From 48ae804d9769a0fb9c6de1821baab428f766489a Mon Sep 17 00:00:00 2001
From: Tony Sun <sunwuyue@live.com>
Date: Fri, 17 Jul 2026 16:04:38 -0400
Subject: [PATCH] agent: clear own config status on stop

Status.nodes entries were only removed when the config resource name
changed. On clean shutdown, null this node's status key so graceful
DaemonSet stops do not leave permanent orphans on the shared policy object.

Signed-off-by: Tony Sun <sunwuyue@live.com>
---
 pkg/agent/agent.go | 27 +++++++++++++++++++++++++++
 1 file changed, 27 insertions(+)

diff --git a/pkg/agent/agent.go b/pkg/agent/agent.go
index 9f63cbae9..aa030f259 100644
--- a/pkg/agent/agent.go
+++ b/pkg/agent/agent.go
@@ -21,6 +21,7 @@ import (
 	"net/http"
 	"os"
 	"sync"
+	"time"
 
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -258,6 +259,7 @@ func (a *Agent) Stop() {
 	defer a.stopLock.Unlock()
 
 	if a.stopC != nil {
+		a.clearOwnConfigStatus()
 		close(a.stopC)
 		<-a.doneC
 		a.stopC = nil
@@ -625,6 +627,31 @@ func (a *Agent) updateConfig(cfg metav1.Object) {
 	a.configure(cfg)
 }
 
+// clearOwnConfigStatus nulls this node's Status.nodes entry on the current
+// config resource so a clean shutdown does not leave a permanent orphan.
+func (a *Agent) clearOwnConfigStatus() {
+	if a.cfgIf == nil || a.nodeName == "" || a.hasLocalConfig() || a.currentCfg == nil {
+		return
+	}
+
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancel()
+
+	ns := a.namespace
+	name := a.currentCfg.GetName()
+	node := a.nodeName
+
+	data, pt, err := cfgapi.NodeStatusPatch(node, nil)
+	if err == nil {
+		err = a.cfgIf.PatchStatus(ctx, ns, name, pt, data, metav1.PatchOptions{})
+	}
+	if err != nil {
+		log.Errorf("failed to clear own config status on %s/%s: %v", ns, name, err)
+		return
+	}
+	log.Infof("cleared own config status on %s/%s", ns, name)
+}
+
 func (a *Agent) patchConfigStatus(prev, curr metav1.Object, errors error) {
 	if a.cfgIf == nil {
 		return