ZooKeeper znode controller: release finalizer without connecting when the parent is deleting

finalizer::Event::Cleanup アームから開始し、deletionTimestamp を持つ参照先の ZookeeperCluster をどのように処理するかを追跡します。ensure_znode_missing のクリーンアップパスと、Terminating で停止した namespace を明らかにする統合テストを確認します。削除時に ZooKeeper 接続をスキップし、数分間のバックオフなしで finalizer を解放できれば完了です。

Problem

In some scenarios, the ZookeeperZnode finalizer (zookeeper.stackable.tech/znode) can take around 130–150s to release. That's what sometimes leaves namespaces stuck in Terminating in our integration tests.

This can happen when the operator tries connection to Zookeeper to delete the node, while ZooKeeper is being torn down, the delete/cleanup path (ensure_znode_missing) runs its errors through controller-runtime's exponential backoff, and that's where the multi-minute stall comes from.

Mechanism

1. znode cleanup (ensure_znode_missing) tries to connect to the ZK service and gets Connection refused — the ZK pods/endpoints are already gone — so the reconcile errors out.
2. The ZookeeperCluster CR then drops out of the watch cache. At this point the finalizer's fast path (cluster doesn't exist → assume the znode is gone → drop the finalizer without connecting) would kick in, but the failed reconcile is already sitting in exponential backoff.
3. ~139s gap: nothing re-runs, even though the fast-path condition is now true.
4. Backoff finally expires, the reconcile re-runs, the fast path fires, the finalizer is removed, and the namespace deletes.

So it comes down to queue ordering under load. If cleanup runs after the CR leaves the store, it's instant if it runs before, it errors, hits backoff, and takes 130s+.

Fix

In the finalizer::Event::Cleanup arm: if the referenced ZookeeperCluster has a deletionTimestamp, drop the finalizer straight away without connecting to ZK. Retrying an unreachable server makes sense on the create path; on the delete path it shouldn't be allowed to block teardown.