Add terminating virtualworkspace

config/crds/core.kcp.io_logicalclusters.yaml

@@ -119,6 +119,17 @@ spec:
                 - resource
                 - uid
                 type: object
+              terminators:
+                description: |-
+                  Terminators are set on creation by the system and copied to status when
+                  termination starts.
+                items:
+                  description: |-
+                    LogicalClusterTerminator is a unique string corresponding to a logical cluster
+                    terminator controller.
+                  pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(:[a-z0-9]([-a-z0-9]*[a-z0-9])?)*(:[a-z0-9][a-z0-9]([-a-z0-9]*[a-z0-9])?))|(system:.+)$
+                  type: string
+                type: array
             type: object
           status:
             default: {}
@@ -197,6 +208,18 @@ spec:
                 - Ready
                 - Unavailable
                 type: string
+              terminators:
+                description: |-
+                  Terminators are set on creation by the system and must be cleared
+                  by a controller before the logical cluster can be deleted. The LogicalCluster object
+                  will stay in the phase "Deleting" until all terminator are cleared.
+                items:
+                  description: |-
+                    LogicalClusterTerminator is a unique string corresponding to a logical cluster
+                    terminator controller.
+                  pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(:[a-z0-9]([-a-z0-9]*[a-z0-9])?)*(:[a-z0-9][a-z0-9]([-a-z0-9]*[a-z0-9])?))|(system:.+)$
+                  type: string
+                type: array
             type: object
         type: object
     served: true

config/crds/tenancy.kcp.io_workspaces.yaml

@@ -299,6 +299,17 @@ spec:
                 - Ready
                 - Unavailable
                 type: string
+              terminators:
+                description: |-
+                  terminators must be cleared by a controller before the workspace is being
+                  deleted.
+                items:
+                  description: |-
+                    LogicalClusterTerminator is a unique string corresponding to a logical cluster
+                    terminator controller.
+                  pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(:[a-z0-9]([-a-z0-9]*[a-z0-9])?)*(:[a-z0-9][a-z0-9]([-a-z0-9]*[a-z0-9])?))|(system:.+)$
+                  type: string
+                type: array
             type: object
         required:
         - spec

config/crds/tenancy.kcp.io_workspacetypes.yaml

@@ -249,6 +249,18 @@ spec:
                     minItems: 1
                     type: array
                 type: object
+              terminator:
+                description: |-
+                  Terminator determines if this WorkspaceType has an associated terminating
+                  controller. These controllers are used to add functionality to a Workspace;
+                  all controllers must finish their work before the Workspace is being deleted.
+
+                  One terminating controller is supported per WorkspaceType; the identifier
+                  for this terminator will be a colon-delimited string using the workspace in which
+                  the WorkspaceType is defined, and the type's name. For example, if a
+                  WorkspaceType `example` is created in the `root:org` workspace, the implicit
+                  terminator name is `root:org:example`.
+                type: boolean
             type: object
           status:
             description: WorkspaceTypeStatus defines the observed state of WorkspaceType.

config/root-phase0/apiexport-tenancy.kcp.io.yaml

@@ -14,12 +14,12 @@ spec:
       crd: {}
   - group: tenancy.kcp.io
     name: workspaces
-    schema: v250421-25d98218b.workspaces.tenancy.kcp.io
+    schema: v251015-1d163d0e5.workspaces.tenancy.kcp.io
     storage:
       crd: {}
   - group: tenancy.kcp.io
     name: workspacetypes
-    schema: v250806-4c99c4583.workspacetypes.tenancy.kcp.io
+    schema: v251015-1d163d0e5.workspacetypes.tenancy.kcp.io
     storage:
       crd: {}
 status: {}

