was done
-	})
-
-	t.Run("NSTemplateSet not deleted until namespace is deleted", func(t *testing.T) {
+	t.Run("NSTemplateSet deletion errors when namespace is not deleted in 1 min", func(t *testing.T) {
 		// given an NSTemplateSet resource and 1 active user namespaces ("dev")
 		nsTmplSet := newNSTmplSet(namespaceName, spacename, "advanced", withNamespaces("abcde11", "dev", "stage"), withDeletionTs(), withClusterResources("abcde11"))
 		nsTmplSet.SetDeletionTimestamp(&metav1.Time{Time: time.Now().Add(-61 * time.Second)})
-		devNS := newNamespace("advanced", spacename, "dev", withTemplateRefUsingRevision("abcde11"))
-		stageNS := newNamespace("advanced", spacename, "stage", withTemplateRefUsingRevision("abcde11"))
+		devNS := newNamespace("advanced", spacename, "dev", withTemplateRefUsingRevision("abcde11"), withFinalizer())
+		stageNS := newNamespace("advanced", spacename, "stage", withTemplateRefUsingRevision("abcde11"), withFinalizer())
 
-		r, fakeClient := prepareController(t, nsTmplSet, devNS, stageNS)
+		r, _ := prepareController(t, nsTmplSet, devNS, stageNS)
 		req := newReconcileRequest(namespaceName, spacename)
 
-		// only add deletion timestamp, but not delete
-		fakeClient.MockDelete = func(ctx context.Context, obj client.Object, opts ...client.DeleteOption) error {
-			if obj, ok := obj.(*corev1.Namespace); ok {
-				deletionTs := metav1.Now()
-				obj.DeletionTimestamp = &deletionTs
-				if err := r.Client.Update(context.TODO(), obj); err != nil {
-					return err
-				}
-			}
-			return nil
-		}
-		// when
 		_, err := r.Reconcile(context.TODO(), req)
 
 		// then
 		require.EqualError(t, err, "NSTemplateSet deletion has not completed in over 1 minute")
 	})
 
 	t.Run("NSTemplateSet not deleted until namespace is deleted", func(t *testing.T) {
-		// given an NSTemplateSet resource and 1 active user namespaces ("dev")
+		// given an NSTemplateSet resource and 2 user namespaces ("dev" and "stage")
 		nsTmplSet := newNSTmplSet(namespaceName, spacename, "advanced", withNamespaces("abcde11", "dev", "stage"), withDeletionTs(), withClusterResources("abcde11"))
-		devNS := newNamespace("advanced", spacename, "dev", withTemplateRefUsingRevision("abcde11"))
+		devNS := newNamespace("advanced", spacename, "dev", withTemplateRefUsingRevision("abcde11"), withFinalizer())
 		stageNS := newNamespace("advanced", spacename, "stage", withTemplateRefUsingRevision("abcde11"))
 
 		r, fakeClient := prepareController(t, nsTmplSet, devNS, stageNS)
 		req := newReconcileRequest(namespaceName, spacename)
 
-		// only add deletion timestamp, but not delete
-		fakeClient.MockDelete = func(ctx context.Context, obj client.Object, opts ...client.DeleteOption) error {
-			if obj, ok := obj.(*corev1.Namespace); ok {
-				if len(obj.Finalizers) == 0 {
-					deletionTs := metav1.Now()
-					obj.DeletionTimestamp = &deletionTs
-					// we need to set finalizer, otherwise, the fakeclient would delete it as soon as the deletion timestamp is set
-					obj.Finalizers = []string{"kubernetes"}
-				} else {
-					obj.Finalizers = nil
-				}
-				if err := r.Client.Update(context.TODO(), obj); err != nil {
-					return err
-				}
-			}
-			return nil
-		}
 		// first reconcile, deletion is triggered
 		result, err := r.Reconcile(context.TODO(), req)
 		require.NoError(t, err)
@@ -1475,16 +1432,14 @@ func TestDeleteNSTemplateSet(t *testing.T) {
 			HasFinalizer().
 			HasConditions(Terminating())
 
