Is your feature request related to a problem? Please describe.

While running self-hosted GitHub runners managed by github actions-runner-controller (ARC), I'm using ExternalSecret to generate a Secret that is then consumed by AutoscalingRunnerSet. Both ExternalSecret and AutoscalingRunnerSet are installed within the same helm chart. ARC has a custom cleanup functionality where you're expected to put actions.github.com/cleanup-protection finalizer on a Secret to prevent it from being deleted too early. When AutoscalingRunnerSet is deleted, ARC will also delete the finalizer on the Secret at the appropriate moment. If this procedure is not followed and the Secret is deleted too early, everything breaks during the chart uninstall. Note that ARC only removes the finalizer, it can't delete the Secret by itself, which is why just specifying creationPolicy: Orphan won't fully solve the problem.

ARC cleanup is described here. Example of a Secret with finalizer when it's created by an official chart rather than ExternalSecret: https://github.com/actions/actions-runner-controller/blob/v0.27.6/charts/gha-runner-scale-set/templates/githubsecret.yaml#L10

Describe the solution you'd like

Ability to specify finalizers in spec.target.template.metadata. Currently, it only supports labels and annotations.

Describe alternatives you've considered

• creationPolicy: Orphan to never delete a Secret - not ideal to leave the garbage around + potential security concern.
• Mutating webhook with a thirdparty controller (e.g. kyverno) - this is what I ended up doing, but still would be nice to use native support instead.