refactor: EnsureFinalizers

[acpana]

WIP

Do we want to have the lifecycle handler update the api server with the finalizers?

[google-oss-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please ask for approval from acpana. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[maqiuyujoyce]

Copying my thoughts over here for posterity:

I think whether we want to have the lifecycle handler update the api server with the finalizers is more of a design question: Should we add the finalizer to the resource asap during the reconciliation, or are we okay to wait?

To prevent the resource from being deleted unexpectedly, we should add the finalizer at the beginning of the reconciliation (so something similar to #1179). And for compatibility purpose, we should probably do it anyways.

We can also choose to not updating the apiserver until the reconciliation is completed if we have solid reasons why that's better - This is the current behavior in the direct controller though I'm actually a bit concerned about it.