Deletion of `KonnectAPIAuth` makes impossible to delete any of dependant resources

[programmer04]

Problem Statement

Deletion of KonnectAPIAuth (which contains the secret to access Konnect) makes impossible to delete any other dependent, Konnect-integrated resources. Because there is no way for the KO to authenticate to Konnect.

Proposed Solution

Introduce a mechanism and document it, which prevents (or at least makes less surprising) the aforementioned problem.

There are a couple of ways to do it, each with its own benefits and drawbacks.

1. Validation webhook for deletion request for KonnectAPIAuth checks if any other resources depend on it and, in such a case, forbids deletion with a descriptive message. The order of deletion has to be preserved because, without KonnectAPIAuth resource deletion of Konnect-related resources becomes impossible.

2. Preventing deletion of KonnectAPIAuth by a setting finalizer.
   Such a finalizer is removed when all dependent resources are deleted, so deletion of KonnectAPIAuth can proceed. The user experience has a flaw, because the deletion of KonnectAPIAuth hangs in such a situation without any message, and the user needs to delete all dependent resources manually to unstuck it.

3. Cascade deletion
   Deletion of KonnectAPIAuth deletes all resources that depend on it. It seems plausible from a technical perspective, but it's rather surprising from a user's point of view. Deleting the resource needed for authentication shouldn't remove other objects without any confirmation.

Considering the above, it seems that option 1 - validation webhook is the best.

Acceptance Criteria

• implement validation logic for the deletion of KonnectAPIAuth

[justindavies]

Option 1 gets my vote, the other two are two much of a surprise (delete everything) or confusing (finaliser)

[justindavies]

I'd ideally like to see this for 2.1 to reduce confusion for customers if they mistakenly delete KonnectAPIAuth

[sandromodarelli]

from the in person meeting:

• We need to add a finalizer pointing to resources that are dependant on KonnectAPIAuth
• We need to make customers aware of the situation by:
  • Applying a proper status condition
  • Add a proper documentation regarding the finalizer applied to KonnectAPIAuth