-		// actually delete ns
+		// actually delete ns by removing finalizer
 		ns := &corev1.Namespace{}
 		err = r.Client.Get(context.TODO(), types.NamespacedName{Name: firstNSName}, ns)
 		require.NoError(t, err)
-		err = fakeClient.Delete(context.TODO(), ns)
+		ns.SetFinalizers(nil)
+		err = fakeClient.Update(context.TODO(), ns)
 		require.NoError(t, err)
 
-		// set MockDelete to nil
-		fakeClient.MockDelete = nil //now removing the mockDelete
-
 		// deletion of firstNS would trigger another reconcile deleting secondNS
 		result, err = r.Reconcile(context.TODO(), req)
 		require.NoError(t, err)
@@ -1511,33 +1466,33 @@ func TestDeleteNSTemplateSet(t *testing.T) {
 	})
 }
 
-func prepareReconcile(t *testing.T, namespaceName, name string, initObjs ...runtime.Object) (*Reconciler, reconcile.Request, *test.FakeClient) {
+func prepareReconcile(t *testing.T, namespaceName, name string, initObjs ...client.Object) (*Reconciler, reconcile.Request, *test.FakeClient) {
 	r, fakeClient := prepareController(t, initObjs...)
 	return r, newReconcileRequest(namespaceName, name), fakeClient
 }
 
-func prepareStatusManager(t *testing.T, initObjs ...runtime.Object) (*statusManager, *test.FakeClient) {
+func prepareStatusManager(t *testing.T, initObjs ...client.Object) (*statusManager, *test.FakeClient) {
 	apiClient, fakeClient := prepareAPIClient(t, initObjs...)
 	return &statusManager{
 		APIClient: apiClient,
 	}, fakeClient
 }
 
-func prepareNamespacesManager(t *testing.T, initObjs ...runtime.Object) (*namespacesManager, *test.FakeClient) {
+func prepareNamespacesManager(t *testing.T, initObjs ...client.Object) (*namespacesManager, *test.FakeClient) {
 	statusManager, fakeClient := prepareStatusManager(t, initObjs...)
 	return &namespacesManager{
 		statusManager: statusManager,
 	}, fakeClient
 }
 
-func prepareClusterResourcesManager(t *testing.T, initObjs ...runtime.Object) (*clusterResourcesManager, *test.FakeClient) {
+func prepareClusterResourcesManager(t *testing.T, initObjs ...client.Object) (*clusterResourcesManager, *test.FakeClient) {
 	statusManager, fakeClient := prepareStatusManager(t, initObjs...)
 	return &clusterResourcesManager{
 		statusManager: statusManager,
 	}, fakeClient
 }
 
-func prepareController(t *testing.T, initObjs ...runtime.Object) (*Reconciler, *test.FakeClient) {
+func prepareController(t *testing.T, initObjs ...client.Object) (*Reconciler, *test.FakeClient) {
 	apiClient, fakeClient := prepareAPIClient(t, initObjs...)
 	return NewReconciler(apiClient), fakeClient
 }
@@ -1829,8 +1784,15 @@ func withLastAppliedSpaceRoles(nsTmplSet *toolchainv1alpha1.NSTemplateSet) objec
 	}
 }
 
-func prepareTemplateTiers(decoder runtime.Decoder) ([]runtime.Object, error) {
-	var tierTemplates []runtime.Object
+func withFinalizer() objectMetaOption {
+	return func(meta metav1.ObjectMeta, tier, typeName string) metav1.ObjectMeta {
+		meta.Finalizers = append(meta.Finalizers, toolchainv1alpha1.FinalizerName)
+		return meta
+	}
+}
+
+func prepareTemplateTiers(decoder runtime.Decoder) ([]client.Object, error) {
+	var tierTemplates []client.Object
 
 	// templates indexed by tiername / type / revision
 	tmpls := map[string]map[string]map[string]string{