created a new goroutine that will remove shadow secrets by going from…

… the secret to the hvsapp instead of the other way around in the original

controllers/hcpvaultsecretsapp_controller.go

@@ -126,6 +126,42 @@ func (r *HCPVaultSecretsAppReconciler) Reconcile(ctx context.Context, req ctrl.R
 		return ctrl.Result{}, r.handleDeletion(ctx, o)
 	}
 
+	go func() {
+		// this goroutine clean ups orphaned shadow secrets once per hour
+		ticker := time.NewTicker(1 * time.Hour)
+		defer ticker.Stop()
+
+		for {
+			select {
+			case <-ticker.C:
+				// retrieve all shadow secrets in the vso namespace
+				secrets := &corev1.SecretList{}
+				if err := r.Client.List(ctx, secrets, client.InNamespace(common.OperatorNamespace)); err != nil {
+					logger.Error(err, "Failed to list secrets")
+					continue
+				}
+
+				for _, secret := range secrets.Items {
+					appName := secret.Labels[hvsaLabelPrefix+"/hvs-app-name"]
+					app := &secretsv1beta1.HCPVaultSecretsApp{}
+
+					// get the HCPVaultSecretsApp associated with the shadow secret
+					if err := r.Client.Get(ctx, client.ObjectKey{Namespace: secret.Namespace, Name: appName}, app); err != nil {
+						logger.Error(err, "Failed to get HCPVaultSecretsApp")
+						continue
+					}
+
+					// check if it was deleted and remove the shadow secret if it was
+					if app.GetDeletionTimestamp() != nil {
+						if err := r.Client.Delete(ctx, &secret); err != nil {
+							logger.Error(err, "Failed to delete orphaned shadow secret")
+						}
+					}
+				}
+			}
+		}
+	}()
+
 	var requeueAfter time.Duration
 	if o.Spec.RefreshAfter != "" {
 		d, err := parseDurationString(o.Spec.RefreshAfter, ".spec.refreshAfter", r.MinRefreshAfter)