Provisioning: Fix patching released resources when Repository is deleted (#110295)

* Provisioning: Use merge patch instead of json path to release orphan resources

* rolling back to json Patch

* adding TODO for testing

* adding integration test

* using struct

* addressing comments on tests

pkg/registry/apis/provisioning/controller/finalizers.go

@@ -2,6 +2,7 @@ package controller
 
 import (
 	"context"
+	"encoding/json"
 	"sort"
 	"strings"
 
@@ -52,12 +53,14 @@ func (f *finalizer) process(ctx context.Context,
 		case ReleaseOrphanResourcesFinalizer:
 			err := f.processExistingItems(ctx, repo.Config(),
 				func(client dynamic.ResourceInterface, item *provisioning.ResourceListItem) error {
-					_, err := client.Patch(ctx, item.Name, types.JSONPatchType, []byte(`[
-						{"op": "remove", "path": "/metadata/annotations/`+utils.AnnoKeyManagerKind+`" },
-						{"op": "remove", "path": "/metadata/annotations/`+utils.AnnoKeyManagerIdentity+`" },
-						{"op": "remove", "path": "/metadata/annotations/`+utils.AnnoKeySourcePath+`" },
-						{"op": "remove", "path": "/metadata/annotations/`+utils.AnnoKeySourceChecksum+`" }
-					]`), v1.PatchOptions{})
+					patchAnnotations, err := getPatchedAnnotations(item)
+					if err != nil {
+						return err
+					}
+
+					_, err = client.Patch(
+						ctx, item.Name, types.JSONPatchType, patchAnnotations, v1.PatchOptions{},
+					)
 					return err
 				})
 			if err != nil {
@@ -124,6 +127,43 @@ func (f *finalizer) processExistingItems(
 	return nil
 }
 
+type jsonPatchOperation struct {
+	Op   string `json:"op"`
+	Path string `json:"path"`
+}
+
+func getPatchedAnnotations(item *provisioning.ResourceListItem) ([]byte, error) {
+	annotations := []jsonPatchOperation{
+		{Op: "remove", Path: "/metadata/annotations/" + escapePatchString(utils.AnnoKeyManagerKind)},
+		{Op: "remove", Path: "/metadata/annotations/" + escapePatchString(utils.AnnoKeyManagerIdentity)},
+	}
+
+	if item.Path != "" {
+		annotations = append(
+			annotations,
+			jsonPatchOperation{
+				Op: "remove", Path: "/metadata/annotations/" + escapePatchString(utils.AnnoKeySourcePath),
+			},
+		)
+	}
+	if item.Hash != "" {
+		annotations = append(
+			annotations,
+			jsonPatchOperation{
+				Op: "remove", Path: "/metadata/annotations/" + escapePatchString(utils.AnnoKeySourceChecksum),
+			},
+		)
+	}
+
+	return json.Marshal(annotations)
+}
+
+func escapePatchString(s string) string {
+	s = strings.ReplaceAll(s, "~", "~0")
+	s = strings.ReplaceAll(s, "/", "~1")
+	return s
+}
+
 func sortResourceListForDeletion(list *provisioning.ResourceList) {
 	// FIXME: this code should be simplified once unified storage folders support recursive deletion
 	// Sort by the following logic: