Deep Review: 20260324-131047-pr-236

The rd-template ConfigMap is owned by the LimaVM controller, not the App controller. The LimaVM webhook sets an owned-by-LimaVM finalizer on it (controller.go:211), and the LimaVM's own cleanup finalizer deletes it via DeleteOwnedResources (limavm_lifecycle.go:60-71). This code violates the ownership boundary documented in controllers.md:63-67 and api_lima.md:60-68.

			templateCM := &corev1.ConfigMap{}
			templateCMName := limaVMName + "-template"
			if cmErr := r.Get(ctx, client.ObjectKey{Name: templateCMName, Namespace: namespace}, templateCM); cmErr == nil {
				if cmErr := base.RemoveOwnedFinalizer(ctx, r.Client, templateCM, v1alpha1.AppKind); cmErr != nil {
					return ctrl.Result{}, fmt.Errorf("failed to remove finalizer from template ConfigMap: %w", cmErr)
				}
				if cmErr := r.Delete(ctx, templateCM); cmErr != nil && !apierrors.IsNotFound(cmErr) {
					return ctrl.Result{}, fmt.Errorf("failed to delete template ConfigMap during cleanup: %w", cmErr)
				}
			} else if !apierrors.IsNotFound(cmErr) {
				log.Error(cmErr, "Failed to fetch template ConfigMap during cleanup")
			}

			return ctrl.Result{}, base.RemoveCleanupFinalizer(ctx, r.Client, &app)

Beyond the design violation, the code at line 76 passes v1alpha1.AppKind to RemoveOwnedFinalizer, which looks for owned-by-App — a finalizer that was never set. The removal is a no-op. The Delete at line 79 then hits the OwnedDeletionGuard webhook because owned-by-LimaVM still blocks deletion.

Fix: Remove this block entirely (lines 73–84). The LimaVM controller handles its own template ConfigMap cleanup.

-			templateCM := &corev1.ConfigMap{}
-			templateCMName := limaVMName + "-template"
-			if cmErr := r.Get(ctx, client.ObjectKey{Name: templateCMName, Namespace: namespace}, templateCM); cmErr == nil {
-				if cmErr := base.RemoveOwnedFinalizer(ctx, r.Client, templateCM, v1alpha1.AppKind); cmErr != nil {
-					return ctrl.Result{}, fmt.Errorf("failed to remove finalizer from template ConfigMap: %w", cmErr)
-				}
-				if cmErr := r.Delete(ctx, templateCM); cmErr != nil && !apierrors.IsNotFound(cmErr) {
-					return ctrl.Result{}, fmt.Errorf("failed to delete template ConfigMap during cleanup: %w", cmErr)
-				}
-			} else if !apierrors.IsNotFound(cmErr) {
-				log.Error(cmErr, "Failed to fetch template ConfigMap during cleanup")
-			}
-
 			return ctrl.Result{}, base.RemoveCleanupFinalizer(ctx, r.Client, &app)

cond.ObservedGeneration at line 207 carries the LimaVM's .metadata.generation. On the App resource, a condition's ObservedGeneration should reflect the App's own generation — it tells observers whether the controller has seen the latest App spec. An App at generation 5 could show observedGeneration: 2 from the LimaVM, which misleads watchers into thinking the controller is lagging.

	statusChanged := false
	for _, cond := range limaVM.Status.Conditions {
		statusChanged = apimeta.SetStatusCondition(&app.Status.Conditions, metav1.Condition{
			Type:               cond.Type,
			Status:             cond.Status,
			Reason:             cond.Reason,
			Message:            base.TruncateConditionMessage(cond.Message),
			ObservedGeneration: cond.ObservedGeneration,
			LastTransitionTime: cond.LastTransitionTime,
		}) || statusChanged
	}

Fix: Use the App's generation.

-			ObservedGeneration: cond.ObservedGeneration,
+			ObservedGeneration: app.Generation,

If r.Get for the input ConfigMap fails with a transient API error (e.g., network timeout) at line 65, the else branch at line 69 logs the error and falls through to RemoveCleanupFinalizer at line 86. The finalizer is stripped, the App is deleted, and the input ConfigMap is permanently orphaned. The embedded control plane has no garbage collector, so the ConfigMap persists indefinitely in kine.

			// LimaVM is gone. Clean up any ConfigMaps that may have been left behind.
			inputCM := &corev1.ConfigMap{}
			if cmErr := r.Get(ctx, client.ObjectKey{Name: inputConfigMapName, Namespace: namespace}, inputCM); cmErr == nil {
				if cmErr := r.Delete(ctx, inputCM); cmErr != nil && !apierrors.IsNotFound(cmErr) {
					return ctrl.Result{}, fmt.Errorf("failed to delete input ConfigMap during cleanup: %w", cmErr)
				}
			} else if !apierrors.IsNotFound(cmErr) {
				log.Error(cmErr, "Failed to fetch input ConfigMap during cleanup")
			}

Fix: Return the error so controller-runtime retries.

 } else if !apierrors.IsNotFound(cmErr) {
-    log.Error(cmErr, "Failed to fetch input ConfigMap during cleanup")
+    return ctrl.Result{}, fmt.Errorf("failed to fetch input ConfigMap during cleanup: %w", cmErr)
 }