tested working

Author: cyclingwithelephants

internal/clients/k8s/object.go

@@ -43,13 +43,14 @@ func (s *ObjectClient) EnsureFinalizer(ctx context.Context, key client.ObjectKey
 		return nil
 	}
 
-	controllerutil.AddFinalizer(obj, finalizer)
 	//nolint:revive // we know this will serialise, even if the compiler doesn't
 	base := obj.DeepCopyObject().(client.Object)
+	controllerutil.AddFinalizer(obj, finalizer)
 
 	s.log.
 		WithValues("finalizer", finalizer).
 		WithValues("object", fmt.Sprintf("%s/%s", obj.GetNamespace(), obj.GetName())).
+		WithValues("kind", obj.GetObjectKind().GroupVersionKind().Kind).
 		Info("creating finalizer")
 	if err := s.k8sClient.Patch(ctx, obj, client.MergeFrom(base)); err != nil {
 		return fmt.Errorf("could not add finalizer %q: %w", finalizer, err)
@@ -71,9 +72,9 @@ func (s *ObjectClient) RemoveFinalizer(ctx context.Context, key client.ObjectKey
 		return nil
 	}
 
-	controllerutil.RemoveFinalizer(obj, finalizer)
 	//nolint:revive // we know this will serialise, even if the compiler doesn't
 	base := obj.DeepCopyObject().(client.Object)
+	controllerutil.RemoveFinalizer(obj, finalizer)
 
 	s.log.
 		WithValues("finalizer", finalizer).

internal/controller/clustertunnel_controller.go

@@ -153,7 +153,7 @@ func (r *ClusterTunnelReconciler) Reconcile(ctx context.Context, req ctrl.Reques
 				return ctrl.Result{}, err
 			}
 			// ensure the secret associated with the tunnel has the finalizer removed
-			var secret *corev1.Secret
+			secret := &corev1.Secret{}
 			err = objectClient.RemoveFinalizer(
 				ctx,
 				client.ObjectKey{
@@ -181,7 +181,7 @@ func (r *ClusterTunnelReconciler) Reconcile(ctx context.Context, req ctrl.Reques
 		return ctrl.Result{}, err
 	}
 	// ensure the secret associated with the tunnel has a finalizer
-	var secret *corev1.Secret
+	secret := &corev1.Secret{}
 	err = objectClient.EnsureFinalizer(
 		ctx,
 		client.ObjectKey{

internal/controller/tunnel_controller.go

@@ -147,7 +147,7 @@ func (r *TunnelReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctr
 			if err != nil {
 				return ctrl.Result{}, err
 			}
-			var secret *corev1.Secret
+			secret := &corev1.Secret{}
 			err = objectClient.RemoveFinalizer(
 				ctx,
 				client.ObjectKey{
@@ -175,7 +175,7 @@ func (r *TunnelReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctr
 		return ctrl.Result{}, err
 	}
 	// ensure the secret associated with the tunnel has a finalizer
-	var secret *corev1.Secret
+	secret := &corev1.Secret{}
 	err = objectClient.EnsureFinalizer(
 		ctx,
 		client.ObjectKey{