When GRC is disabled globally within ACM, all components, including the Policy Addon controller get deleted. This means that any finalizer cleanup the addon controller would normally do, doesn't have a chance to finish.

The proposal is for the Policy Addon controller to add finalizers to the ClusterManagementAddOn objects associated with the policy addons when one or more managed cluster has the addon installed. The finalizer is removed when the policy addons are successfully cleaned up on all managed clusters.

In addition, when the ACM installer (or something else) deletes the ClusterManagementAddOn, the Policy Addon controller should start uninstalling the associated addon. The finalizer removal would work as described above.

ACM-6199 will track the installer work.

Ideally, this would be added as a capability in the addon-framework library. If it's not possible, then custom logic in the Policy Addon controller will suffice.