fix(core): enforce chart uniqueness via lease claim

api/v1alpha1/conditions.go

@@ -34,6 +34,7 @@ const (
 	ReasonSuccess                 = "Success"
 	ReasonFailed                  = "Failed"
 	ReasonUninstallFailed         = "UninstallFailed"
+	ReasonChartClaimConflict      = "ChartClaimConflict"
 
 	// HelmRelease error reasons
 	ReasonReleaseFailed = "ReleaseFailed"

images/operator-helm-controller/internal/controller/helmclusteraddon/controller.go

@@ -45,6 +45,7 @@ func SetupWithManager(mgr ctrl.Manager) error {
 		services.NewOCIRepoService(client, mgr.GetScheme(), helmv1alpha1.TargetNamespace),
 		services.NewReleaseService(client, mgr.GetScheme(), helmv1alpha1.TargetNamespace),
 		services.NewMaintenanceService(client, mgr.GetScheme(), helmv1alpha1.TargetNamespace),
+		services.NewClaimService(client, mgr.GetAPIReader(), helmv1alpha1.TargetNamespace),
 		status.NewManager(client),
 	)
 

images/operator-helm-controller/internal/manager/status/deletion.go

@@ -113,6 +113,20 @@ func (s *Manager) MarkUninstallPending(ctx context.Context, obj ObjectWithCondit
 	)
 }
 
+func (s *Manager) MarkUninstallReconciling(ctx context.Context, obj ObjectWithConditions) error {
+	status := reconcilingDeletionStatus(obj, "")
+	result := uninstallFailedResult{status: status}
+
+	return s.Update(
+		ctx,
+		obj,
+		NoopStatusMutator,
+		NoopStatusMapper,
+		result,
+		AsCondition(result, helmv1alpha1.ConditionTypeReady),
+	)
+}
+
 // MarkDeletionPending records that an internal resource is still being deleted,
 // manipulating only the Ready condition — there is nothing to uninstall. A
 // failing resource (its Ready condition is False) yields Ready=False with reason

images/operator-helm-controller/internal/reconcile/helmclusteraddon/reconciler.go

@@ -26,6 +26,7 @@ import (
 	helmchartutil "helm.sh/helm/v3/pkg/chartutil"
 	corev1 "k8s.io/api/core/v1"
 	apierrors "k8s.io/apimachinery/pkg/api/errors"
+	"k8s.io/apimachinery/pkg/api/meta"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/types"
 	"k8s.io/client-go/util/retry"
@@ -46,12 +47,19 @@ import (
 // whose deletion is stuck and stops emitting events.
 const internalResourceDeletionRequeueInterval = 30 * time.Second
 
+// chartClaimConflictRequeueInterval bounds how often an addon that lost the claim
+// on its repository/chart pair re-checks whether the owner has released it. There
+// is no watch on the claim Lease, so this periodic requeue is what lets a duplicate
+// recover once the conflicting addon is deleted or repointed at another chart.
+const chartClaimConflictRequeueInterval = 30 * time.Second
+
 func New(
 	client client.Client,
 	chartService *services.ChartService,
 	ociRepositoryService *services.OCIRepoService,
 	releaseService *services.ReleaseService,
 	maintenanceService *services.MaintenanceService,
+	claimService *services.ClaimService,
 	statusManager *status.Manager,
 ) *Reconciler {
 	return &Reconciler{
@@ -60,6 +68,7 @@ func New(
 		ociRepositoryService: ociRepositoryService,
 		releaseService:       releaseService,
 		maintenanceService:   maintenanceService,
+		claimService:         claimService,
 		statusManager:        statusManager,
 	}
 }
@@ -71,6 +80,7 @@ type Reconciler struct {
 	ociRepositoryService *services.OCIRepoService
 	releaseService       *services.ReleaseService
 	maintenanceService   *services.MaintenanceService
+	claimService         *services.ClaimService
 	statusManager        *status.Manager
 }
 
@@ -90,6 +100,29 @@ func (r *Reconciler) Reconcile(ctx context.Context, req reconcile.Request) (reco
 		return r.reconcileDelete(ctx, addon)
 	}
 
