Configuration deletion skips destroy job when apply fails before state secret is created, leaving cloud resources orphaned

[gmarfia88]

Summary
When a terraform apply job fails mid-execution, the terranetes executor (step binary) does not seem to upload the Terraform state secret to Kubernetes. As a result, when the Configuration resource is later deleted, the controller appears to silently skip the destroy job — potentially leaving any cloud resources that were partially created permanently orphaned.

Root Cause
The issue seems to involve two components:

1. cmd/step/main.go (around line 220) — state is only uploaded on success**
   The step binary appears to upload Kubernetes secrets (including the Terraform state) only after all commands complete successfully. If terraform apply fails, the executor seems to exit early with an error and never upload the local /data/terraform.tfstate to the Kubernetes secret, even though Terraform has already written a partial state to disk.

2. pkg/controller/configuration/delete.go (line 69) — destroy is skipped if state secret is absent**
   found, err := kubernetes.GetIfExists(ctx, c.cc, secret)
...
if !found { return reconcile.Result{}, nil }

If the state secret does not exist, ensureTerraformDestroy returns without creating a destroy job, allowing the finalizer to complete and the Configuration to be deleted.

Scenario

1. User applies a Configuration that provisions cloud resources.
2. terraform apply partially succeeds (e.g., creates some resources) and then fails.
3. The step executor exits with an error — the Terraform state secret is not created in Kubernetes, even though a terraform.tfstate file exists locally in the job pod.
4. The user deletes the Configuration to clean up.
5. ensureTerraformDestroy finds no state secret → skips the destroy job → removes the finalizer.
6. The Configuration is deleted from Kubernetes, but the partially created cloud resources remain — permanently orphaned.

Expected behavior
The state secret should be uploaded even when terraform apply fails, so that a subsequent delete of the Configuration can correctly trigger a destroy job to clean up any partially created cloud resources.

Please let me know if you need more details.