config/root-phase0/apiresourceschema-logicalclusters.core.kcp.io.yaml

@@ -2,7 +2,7 @@ apiVersion: apis.kcp.io/v1alpha1
 kind: APIResourceSchema
 metadata:
   creationTimestamp: null
-  name: v241020-fce06d31d.logicalclusters.core.kcp.io
+  name: v251016-6e24e0d49.logicalclusters.core.kcp.io
 spec:
   group: core.kcp.io
   names:
@@ -117,6 +117,17 @@ spec:
               - resource
               - uid
               type: object
+            terminators:
+              description: |-
+                Terminators are set on creation by the system and copied to status when
+                termination starts.
+              items:
+                description: |-
+                  LogicalClusterTerminator is a unique string corresponding to a logical cluster
+                  terminator controller.
+                pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(:[a-z0-9]([-a-z0-9]*[a-z0-9])?)*(:[a-z0-9][a-z0-9]([-a-z0-9]*[a-z0-9])?))|(system:.+)$
+                type: string
+              type: array
           type: object
         status:
           default: {}
@@ -195,6 +206,18 @@ spec:
               - Ready
               - Unavailable
               type: string
+            terminators:
+              description: |-
+                Terminators are set on creation by the system and must be cleared
+                by a controller before the logical cluster can be deleted. The LogicalCluster object
+                will stay in the phase "Deleting" until all terminator are cleared.
+              items:
+                description: |-
+                  LogicalClusterTerminator is a unique string corresponding to a logical cluster
+                  terminator controller.
+                pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(:[a-z0-9]([-a-z0-9]*[a-z0-9])?)*(:[a-z0-9][a-z0-9]([-a-z0-9]*[a-z0-9])?))|(system:.+)$
+                type: string
+              type: array
           type: object
       type: object
     served: true

config/root-phase0/apiresourceschema-workspaces.tenancy.kcp.io.yaml

@@ -2,7 +2,7 @@ apiVersion: apis.kcp.io/v1alpha1
 kind: APIResourceSchema
 metadata:
   creationTimestamp: null
-  name: v250421-25d98218b.workspaces.tenancy.kcp.io
+  name: v251015-1d163d0e5.workspaces.tenancy.kcp.io
 spec:
   group: tenancy.kcp.io
   names:
@@ -297,6 +297,17 @@ spec:
               - Ready
               - Unavailable
               type: string
+            terminators:
+              description: |-
+                terminators must be cleared by a controller before the workspace is being
+                deleted.
+              items:
+                description: |-
+                  LogicalClusterTerminator is a unique string corresponding to a logical cluster
+                  terminator controller.
+                pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(:[a-z0-9]([-a-z0-9]*[a-z0-9])?)*(:[a-z0-9][a-z0-9]([-a-z0-9]*[a-z0-9])?))|(system:.+)$
+                type: string
+              type: array
           type: object
       required:
       - spec

config/root-phase0/apiresourceschema-workspacetypes.tenancy.kcp.io.yaml

@@ -2,7 +2,7 @@ apiVersion: apis.kcp.io/v1alpha1
 kind: APIResourceSchema
 metadata:
   creationTimestamp: null
-  name: v250806-4c99c4583.workspacetypes.tenancy.kcp.io
+  name: v251015-1d163d0e5.workspacetypes.tenancy.kcp.io
 spec:
   group: tenancy.kcp.io
   names:
@@ -247,6 +247,18 @@ spec:
                   minItems: 1
                   type: array
               type: object
+            terminator:
+              description: |-
+                Terminator determines if this WorkspaceType has an associated terminating
+                controller. These controllers are used to add functionality to a Workspace;
+                all controllers must finish their work before the Workspace is being deleted.
+
+                One terminating controller is supported per WorkspaceType; the identifier
+                for this terminator will be a colon-delimited string using the workspace in which
+                the WorkspaceType is defined, and the type's name. For example, if a
+                WorkspaceType `example` is created in the `root:org` workspace, the implicit
+                terminator name is `root:org:example`.
+              type: boolean
           type: object
         status:
           description: WorkspaceTypeStatus defines the observed state of WorkspaceType.

