When I upgrade capa rosa hcp by capi, it failed with error :

E0226 12:24:53.141811       1 controller.go:329] "Reconciler error" err="failed to reconcile kubeconfig: failed to reconcile cluster admin password secret: secrets \"heli-admin-password\" is forbidden: cannot set blockOwnerDeletion if an ownerReference refers to a resource you can't set finalizers on: , <nil>" controller="rosacontrolplane" controllerGroup="controlplane.cluster.x-k8s.io" controllerKind="ROSAControlPlane" ROSAControlPlane="default/heli-control-plane" namespace="default" name="heli-control-plane" reconcileID="ba8255c0-6802-4164-8146-39e4f678c57c"

    100%

0. create an OCP as the management cluster to install capi
1. create capi rosa hcp by https://docs.google.com/document/d/18jtqQy2CEYzmxJoBr2dcnZBtHY62hL8juhO_XIUsA64/edit
2. change rosacontrolplane `ROSAControlPlane.spec.version` to trigger hcp upgrade

  upgrade fail

    upgrade to the new version

    hwo to fix:

by updating the clusterrole capa-manager-role, the upgrade successed finally. 

- controlplane.cluster.x-k8s.io
  resources:
  - awsmanagedcontrolplanes
  - rosacontrolplanes/finalizers
  verbs:
  - delete
  - get
  - list
  - patch
  - update