controller: wire tag resolver and rewrite resolveTargetDigest

Add TagResolver and TagResolutionInterval to the reconciler struct.

Rewrite resolveTargetDigest to resolve tag refs via the registry with
periodic re-resolution, and set Degraded/RegistryError on failure.

Wire GGCRResolver and --tag-resolution-interval flag in main.go.

Assisted-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Alice Frosi <afrosi@redhat.com>

Author: alicefr

cmd/controller/main.go

@@ -5,6 +5,7 @@ package main
 import (
 	"flag"
 	"os"
+	"time"
 
 	"k8s.io/apimachinery/pkg/runtime"
 	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
@@ -16,6 +17,7 @@ import (
 
 	bootcv1alpha1 "github.com/jlebon/bootc-operator/api/v1alpha1"
 	"github.com/jlebon/bootc-operator/internal/controller"
+	"github.com/jlebon/bootc-operator/internal/registry"
 )
 
 var (
@@ -31,7 +33,9 @@ func init() {
 func main() {
 	var enableLeaderElection bool
 	var probeAddr string
+	var tagResolutionInterval time.Duration
 	flag.StringVar(&probeAddr, "health-probe-bind-address", ":8081", "The address the probe endpoint binds to.")
+	flag.DurationVar(&tagResolutionInterval, "tag-resolution-interval", 5*time.Minute, "How often to re-resolve tag-based image refs.")
 	flag.BoolVar(&enableLeaderElection, "leader-elect", false,
 		"Enable leader election for controller manager. "+
 			"Enabling this will ensure there is only one active controller manager.")
@@ -61,9 +65,11 @@ func main() {
 	}
 
 	if err := (&controller.BootcNodePoolReconciler{
-		Client:     mgr.GetClient(),
-		Scheme:     mgr.GetScheme(),
-		KubeClient: kubeClient,
+		Client:                mgr.GetClient(),
+		Scheme:                mgr.GetScheme(),
+		KubeClient:            kubeClient,
+		TagResolver:           &registry.GGCRResolver{},
+		TagResolutionInterval: tagResolutionInterval,
 	}).SetupWithManager(mgr); err != nil {
 		setupLog.Error(err, "Failed to create controller", "controller", "bootcnodepool")
 		os.Exit(1)

internal/controller/bootcnodepool_controller.go

@@ -35,6 +35,7 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/source"
 
 	bootcv1alpha1 "github.com/jlebon/bootc-operator/api/v1alpha1"
+	"github.com/jlebon/bootc-operator/internal/registry"
 )
 
 // drainStatus tracks an in-progress drain goroutine for a single node.
@@ -52,6 +53,9 @@ type BootcNodePoolReconciler struct {
 	KubeClient kubernetes.Interface
 	Recorder   events.EventRecorder
 
+	TagResolver           registry.TagResolver
+	TagResolutionInterval time.Duration
+
 	// drainCh receives events from drain goroutines to re-enqueue the
 	// owning pool after a drain completes.
 	drainCh chan event.GenericEvent
@@ -239,12 +243,22 @@ func (r *BootcNodePoolReconciler) Reconcile(ctx context.Context, req ctrl.Reques
 	// the end.
 
 	// Resolve the target digest from the image ref.
-	if err := r.resolveTargetDigest(&pool); err != nil {
+	resolveResult, err := r.resolveTargetDigest(ctx, &pool)
+	if err != nil {
 		if isInvalidSpecError(err) {
 			return r.setInvalidSpecCondition(ctx, &pool, err)
 		}
 		return ctrl.Result{}, fmt.Errorf("resolving target digest: %w", err)
 	}
+	if pool.Status.TargetDigest == "" {
+		// First tag resolution failed — nothing to roll out yet.
+		if !reflect.DeepEqual(pool.Status, *statusOrig) {
+			if err := r.Status().Update(ctx, &pool); err != nil {
+				return ctrl.Result{}, fmt.Errorf("updating pool status: %w", err)
+			}
+		}
+		return resolveResult, nil
+	}
 
