deletion of role fails if secretRef is not found

[jasonwbarnett]

What happened?

When I deleted a Role (postgresql.sql.crossplane.io/v1alpha1) that has a passwordSecretRef and the referenced secret is missing, it fails to delete the role.

  - lastTransitionTime: "2024-07-02T22:28:00Z"
    message: 'observe failed: cannot get password secret: Secret "database" not found'
    reason: ReconcileError
    status: "False"
    type: Synced

What is the use case?

I am using Argo CD to deploy applications onto K8s and there is race condition where the namespace and it's secret may be deleted before the Role. This creates a funky situation where the Role is left dangling forever.

How can we reproduce it?

Create a role using an existing passwordSecretRef. Then delete the secret. Finally, delete the Role.

What environment did it happen in?

Provider version: 0.9.0 Crossplane version: 1.16.0 K8s: EKS

[mleahu]

We solved this kind of problems with Usages, but we control the secret as well.

[chlunde]

This is as designed as we don't know the state of the role if the secret has been deleted, and as @mleahu says this can be fixed with Usage.