significant risk of stuck finalizers. finalizers is a shared field, any actor with permission can reorder it. If the finalizer list is processed in order, then this can lead to a situation in which the component responsible for the first finalizer in the list is waiting for a signal (field value, external system, or other) produced by a component responsible for a finalizer later in the list, resulting in a deadlock. Without enforced ordering finalizers are free to order amongst themselves and are not...

			claim.Finalizers = append(claim.Finalizers, resourcev1alpha2.Finalizer)
			if _, err := pl.clientset.ResourceV1alpha2().ResourceClaims(claim.Namespace).Update(ctx, claim, metav1.UpdateOptions{}); err != nil {
				return nil, fmt.Errorf("add finalizer: %v", err)
			}
		}
	}

	// The claim might be stale, for example because the claim can get shared and some
	// other goroutine has updated it in the meantime. We therefore cannot use

			expectedErr: true,
		},
		"skip-adding-finalizer": {
			pod:    podWithClaimName,
			claims: []*resourcev1alpha2.ResourceClaim{pendingImmediateClaim},
			oldObj: pendingImmediateClaim,
			newObj: func() *resourcev1alpha2.ResourceClaim {
				claim := pendingImmediateClaim.DeepCopy()
				claim.Finalizers = append(claim.Finalizers, "foo")
				return claim
			}(),

func TestValidateCertificateSigningRequestUpdate(t *testing.T) {
	validUpdateMeta := validObjectMeta
	validUpdateMeta.ResourceVersion = "1"

	validUpdateMetaWithFinalizers := validUpdateMeta
	validUpdateMetaWithFinalizers.Finalizers = []string{"foo"}

	validSpec := capi.CertificateSigningRequestSpec{
		Usages:     validUsages,
		Request:    newCSRPEM(t),
		SignerName: "example.com/something",
	}

	tests := []struct {

        ModelNode.State.Initialized     | ModelActionRole.Initialize.name()
        ModelNode.State.Mutated         | ModelActionRole.Mutate.name()
        ModelNode.State.Finalized       | ModelActionRole.Finalize.name()
        ModelNode.State.SelfClosed      | ModelActionRole.Validate.name()
        ModelNode.State.GraphClosed     | ModelActionRole.Validate.name()
    }

        "apiVersion": "apiVersionValue",
        "kind": "kindValue",
        "name": "nameValue",
        "uid": "uidValue",
        "controller": true,
        "blockOwnerDeletion": true
      }
    ],
    "finalizers": [
      "finalizersValue"
    ],
    "managedFields": [
      {
        "manager": "managerValue",
        "operation": "operationValue",
        "apiVersion": "apiVersionValue",

        "apiVersion": "apiVersionValue",
        "kind": "kindValue",
        "name": "nameValue",
        "uid": "uidValue",
        "controller": true,
        "blockOwnerDeletion": true
      }
    ],
    "finalizers": [
      "finalizersValue"
    ],
    "managedFields": [
      {
        "manager": "managerValue",
        "operation": "operationValue",
        "apiVersion": "apiVersionValue",

        "apiVersion": "apiVersionValue",
        "kind": "kindValue",
        "name": "nameValue",
        "uid": "uidValue",
        "controller": true,
        "blockOwnerDeletion": true
      }
    ],
    "finalizers": [
      "finalizersValue"
    ],
    "managedFields": [
      {
        "manager": "managerValue",
        "operation": "operationValue",
        "apiVersion": "apiVersionValue",

        "apiVersion": "apiVersionValue",
        "kind": "kindValue",
        "name": "nameValue",
        "uid": "uidValue",
        "controller": true,
        "blockOwnerDeletion": true
      }
    ],
    "finalizers": [
      "finalizersValue"
    ],
    "managedFields": [
      {
        "manager": "managerValue",
        "operation": "operationValue",
        "apiVersion": "apiVersionValue",

        "apiVersion": "apiVersionValue",
        "kind": "kindValue",
        "name": "nameValue",
        "uid": "uidValue",
        "controller": true,
        "blockOwnerDeletion": true
      }
    ],
    "finalizers": [
      "finalizersValue"
    ],
    "managedFields": [
      {
        "manager": "managerValue",
        "operation": "operationValue",
        "apiVersion": "apiVersionValue",