},
		{
			name: "service CIDR must have finalizer",
			cidrs: []*networkingapiv1alpha1.ServiceCIDR{
				makeServiceCIDR("no-finalizer", "192.168.0.0/24", "2001:db2::/64"),
			},
			cidrSynced: "no-finalizer",
			actions:    [][]string{{"patch", "servicecidrs", ""}, {"patch", "servicecidrs", "status"}},
		},
		{
			name: "service CIDR being deleted must remove the finalizer",
			cidrs: []*networkingapiv1alpha1.ServiceCIDR{

====
include::sample[dir="snippets/tasks/finalizers/kotlin",files="build.gradle.kts[]"]
include::sample[dir="snippets/tasks/finalizers/groovy",files="build.gradle[]"]

----
$ gradle -q taskX
include::{snippetsPath}/tasks/finalizers/tests/taskFinalizers.out[]
----
====

Finalizer tasks are executed even if the finalized task fails or if the finalized task is considered `UP-TO-DATE`:

====

	maxRetries     = 15
	controllerName = "service-cidr-controller"

	ServiceCIDRProtectionFinalizer = "networking.k8s.io/service-cidr-finalizer"

	// deletionGracePeriod is the time in seconds to wait to remove the finalizer from a ServiceCIDR to ensure the
	// deletion informations has been propagated to the apiserver allocators to avoid allocating any IP address
	// before we complete delete the ServiceCIDR

        }

        @Override
        public void disallowChanges() {
            // Finalized, so already cannot change
        }

        @Override
        public void finalizeOnNextGet() {
            // Finalized already
        }

        @Override
        public void disallowUnsafeRead() {
            // Finalized already so read is safe
        }

        @Override

WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package finalizer

import (
	"context"
	"fmt"
	"reflect"
	"time"

	"k8s.io/klog/v2"

	apierrors "k8s.io/apimachinery/pkg/api/errors"
	"k8s.io/apimachinery/pkg/api/meta"

	claim = claim.DeepCopy()
	// As far the controller is concerned, a claim was allocated by us if it has
	// this finalizer. For testing we don't need to update the allocation result.
	claim.Finalizers = append(claim.Finalizers, resourcev1alpha2.Finalizer)
	return claim
}

func reserveClaim(claim *resourcev1alpha2.ResourceClaim, pod *v1.Pod) *resourcev1alpha2.ResourceClaim {
	claim = claim.DeepCopy()

		ret.RangeTime[name] += lastTs.Sub(ts)
	}
	return ret
}

// finalize is called when processing a goroutine end event or at
// the end of trace processing. This finalizes the execution stat
// and any active regions in the goroutine, in which case trigger is nil.
func (g *GoroutineSummary) finalize(lastTs Time, trigger *Event) {
	if trigger != nil {
		g.EndTime = trigger.Time()
	}

			return err
		}

		// Now also remove the finalizer if it is not needed anymore.
		// Note that the index may have changed as a result of the UpdateStatus call.
		builtinControllerFinalizer := slices.Index(claim.Finalizers, resourcev1alpha2.Finalizer)
		if builtinControllerFinalizer >= 0 && claim.Status.Allocation == nil {
			claim.Finalizers = slices.Delete(claim.Finalizers, builtinControllerFinalizer, builtinControllerFinalizer+1)

    @Requires(IntegTestPreconditions.NotParallelExecutor)
    def "finalizer task dependencies from sibling project must run after finalized task dependencies"() {
        server.start()

        given:
        def configurationCache = newConfigurationCacheFixture()
        createDirs("finalized", "finalizer")
        settingsFile << """
            include 'finalized', 'finalizer'
        """
        buildFile << """

            strings << 3
        }

        @Finalize
        static void finalize1(List<String> strings) {
            strings << "2"
        }

        @Mutate
        static void mutate1(List<String> strings) {
            strings << "1"
        }
    }

    def "finalize rules are registered"() {
        given:
        def registry = Mock(ModelRegistry)