Add finalizer to backup secrets

[evilhamsterman]

Report

Deleting a namespace that has ps-backups using S3 storage gets stuck and backups don't get cleaned up because as soon as you mark the namespace for deletion the secret containing the access key for S3 gets deleted, so the operator is unable to cleanup the backups and delete the ps-backups.

More about the problem

I'd expect that the operator adds a finalizer to the required secret as long as there is a backup that uses it, to ensure it isn't deleted while there are backups that depend on it. Once there are no more backups that depend on the secret the finalizer can be removed allowing deletion of the secret.

Steps to reproduce

1. Create a namespace with a MySQL instance
2. Create a ps-backup using S3 or other destination requiring access to a secret for authentication
3. Attempt to delete the namespace
4. The namespace will get stuck in terminating and cannot be cleaned up without manually removing finalizers from the ps-backup which leaves the backup on the destination.

Versions

1. Kubernetes: 1.32
2. Operator: 1.0.0
3. Database: Any

Anything else?

No response

[egegunes]

It makes sense to me. Although since secrets are not controlled by the operator, we need to be careful but it's doable.

I created K8SPS-654 to track this.

[evilhamsterman]

They aren't, but it's not uncommon for systems to add their own finalizers for reasons exactly like this. That's what their for, to indicate that they should not be removed because there's a dependency on the resource.

…

On Thu, Feb 19, 2026, 9:57 PM Ege Güneş ***@***.***> wrote: *egegunes* left a comment (percona/percona-server-mysql-operator#1211) <#1211 (comment)> It makes sense to me. Although since secrets are not controlled by the operator, we need to be careful but it's doable. I created K8SPS-654 <https://perconadev.atlassian.net/browse/K8SPS-654> to track this. — Reply to this email directly, view it on GitHub <#1211 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAAORKCSQLBGZFGVPDTSGC34M2O5HAVCNFSM6AAAAACVXGECOOVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZTSMZRHAZTGOJVGA> . You are receiving this because you authored the thread.Message ID: ***@***.***>