Task finalizer1 = task("finalizer1", dependsOn: [finalizerDependency])
        Task finalized1 = task("finalized1", finalizedBy: [finalizer1])
        Task finalizer2 = task("finalizer2")
        Task finalized2 = task("finalized2", finalizedBy: [finalizer2], failure: new RuntimeException("failure"))

        when:
        addToGraphAndPopulate([finalized1, finalized2])

        then:

    def "finalizer task can depend on multiple finalized tasks"() {
        given:
        buildFile '''
            task finalizer(type: BreakingTask) {
                dependsOn 'finalized1', 'finalized2'
            }
            task finalized1(type: BreakingTask) {
                finalizedBy 'finalizer'
            }
            task finalized2(type: BreakingTask) {

			if finptrmask[0] == 0 {
				// Build pointer mask for Finalizer array in block.
				// Check assumptions made in finalizer1 array above.
				if (unsafe.Sizeof(finalizer{}) != 5*goarch.PtrSize ||
					unsafe.Offsetof(finalizer{}.fn) != 0 ||
					unsafe.Offsetof(finalizer{}.arg) != goarch.PtrSize ||
					unsafe.Offsetof(finalizer{}.nret) != 2*goarch.PtrSize ||
					unsafe.Offsetof(finalizer{}.fint) != 3*goarch.PtrSize ||

			// yet to sync the volume and add the pv deletion protection finalizer. The custom finalizer is some
			// pre-existing finalizer, for example the pv-protection finalizer. When csi-migration is disabled,
			// the migrated-to annotation will be removed shortly when updateVolumeMigrationAnnotationsAndFinalizers
			// is called followed by adding back the in-tree pv protection finalizer.

		finalizers.Insert(finalizer)
		iop.SetFinalizers(sets.SortedList(finalizers))
		err := r.client.Update(context.TODO(), iop)
		if err != nil {
			if errors.IsNotFound(err) {
				scope.Infof("Could not add finalizer to %s: the object was deleted.", iopName)
				metrics.CRDeletionTotal.Increment()
				return reconcile.Result{}, nil
			} else if errors.IsConflict(err) {

    def "detects a cycle with a task that mustRunAfter itself as finalizer of another task"() {
        buildFile << """
            def finalizer = tasks.register("finalizer")
            tasks.named("finalizer").configure {
                mustRunAfter(finalizer)
            }
            task myTask {
                finalizedBy finalizer
            }
        """
        expect:
        2.times {

		},
		{
			name: "service CIDR must have finalizer",
			cidrs: []*networkingapiv1alpha1.ServiceCIDR{
				makeServiceCIDR("no-finalizer", "192.168.0.0/24", "2001:db2::/64"),
			},
			cidrSynced: "no-finalizer",
			actions:    [][]string{{"patch", "servicecidrs", ""}, {"patch", "servicecidrs", "status"}},
		},
		{
			name: "service CIDR being deleted must remove the finalizer",
			cidrs: []*networkingapiv1alpha1.ServiceCIDR{

	}

	if protectionutil.NeedToAddFinalizer(pvc, volumeutil.PVCProtectionFinalizer) {
		// PVC is not being deleted -> it should have the finalizer. The
		// finalizer should be added by admission plugin, this is just to add
		// the finalizer to old PVCs that were created before the admission
		// plugin was enabled.
		return c.addFinalizer(ctx, pvc)
	}
	return nil
}

		return volume.Finalizers, false
	}
	if !metav1.HasAnnotation(volume.ObjectMeta, storagehelpers.AnnDynamicallyProvisioned) {
		// PV deletion protection finalizer is currently supported only for dynamically
		// provisioned volumes.
		return volume.Finalizers, false
	}
	if volume.Finalizers != nil {
		outFinalizers = append(outFinalizers, volume.Finalizers...)
	}

	maxRetries     = 15
	controllerName = "service-cidr-controller"

	ServiceCIDRProtectionFinalizer = "networking.k8s.io/service-cidr-finalizer"

	// deletionGracePeriod is the time in seconds to wait to remove the finalizer from a ServiceCIDR to ensure the
	// deletion informations has been propagated to the apiserver allocators to avoid allocating any IP address
	// before we complete delete the ServiceCIDR