dev: rel notes

Author: sunsingerus

release_notes.md

@@ -52,6 +52,10 @@
   Two related changes come with it: the hook now execs `kubectl` directly rather than wrapping it in `/bin/sh`, because `registry.k8s.io/kubectl` is distroless and ships no shell; and it runs as root (uid 0) where the Bitnami image ran as uid 1001 — set `crdHook.containerSecurityContext` if your admission policies require a non-root uid.
 
 ### Fixed
+* **Host deletion is no longer reported as completed when the operator could not tell whether the host still exists.** Deleting a host starts by fetching its StatefulSet, and *any* error from that fetch was treated as "already deleted" — a `DeleteCompleted` event was emitted and the rest of the cleanup was skipped. Only `NotFound` actually means the host is gone; a `Forbidden`, a throttled request or a transport failure took the same branch. The skipped cleanup covers the ZooKeeper table drop and the deletion of the host's StatefulSet, PVCs, ConfigMap and Service. The PVCs matter most: they carry no owner reference, so by default nothing else reclaims them. Now only `NotFound` reports completion; every other error raises `DeleteFailed` and returns the error. Present since 0.10.0.
+
+  This surfaces when the StatefulSet fetch fails in a way that is not retryable — a revoked or expired token, RBAC that no longer permits reading StatefulSets, sustained throttling, or an API server unreachable for longer than the retry budget (5 attempts over roughly 7.5 seconds). Note the error is not yet propagated far enough to stop the CHI finalizer being removed, so an affected deletion can still orphan PVCs; that is tracked separately in [#2056](https://github.com/Altinity/clickhouse-operator/issues/2056). Contributed by [@somanchi004-code](https://github.com/somanchi004-code) in [PR #2057](https://github.com/Altinity/clickhouse-operator/pull/2057).
+
 * **Operator no longer keeps probing a ZooKeeper ensemble it can no longer reach.** On any terminal ZK session state the operator released its handle on the connection, but closed the underlying connection only for *expired* and *connecting* states — never for *disconnected*, which is the state the client library reports first. Nothing else held a reference, so that connection could never be closed again, and the library's internal loop kept re-dialing its cached (by then stale) endpoint addresses roughly once a second for the remaining lifetime of the operator process. The visible symptom was an endless stream of `failed to connect to <ip>:2181: i/o timeout` that only an operator restart cleared. Every terminal state now closes the connection. Present since 0.24.0.
 
   The ZK root-path ensure is now cancellable and runs under the reconcile context, so superseding or cancelling a reconcile interrupts it instead of spending its full retry budget — roughly 8 minutes per ZooKeeper operation, and two operations per path component — dialing an unreachable ensemble. An ensure that exhausts its retries now also raises a `CreateFailed` event, rather than only a log line; it remains non-fatal, because ClickHouse creates the root path itself on first DDL. The ensure is additionally skipped on recovery passes that repeat an already-completed generation with no pending work, so recovering an unhealthy host no longer re-dials the ensemble. The ZK client library's own per-attempt dial logging is routed through the operator's logger, and per-attempt retry detail is logged at `-v=1`.