feature: API-SyncAgent finalizer & owner enhancement

[BergCyrill]

Feature Description

Currently it is not visible on a synced CR whether it is managed by a API-SyncAgent.
The only dependency one may see is the finalizer "syncagent.kcp.io/cleanup". This may be intentional but makes troubleshooting hard. Some annotation would be helpful here.
Additionally this digs up another improvement: When there is a related resource (source: kcp) which is referenced by multiple CRs they will use the same finalizer value concurrently. This may lead to orphaned resources if one of those CRs gets deleted (and #116 is solved).

Proposed Solution

We could:

• add an annotation to synced resources showing ownership
• enhance finalizers on related resources to allow multiple API-SyncAgents to reference a resource and manage cleanup dependencies

Alternative Solutions

No response

Want to contribute?

• I would like to work on this issue.

Additional Context

No response

[xrstf]

Additionally this digs up another improvement: When there is a related resource (source: kcp) which is referenced by multiple CRs they will use the same finalizer value concurrently. This may lead to orphaned resources if one of those CRs gets deleted (and #116 is solved).

Yeah that makes sense, maybe we need to include the agent name in the finalizer name. Or use annotations and make the agents smart enough to only let the last one actually remove the finalizer and unblock the deletion.

The only dependency one may see is the finalizer "syncagent.kcp.io/cleanup". This may be intentional but makes troubleshooting hard. Some annotation would be helpful here.

That is actually a purposeful design decision in the code, to not leak any sync-related data into consume workspaces. You could use mutations to inject your own annotations, or we could maybe add a debug mode to the agent, but I would not like the agent to just by default leak sync details to the consumers.

[BergCyrill]

Yeah that makes sense, maybe we need to include the agent name in the finalizer name. Or use annotations and make the agents smart enough to only let the last one actually remove the finalizer and unblock the deletion.

One could apply the same logic to the synced resource itself and either write the agent name into the finalizer or add the same annotation like in related resources. I think this would be helpful enough and not leak any sync-related data into the consumer workspaces.