CNTRLPLANE-3857: Replace per-controller HCP finalizers with status conditions for deletion cleanup

api/hypershift/v1beta1/endpointservice_types.go

@@ -119,6 +119,26 @@ type AWSEndpointServiceStatus struct {
 	// SecurityGroupID is the ID of the security group.
 	// +optional
 	SecurityGroupID string `json:"securityGroupID,omitempty"`
+
+	// sharedVPCEndpointRoleARN is the persisted ARN of the SharedVPC role used
+	// for EC2 endpoint and security group operations during deletion.
+	//
+	// The role ARN is copied from the HostedControlPlane so cleanup can continue
+	// after the HCP is gone, for example after a controller restart.
+	// +optional
+	// +kubebuilder:validation:MinLength=1
+	// +kubebuilder:validation:MaxLength=2048
+	SharedVPCEndpointRoleARN string `json:"sharedVPCEndpointRoleARN,omitempty"`
+
+	// sharedVPCRoute53RoleARN is the persisted ARN of the SharedVPC role used
+	// for Route53 operations during deletion.
+	//
+	// The role ARN is copied from the HostedControlPlane so cleanup can continue
+	// after the HCP is gone, for example after a controller restart.
+	// +optional
+	// +kubebuilder:validation:MinLength=1
+	// +kubebuilder:validation:MaxLength=2048
+	SharedVPCRoute53RoleARN string `json:"sharedVPCRoute53RoleARN,omitempty"`
 }
 
 // +kubebuilder:object:root=true

api/hypershift/v1beta1/hosted_controlplane.go

@@ -309,6 +309,26 @@ const (
 	HostedControlPlaneDegraded  ConditionType = "Degraded"
 	EtcdSnapshotRestored        ConditionType = "EtcdSnapshotRestored"
 	CVOScaledDown               ConditionType = "CVOScaledDown"
+
+	// PrivateConnectivityCleanedUp signals whether platform private connectivity
+	// resources (AWS PrivateLink endpoints, Azure Private Endpoints) have been
+	// cleaned up during HostedControlPlane deletion. Set by platform controllers,
+	// or by CPO when no matching private connectivity resources exist, and gated
+	// with a 10-minute timeout in CPO's deletion path. The timeout allows
+	// HCP deletion to proceed even when cleanup is stuck (trading orphaned cloud
+	// resources for avoiding indefinite deletion blocking), while the condition
+	// provides visibility into whether cleanup completed successfully or timed out.
+	PrivateConnectivityCleanedUp ConditionType = "PrivateConnectivityCleanedUp"
+
+	// PrivateConnectivityCleanupCompleteReason is set when platform controllers
+	// have finished cleaning up all private connectivity resources.
+	PrivateConnectivityCleanupCompleteReason = "CleanupComplete"
+
+	// PrivateConnectivityCleanupTimedOutReason is set when the cleanup timeout
+	// elapsed before the platform controller signaled completion. When this occurs,
+	// cloud resources (endpoints, DNS zones, security groups) may be orphaned and
+	// require manual cleanup.
+	PrivateConnectivityCleanupTimedOutReason = "CleanupTimedOut"
 )
 
 // HostedControlPlaneStatus defines the observed state of HostedControlPlane

api/hypershift/v1beta1/hostedcluster_conditions.go

@@ -70,6 +70,8 @@ const (
 	// ClusterVersionRetrievedUpdates bubbles up RetrievedUpdates from the CVO.
 	ClusterVersionRetrievedUpdates ConditionType = "ClusterVersionRetrievedUpdates"
 
+	// HCP-only conditions (not propagated to HostedCluster).
+
 	// UnmanagedEtcdAvailable indicates whether a user-managed etcd cluster is
 	// healthy.
 	UnmanagedEtcdAvailable ConditionType = "UnmanagedEtcdAvailable"

api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/awsendpointservices.hypershift.openshift.io/AAA_ungated.yaml

@@ -196,6 +196,26 @@ spec:
                   SecurityGroupID is the ID of the security group.
                 maxLength: 255
                 type: string
+              sharedVPCEndpointRoleARN:
+                description: |-
+                  sharedVPCEndpointRoleARN is the persisted ARN of the SharedVPC role used
+                  for EC2 endpoint and security group operations during deletion.
+
+                  The role ARN is copied from the HostedControlPlane so cleanup can continue
+                  after the HCP is gone, for example after a controller restart.
+                maxLength: 2048
+                minLength: 1
+                type: string
+              sharedVPCRoute53RoleARN:
+                description: |-
+                  sharedVPCRoute53RoleARN is the persisted ARN of the SharedVPC role used
+                  for Route53 operations during deletion.
+
+                  The role ARN is copied from the HostedControlPlane so cleanup can continue
+                  after the HCP is gone, for example after a controller restart.
+                maxLength: 2048
+                minLength: 1
+                type: string
             type: object
         type: object
     served: true