 	// Sync pool membership and retrieve BootcNodes we own.
 	ownedBootcNodes, err := r.syncMembership(ctx, &pool)
@@ -274,24 +288,56 @@ func (r *BootcNodePoolReconciler) Reconcile(ctx context.Context, req ctrl.Reques
 		}
 	}
 
-	return ctrl.Result{}, nil
+	return resolveResult, nil
 }
 
-// resolveTargetDigest parses the digest from the pool's image ref and
-// sets pool.Status.TargetDigest. For digest refs (the only kind
-// supported now), the digest is extracted directly. Tag resolution is
-// deferred to Milestone 5.
-func (r *BootcNodePoolReconciler) resolveTargetDigest(pool *bootcv1alpha1.BootcNodePool) error {
+// resolveTargetDigest resolves the target digest from the pool's image
+// ref. Digest refs are extracted directly. Tag refs are resolved via
+// the registry, respecting the re-resolution interval.
+func (r *BootcNodePoolReconciler) resolveTargetDigest(ctx context.Context, pool *bootcv1alpha1.BootcNodePool) (ctrl.Result, error) {
+	log := logf.FromContext(ctx)
+
 	ref, err := parseImageRef(pool.Spec.Image.Ref)
 	if err != nil {
-		return newInvalidSpecError(fmt.Sprintf("invalid image ref %q: %v", pool.Spec.Image.Ref, err))
+		return ctrl.Result{}, newInvalidSpecError(fmt.Sprintf("invalid image ref %q: %v", pool.Spec.Image.Ref, err))
 	}
+
 	digested, ok := ref.(reference.Digested)
-	if !ok {
-		return newInvalidSpecError(fmt.Sprintf("image ref %q has no digest (tag resolution not yet supported)", pool.Spec.Image.Ref))
+	if ok {
+		pool.Status.TargetDigest = digested.Digest().String()
+		return ctrl.Result{}, nil
 	}
-	pool.Status.TargetDigest = digested.Digest().String()
-	return nil
+
+	// Tag ref — check if resolution is due.
+	now := time.Now()
+	if pool.Status.NextTagResolutionTime != nil && now.Before(pool.Status.NextTagResolutionTime.Time) {
+		remaining := pool.Status.NextTagResolutionTime.Time.Sub(now)
+		log.V(1).Info("Tag resolution not yet due", "remaining", remaining)
+		return ctrl.Result{RequeueAfter: remaining}, nil
+	}
+
+	digest, err := r.TagResolver.Resolve(ctx, pool.Spec.Image.Ref)
+	if err != nil {
+		log.Error(err, "Failed to resolve tag", "ref", pool.Spec.Image.Ref)
+		apimeta.SetStatusCondition(&pool.Status.Conditions, metav1.Condition{
+			Type:    bootcv1alpha1.PoolDegraded,
+			Status:  metav1.ConditionTrue,
+			Reason:  bootcv1alpha1.PoolRegistryError,
+			Message: err.Error(),
+		})
+		next := metav1.NewTime(now.Add(r.TagResolutionInterval))
+		pool.Status.NextTagResolutionTime = &next
+		return ctrl.Result{RequeueAfter: r.TagResolutionInterval}, nil
+	}
+
+	if pool.Status.TargetDigest != digest {
+		log.Info("Resolved tag to new digest", "ref", pool.Spec.Image.Ref, "digest", digest)
+	}
+	pool.Status.TargetDigest = digest
+	next := metav1.NewTime(now.Add(r.TagResolutionInterval))
+	pool.Status.NextTagResolutionTime = &next
+	// Requeue the tag resolution for the next interval
+	return ctrl.Result{RequeueAfter: r.TagResolutionInterval}, nil
 }
 
 // parseImageRef parses an image reference string into a named