Right now the controller deletes the oauth clients it provisions when they're deleted from the cluster. This should be an optional policy like the reclaim policies on PVCs.