Release the lock after each full reconcile run instead of releasing it only after full reconciliation

Dockerfile

@@ -4,7 +4,7 @@ ARG FDB_VERSION=7.1.67
 ARG FDB_WEBSITE=https://github.com/apple/foundationdb/releases/download
 
 # Build the manager binary
-FROM golang:1.26.4-bookworm AS builder
+FROM golang:1.26.5-bookworm AS builder
 
 ARG FDB_VERSION
 ARG FDB_WEBSITE

controllers/cluster_controller.go

@@ -344,6 +344,21 @@ func (r *FoundationDBClusterReconciler) Reconcile(
 	var delayedRequeueDuration time.Duration
 	var delayedRequeue bool
 
+	defer func() {
+		// After each full run of all sub-reconcilers release the lock if this operator instance was holding a lock.
+		// This gives other operator instances the chance to perform operations without stalling them.
+		if cluster.ShouldUseLocks() {
+			lockErr := r.releaseLock(clusterLog, cluster)
+			if lockErr != nil {
+				clusterLog.Info(
+					"could not release lock after sub-reconcilers have run",
+					"err",
+					lockErr,
+				)
+			}
+		}
+	}()
+
 	for _, subReconciler := range subReconcilers {
 		// We have to set the normalized spec here again otherwise any call to Update() for the status of the cluster
 		// will reset all normalized fields...

controllers/update_lock_configuration.go

@@ -40,8 +40,12 @@ func (updateLockConfiguration) reconcile(
 	_ *fdbv1beta2.FoundationDBStatus,
 	logger logr.Logger,
 ) *requeue {
-	if len(cluster.Spec.LockOptions.DenyList) == 0 || !cluster.ShouldUseLocks() ||
-		!cluster.Status.Configured {
+	if !cluster.ShouldUseLocks() || !cluster.Status.Configured {
+		return nil
+	}
+
+	// If no lock entries must be set or removed we can skip all the work.
+	if len(cluster.Spec.LockOptions.DenyList) == 0 {
 		return nil
 	}
 

controllers/update_status.go

@@ -285,20 +285,24 @@ func (c updateStatus) reconcile(
 		clusterStatus.NeedsNewCoordinators = !coordinatorsValid
 	}
 
-	if len(cluster.Spec.LockOptions.DenyList) > 0 && cluster.ShouldUseLocks() &&
-		clusterStatus.Configured {
-		lockClient, err := r.getLockClient(logger, cluster)
-		if err != nil {
-			return &requeue{curError: err}
-		}
-		denyList, err := lockClient.GetDenyList()
-		if err != nil {
-			return &requeue{curError: err}
-		}
-		if len(denyList) == 0 {
-			denyList = nil
+	if cluster.ShouldUseLocks() && clusterStatus.Configured {
+		// If the original status had an entry for the deny list we have to query the FDB cluster until that entry was
+		// removed. Same for the case a user added at least one entry to the deny list.
+		if len(cluster.Spec.LockOptions.DenyList) > 0 || len(originalStatus.Locks.DenyList) > 0 {
+			lockClient, err := r.getLockClient(logger, cluster)
+			if err != nil {
+				return &requeue{curError: err}
+			}
+			denyList, err := lockClient.GetDenyList()
+			if err != nil {
+				return &requeue{curError: err}
+			}
+			if len(denyList) == 0 {
+				denyList = nil
+			}
+
+			clusterStatus.Locks.DenyList = denyList
 		}
-		clusterStatus.Locks.DenyList = denyList
 	}
 
 	// Sort slices that are assembled based on pods to prevent a reordering from
@@ -334,14 +338,6 @@ func (c updateStatus) reconcile(
 		}
 	}
 
-	if reconciled && cluster.ShouldUseLocks() {
-		// Once the cluster is reconciled the operator will release any pending locks for this cluster.
-		lockErr := r.releaseLock(logger, cluster)
-		if lockErr != nil {
-			return &requeue{curError: lockErr}
-		}
-	}
-
 	// See: https://github.com/kubernetes-sigs/kubebuilder/issues/592
 	// If we use the default reflect.DeepEqual method it will be recreating the
 	// clusterStatus multiple times because the pointers are different.

fdbclient/lock_client.go

@@ -332,6 +332,7 @@ func (client *realLockClient) ReleaseLock() error {
 
 		return nil, nil
 	})
+
 	return err
 }
 

sample-apps/data-loader/Dockerfile

@@ -2,7 +2,7 @@ ARG FDB_VERSION=7.1.67
 ARG FDB_WEBSITE=https://github.com/apple/foundationdb/releases/download
 
 # Build the manager binary
-FROM golang:1.26.4-bookworm AS builder
+FROM golang:1.26.5-bookworm AS builder
 
 ARG FDB_VERSION
 ARG FDB_WEBSITE