+	// Claim the repository/chart pair before anything else, including adding the
+	// finalizer. The claim is the authoritative, race-free guard on uniqueness (the
+	// webhook only fast-rejects the obvious duplicate on CREATE and cannot stop
+	// concurrent creates from racing past it). It must run before the finalizer
+	// because a duplicate that loses the race must not accrue a finalizer it would
+	// otherwise have to clean up: it simply surfaces the conflict on its status and
+	// requeues, recovering on its own once the owner releases the pair.
+	acquired, holder, err := r.claimService.Acquire(ctx, addon)
+	if err != nil {
+		return reconcile.Result{}, fmt.Errorf("acquiring chart claim: %w", err)
+	}
+	if !acquired {
+		return reconcile.Result{RequeueAfter: chartClaimConflictRequeueInterval}, r.statusManager.Update(
+			ctx, addon, status.NoopStatusMutator, status.NoopStatusMapper,
+			services.ReleaseResult{Status: status.Failed(
+				addon,
+				helmv1alpha1.ReasonChartClaimConflict,
+				fmt.Sprintf("chart %q is already used by helmclusteraddon/%s", addon.Spec.Chart.HelmClusterAddonChartName, holder),
+				nil,
+			)},
+		)
+	}
+
 	if utils.IsSystemNamespace(addon.Spec.Namespace) {
 		return reconcile.Result{}, r.statusManager.Update(ctx, addon, status.NoopStatusMutator, status.NoopStatusMapper, services.ReleaseResult{Status: status.Failed(
 			addon,
@@ -110,6 +143,10 @@ func (r *Reconciler) Reconcile(ctx context.Context, req reconcile.Request) (reco
 		// would not trigger a follow-up reconcile.
 	}
 
+	if err := r.claimService.ReleaseStale(ctx, addon); err != nil {
+		return reconcile.Result{}, fmt.Errorf("releasing stale chart claims: %w", err)
+	}
+
 	if r.maintenanceService.IsMaintenanceModeChangeRequired(addon) {
 		maintenanceRes := r.maintenanceService.EnsureMaintenanceMode(ctx, addon)
 		return reconcile.Result{}, r.statusManager.Update(ctx, addon, status.NoopStatusMutator, status.NoopStatusMapper, maintenanceRes, status.AsCondition(maintenanceRes, "Ready"))
@@ -242,6 +279,15 @@ func (r *Reconciler) reconcileDelete(ctx context.Context, addon *helmv1alpha1.He
 		return reconcile.Result{}, nil
 	}
 
+	if addon.ForceReconcileRequired() || meta.FindStatusCondition(addon.Status.Conditions, helmv1alpha1.ConditionTypeUninstallFailed) == nil {
+		if err := r.statusManager.MarkUninstallReconciling(ctx, addon); err != nil {
+			if apierrors.IsNotFound(err) {
+				return reconcile.Result{}, nil
+			}
+			return reconcile.Result{}, fmt.Errorf("updating deletion status: %w", err)
+		}
+	}
+
 	// The finalizer must stay until the internal resources are actually gone.
 	// A Delete only sets a deletion timestamp; the downstream controllers keep
 	// their finalizers until they finish tearing the underlying release/source
@@ -283,6 +329,14 @@ func (r *Reconciler) reconcileDelete(ctx context.Context, addon *helmv1alpha1.He
 		return r.awaitInternalResourceDeletion(ctx, addon, "internal repository", ociRepo)
 	}
 
+	// Release the claim only once every downstream resource is gone: releasing it
+	// earlier would let another addon start reconciling the same chart while this
+	// one's release is still being uninstalled — exactly the collision the claim
+	// prevents.
+	if err := r.claimService.Release(ctx, addon); err != nil {
+		return reconcile.Result{}, fmt.Errorf("releasing chart claim: %w", err)
+	}
+
 	if err := retry.RetryOnConflict(retry.DefaultRetry, func() error {
 		latestAddon := &helmv1alpha1.HelmClusterAddon{}
 		if err := r.Get(ctx, client.ObjectKeyFromObject(addon), latestAddon); err != nil {