pkg/admission/logicalcluster/admission.go

@@ -111,6 +111,8 @@ func (o *plugin) Admit(ctx context.Context, a admission.Attributes, _ admission.
 
 		logicalCluster.Status.Initializers = logicalCluster.Spec.Initializers
 
+		logicalCluster.Status.Terminators = logicalCluster.Spec.Terminators
+
 		return updateUnstructured(u, logicalCluster)
 	}
 

pkg/reconciler/core/logicalcluster/logicalcluster_reconcile.go

@@ -36,8 +36,11 @@ type reconciler interface {
 }
 
 func (c *Controller) reconcile(ctx context.Context, logicalCluster *corev1alpha1.LogicalCluster) (bool, error) {
+	// reconcilers which modify Status should be last
+	// reconcilers which modify ObjectMeta, need to return reconcileStatusStopAndRequeue on change
 	reconcilers := []reconciler{
 		&metaDataReconciler{},
+		&terminatorReconciler{},
 		&phaseReconciler{},
 		&urlReconciler{shardExternalURL: c.shardExternalURL},
 	}

pkg/reconciler/core/logicalcluster/logicalcluster_reconcile_metadata.go

@@ -27,6 +27,7 @@ import (
 
 	corev1alpha1 "github.com/kcp-dev/kcp/sdk/apis/core/v1alpha1"
 	"github.com/kcp-dev/kcp/sdk/apis/tenancy/initialization"
+	"github.com/kcp-dev/kcp/sdk/apis/tenancy/termination"
 	tenancyv1alpha1 "github.com/kcp-dev/kcp/sdk/apis/tenancy/v1alpha1"
 )
 
@@ -39,7 +40,7 @@ func (r *metaDataReconciler) reconcile(ctx context.Context, logicalCluster *core
 
 	expected := string(logicalCluster.Status.Phase)
 	if !logicalCluster.DeletionTimestamp.IsZero() {
-		expected = "Deleting"
+		expected = string(corev1alpha1.LogicalClusterPhaseDeleting)
 	}
 	if got := logicalCluster.Labels[tenancyv1alpha1.WorkspacePhaseLabel]; got != expected {
 		if logicalCluster.Labels == nil {
@@ -49,6 +50,7 @@ func (r *metaDataReconciler) reconcile(ctx context.Context, logicalCluster *core
 		changed = true
 	}
 
+	// add initializers from the status as hashed labels
 	initializerKeys := sets.New[string]()
 	for _, initializer := range logicalCluster.Status.Initializers {
 		key, value := initialization.InitializerToLabel(initializer)
@@ -62,13 +64,36 @@ func (r *metaDataReconciler) reconcile(ctx context.Context, logicalCluster *core
 		}
 	}
 
+	// add terminators from the status as hashed labels
+	terminatorKeys := sets.New[string]()
+	for _, terminator := range logicalCluster.Status.Terminators {
+		key, value := termination.TerminatorToLabel(terminator)
+		terminatorKeys.Insert(key)
+		if got, expected := logicalCluster.Labels[key], value; got != expected {
+			if logicalCluster.Labels == nil {
+				logicalCluster.Labels = map[string]string{}
+			}
+			logicalCluster.Labels[key] = value
+			changed = true
+		}
+	}
+
+	// remove any initializers/terminators from labels, which have been
+	// removed in the status
 	for key := range logicalCluster.Labels {
 		if strings.HasPrefix(key, tenancyv1alpha1.WorkspaceInitializerLabelPrefix) {
 			if !initializerKeys.Has(key) {
 				delete(logicalCluster.Labels, key)
 				changed = true
 			}
 		}
+
+		if strings.HasPrefix(key, tenancyv1alpha1.WorkspaceTerminatorLabelPrefix) {
+			if !terminatorKeys.Has(key) {
+				delete(logicalCluster.Labels, key)
+				changed = true
+			}
+		}
 	}
 
 	if logicalCluster.Status.Phase == corev1alpha1.LogicalClusterPhaseReady {