feat: GCP-503 Implement OrphanDeleter for GCP

Removes finalizers from orphaned GCPMachines when WIF credentials become
invalid to prevent cluster teardown getting stuck.

The implementation is similar to the existing AWS implementation.

Author: thetechnick

hypershift-operator/controllers/hostedcluster/internal/platform/gcp/gcp.go

@@ -33,10 +33,12 @@ import (
 	"k8s.io/apimachinery/pkg/api/meta"
 	"k8s.io/apimachinery/pkg/api/resource"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	utilerrors "k8s.io/apimachinery/pkg/util/errors"
 	"k8s.io/utils/ptr"
 
 	capigcp "sigs.k8s.io/cluster-api-provider-gcp/api/v1beta1"
 	capiv1 "sigs.k8s.io/cluster-api/api/core/v1beta1"
+	ctrl "sigs.k8s.io/controller-runtime"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 
 	"github.com/blang/semver"
@@ -532,6 +534,34 @@ func (p GCP) validateWorkloadIdentityConfiguration(hcluster *hyperv1.HostedClust
 	return nil
 }
 
+func (GCP) DeleteOrphanedMachines(ctx context.Context, c client.Client, hc *hyperv1.HostedCluster, controlPlaneNamespace string) error {
+	if ValidCredentials(hc) {
+		return nil
+	}
+	gcpMachineList := capigcp.GCPMachineList{}
+	if err := c.List(ctx, &gcpMachineList, client.InNamespace(controlPlaneNamespace)); err != nil {
+		return fmt.Errorf("failed to list GCPMachines in %s: %w", controlPlaneNamespace, err)
+	}
+	logger := ctrl.LoggerFrom(ctx)
+	var errs []error
+	for i := range gcpMachineList.Items {
+		gcpMachine := &gcpMachineList.Items[i]
+		if gcpMachine.DeletionTimestamp.IsZero() ||
+			len(gcpMachine.Finalizers) == 0 {
+			continue
+		}
+
+		gcpMachine.Finalizers = []string{}
+		if err := c.Update(ctx, gcpMachine); err != nil {
+			errs = append(errs, fmt.Errorf("failed to delete machine %s/%s: %w", gcpMachine.Namespace, gcpMachine.Name, err))
+			continue
+		}
+		logger.Info("removed finalizers of gcpmachine because of invalid AWS identity provider", "machine", client.ObjectKeyFromObject(gcpMachine))
+
+	}
+	return utilerrors.NewAggregate(errs)
+}
+
 // setCondition updates or creates a condition on the HostedCluster.
 // This follows the standard HyperShift pattern for condition management.
 func setCondition(hcluster *hyperv1.HostedCluster, conditionType hyperv1.ConditionType, status metav1.ConditionStatus, reason, message string) {

hypershift-operator/controllers/hostedcluster/internal/platform/gcp/gcp_test.go

@@ -416,3 +416,57 @@ func TestReconcileGCPClusterPreservesServerDefaultedFields(t *testing.T) {
 	g.Expect(gcpCluster.Spec.Network.Subnets[0].Name).To(Equal("test-subnet"))
 	g.Expect(gcpCluster.Spec.Network.Subnets[0].Region).To(Equal("us-central1"))
 }
+
+func TestDeleteOrphanedMachines(t *testing.T) {
+	g := NewWithT(t)
+
+	platform := New("test-utilities-image", "test-capg-image", &semver.Version{Major: 4, Minor: 17, Patch: 0})
+	hc := validHostedCluster()
+
+	// Create a scheme with both HyperShift and CAPG types
+	scheme := runtime.NewScheme()
+	g.Expect(clientgoscheme.AddToScheme(scheme)).To(Succeed())
+	g.Expect(hyperv1.AddToScheme(scheme)).To(Succeed())
+	g.Expect(capigcp.AddToScheme(scheme)).To(Succeed())
+	fakeClient := fake.NewClientBuilder().
+		WithObjects(
+			&capigcp.GCPMachine{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:              "test-xl-1",
+					Namespace:         "test-control-plane-namespace",
+					DeletionTimestamp: ptr.To(metav1.Now()),
+					Finalizers:        []string{"test", "testz"},
+				},
+			},
+			// GCPMachines without deletionTimestamp should not get their finalizers removed.
+			&capigcp.GCPMachine{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:       "test-xl-2",
+					Namespace:  "test-control-plane-namespace",
+					Finalizers: []string{"test", "testz"},
+				},
+			},
+		).
+		WithScheme(scheme).
+		Build()
+
+	err := platform.DeleteOrphanedMachines(
+		t.Context(),
+		fakeClient,
+		hc,
+		"test-control-plane-namespace",
+	)
+	g.Expect(err).To(BeNil())
+
+	gcpMachineList := &capigcp.GCPMachineList{}
+	err = fakeClient.List(t.Context(), gcpMachineList)
+	g.Expect(err).To(BeNil())
+
+	for _, gcpMachine := range gcpMachineList.Items {
+		if !gcpMachine.DeletionTimestamp.IsZero() {
+			g.Expect(gcpMachine.Finalizers).To(BeEmpty())
+		} else {
+			g.Expect(gcpMachine.Finalizers).ToNot(BeEmpty())
+		}
+	}
+}