test(conformance): non-blocking per-entry cleanup (don't stall on finalizers)

The idempotency run was hanging (then timing out) in the backup-enabled entry's
DeferCleanup: deleting the instance triggers the operator's on-delete backup
finalizer, whose snapshot Job can't complete with placeholder S3 creds, so the
default `kubectl delete` (which waits for finalizers) blocked indefinitely and
starved the remaining corpus entries. All 7 prior entries pass (Ready +
idempotency); switch the per-entry cleanup to a non-blocking delete
(--wait=false) so the full corpus runs. The ephemeral cluster is torn down at the
end, so a terminating instance left behind is harmless.

(Follow-up, operator-side: the backup-on-delete finalizer should not block
deletion indefinitely when the backup fails — an instance with bad creds is
otherwise undeletable.)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: stubbi

test/conformance/helpers.go

@@ -52,6 +52,16 @@ func kubectlDelete(yaml string) (string, error) {
 	return runStdin("kubectl", []string{"delete", "--ignore-not-found", "-f", "-"}, yaml)
 }
 
+// kubectlDeleteNoWait deletes without blocking on finalizers. Used for per-entry
+// cleanup in the idempotency corpus: some fixtures (e.g. backup-enabled) install
+// an on-delete finalizer whose snapshot Job cannot complete with placeholder
+// credentials, so a default `kubectl delete` (which waits for the finalizer)
+// would hang and starve the remaining corpus entries. The ephemeral cluster is
+// torn down at the end, so leaving a terminating instance behind is harmless.
+func kubectlDeleteNoWait(yaml string) (string, error) {
+	return runStdin("kubectl", []string{"delete", "--ignore-not-found", "--wait=false", "-f", "-"}, yaml)
+}
+
 func clientcmdPath() string {
 	if p := os.Getenv("KUBECONFIG"); p != "" {
 		return p

test/conformance/idempotency_test.go

@@ -147,7 +147,10 @@ var _ = Describe("idempotency canary", Ordered, func() {
 				Expect(instName).ToNot(BeEmpty(), "could not extract name from fixture %s", entry.fixture)
 
 				DeferCleanup(func() {
-					_, _ = kubectlDelete(namespaced)
+					// Non-blocking: a fixture's on-delete finalizer (e.g.
+					// backup-enabled's snapshot Job on placeholder creds) must not
+					// stall the rest of the corpus. The namespace is torn down at end.
+					_, _ = kubectlDeleteNoWait(namespaced)
 				})
 			})