fix(openshift): delete operator webhooks before namespace cleanup on uninstall

[jkhelil]

Problem

When uninstalling via the Console UI, `TektonConfig` finalization calls
`rbac.cleanUp()` which updates user namespaces to strip the
`openshift-pipelines.tekton.dev/namespace-reconcile-version` label.
The `namespace.operator.tekton.dev` ValidatingWebhookConfiguration
intercepts every namespace update and calls the
`tekton-operator-proxy-webhook` service in `openshift-pipelines`.

When the UI removes `openshift-pipelines` before finalization completes,
the VWH still exists (GC lag) but the backend service is already gone:

```
Failed to finalize platform resources failed to update namespace default:
failed calling webhook "namespace.operator.tekton.dev":
service "tekton-operator-proxy-webhook" not found
```

Result: finalization stuck → Subscription/CSV never deleted → operator pod,
deployments, CRDs and ClusterRoles remain in `openshift-operators`.

Root cause

The VWH/MWH are owned by the `openshift-pipelines` Namespace (SRVKP-8901)
and are GC'd when it is deleted — but there is a window where the namespace
is Terminating (services gone) while the webhook configs still exist.
`cleanUp()` namespace updates fail during that window.

Fix

Delete `namespace.operator.tekton.dev` (VWH) and `proxy.operator.tekton.dev`
(MWH) at the start of `openshiftExtension.Finalize`, before
`rbac.cleanUp()` runs. `NotFound` is ignored (already GC'd). The
ownerRef-based GC from SRVKP-8901 is kept as the normal cleanup path.

Also propagate errors from `extension.Finalize` in `FinalizeKind` so the
finalizer retries on failure instead of silently continuing.

Testing

Verified on OpenShift 4.20 (AWS) — installed OSP 1.22.2 via OperatorHub,
patched operator image with this fix, triggered UI uninstall. Confirmed:

• No `service "tekton-operator-proxy-webhook" not found` errors in logs ✅
• VWH `namespace.operator.tekton.dev` removed ✅
• MWH `proxy.operator.tekton.dev` removed ✅
• Subscription, CSV, operator deployments all removed ✅
• `openshift-pipelines` namespace removed ✅
• CRDs remain (expected — OLM does not delete CRDs on uninstall)

Unit tests: `TestRemoveOperatorAdmissionWebhooks` (delete both, already-absent, delete-failure).

Fixes: SRVKP-12010

Made with Cursor

Bug fix: OpenShift Pipelines operator now uninstalls cleanly via the Console UI.
Previously, operator admission webhooks (namespace.operator.tekton.dev,
proxy.operator.tekton.dev) could still be registered while their backend service
was already removed during uninstall, causing TektonConfig finalization to fail
and leaving the Subscription, CSV, and operator deployment behind in
openshift-operators. The webhooks are now explicitly removed at the start of
finalization before namespace label cleanup runs.

[jkhelil]

/kind bug

[jkhelil]

/retest

[pratap0007]

/lgtm

[tekton-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: vdemeester

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [vdemeester]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment