fix: read Karmada PP name from ResourceBinding annotations, not labels

OrphanRBReconciler scoped referenced-data companion ResourceBindings by reading
propagationpolicy.karmada.io/name from metadata.labels, but the running Karmada
version stores that value in metadata.annotations (labels carry only permanent-id
UUIDs). The label read always returned "", so the scope predicate rejected every
ResourceBinding and the controller never reclaimed an orphaned binding — confirmed
live in the lab, where the stranded cm-pristine/secret-pristine copies were never
cleaned.

Read from annotations in both isInScope and the watch predicate. The unit-test
fixtures previously set the PP name as a label (matching the bug, which is why they
passed against broken code); they now use the production annotation shape, so they
fail against the label read and pass against the fix.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
(cherry picked from commit e321370)

Author: scotwells

internal/controller/orphan_rb_controller.go

@@ -25,14 +25,17 @@ const (
 	// ResourceBindings whose hub companion was deleted before the controller started.
 	orphanRBSweepInterval = 5 * time.Minute
 
-	// ppNameLabelKey is the label Karmada's binding-controller stamps on every
-	// ResourceBinding to link it back to its governing PropagationPolicy.
-	ppNameLabelKey = "propagationpolicy.karmada.io/name"
+	// ppNameAnnotationKey is the annotation Karmada's binding-controller stamps on
+	// every ResourceBinding to link it back to its governing PropagationPolicy.
+	// Despite the "name" in the key string, Karmada stores this value in
+	// metadata.annotations, NOT metadata.labels (labels carry only permanent-id
+	// UUIDs). Reading from labels always returns "" and breaks scope filtering.
+	ppNameAnnotationKey = "propagationpolicy.karmada.io/name"
 
 	// cityPPPrefix is the prefix of PropagationPolicy names created by
 	// propagationPolicyNameFor in workloaddeployment_federator.go. RBs whose
-	// PP label starts with this prefix were created for referenced-data companion
-	// propagation.
+	// PP annotation starts with this prefix were created for referenced-data
+	// companion propagation.
 	cityPPPrefix = "city-"
 )
 
@@ -49,8 +52,9 @@ const (
 // Only ResourceBindings satisfying ALL three conditions are ever deleted:
 //  1. Name ends with "-configmap" or "-secret" (Karmada's kind-suffix for
 //     namespace-scoped ConfigMap/Secret RBs — WD RBs end in "-workloaddeployment").
-//  2. The propagationpolicy.karmada.io/name label starts with "city-" (all
-//     referenced-data PropagationPolicies use this prefix).
+//  2. The propagationpolicy.karmada.io/name annotation starts with "city-" (all
+//     referenced-data PropagationPolicies use this prefix; Karmada stores this
+//     in annotations, not labels).
 //  3. The hub companion derived by stripping the kind suffix does NOT exist
 //     in the same namespace (and has no deletionTimestamp — a terminating
 //     companion means Karmada cascade is still in progress).
@@ -116,9 +120,9 @@ func (r *OrphanRBReconciler) Reconcile(ctx context.Context, req ctrl.Request) (c
 }
 
 // isInScope returns true when the ResourceBinding falls within the tight scope
-// of referenced-data companion RBs: city-PP label AND kind suffix.
+// of referenced-data companion RBs: city-PP annotation AND kind suffix.
 func (r *OrphanRBReconciler) isInScope(rb *karmadaworkv1alpha2.ResourceBinding) bool {
-	ppName := rb.Labels[ppNameLabelKey]
+	ppName := rb.Annotations[ppNameAnnotationKey]
 	if !strings.HasPrefix(ppName, cityPPPrefix) {
 		return false
 	}
@@ -187,7 +191,7 @@ func (r *OrphanRBReconciler) SetupWithManager(mgr manager.Manager) error {
 	return ctrl.NewControllerManagedBy(mgr).
 		For(&karmadaworkv1alpha2.ResourceBinding{},
 			builder.WithPredicates(predicate.NewPredicateFuncs(func(obj client.Object) bool {
-				ppName := obj.GetLabels()[ppNameLabelKey]
+				ppName := obj.GetAnnotations()[ppNameAnnotationKey]
 				if !strings.HasPrefix(ppName, cityPPPrefix) {
 					return false
 				}

internal/controller/orphan_rb_controller_test.go

@@ -25,8 +25,14 @@ const (
 	// orbTestNS is the hub namespace where companion RBs and their companions live.
 	orbTestNS = "ns-efdf8ca1-9c2d-4ac8-b161-1951503a2879"
 
-	// orbCityPPName is the PropagationPolicy name label used on companion RBs.
+	// orbCityPPName is the PropagationPolicy name stored in metadata.annotations
+	// on companion RBs. Karmada writes it to annotations, not labels (labels only
+	// carry permanent-id UUIDs).
 	orbCityPPName = "city-dfw"
+
+	// Karmada permanent-id label keys — present in metadata.labels on production RBs.
+	orbPPPermanentIDKey = "propagationpolicy.karmada.io/permanent-id"
+	orbRBPermanentIDKey = "resourcebinding.karmada.io/permanent-id"
 )
 
 // ─── Helpers ──────────────────────────────────────────────────────────────────
@@ -40,15 +46,22 @@ func newOrphanRBReconciler(objs ...client.Object) (*OrphanRBReconciler, client.C
 	return &OrphanRBReconciler{HubClient: hubCl}, hubCl
 }
 
-// makeCompanionRB returns a ResourceBinding that represents an in-scope
-// companion RB (city-PP label + configmap/secret name suffix). The RB is
-// placed in orbTestNS.
+// makeCompanionRB returns a ResourceBinding that mirrors the production shape
+// observed in the lab: PP name in metadata.annotations (NOT labels), and
+// permanent-id UUIDs in labels. This matches what Karmada's binding-controller
+// actually stamps on each ResourceBinding.
 func makeCompanionRB(name string) *karmadaworkv1alpha2.ResourceBinding {
 	return &karmadaworkv1alpha2.ResourceBinding{
 		ObjectMeta: metav1.ObjectMeta{
 			Namespace: orbTestNS,
 			Name:      name,
-			Labels:    map[string]string{ppNameLabelKey: orbCityPPName},
+			Labels: map[string]string{
+				orbPPPermanentIDKey: "a3d5b1ac-0000-0000-0000-000000000001",
+				orbRBPermanentIDKey: "ee4b0939-0000-0000-0000-000000000001",
+			},
+			Annotations: map[string]string{
+				ppNameAnnotationKey: orbCityPPName,
+			},
 		},
 	}
 }
@@ -153,12 +166,17 @@ func TestOrphanRB_SkipsTerminatingCompanion(t *testing.T) {
 func TestOrphanRB_IgnoresNonCityPPRB(t *testing.T) {
 	t.Parallel()
 
-	// RB has a non-city PP label (e.g. a WD's PP or an unrelated tenant's PP).
+	// RB has a non-city PP annotation (e.g. a WD's PP or an unrelated tenant's PP).
+	// Production shape: PP name in annotations, permanent-ids in labels.
 	nonCityRB := &karmadaworkv1alpha2.ResourceBinding{
 		ObjectMeta: metav1.ObjectMeta{
 			Namespace: orbTestNS,
 			Name:      "cm-other-configmap",
-			Labels:    map[string]string{ppNameLabelKey: "other-pp"},
+			Labels: map[string]string{
+				"propagationpolicy.karmada.io/permanent-id": "a3d5b1ac-0000-0000-0000-000000000099",
+				"resourcebinding.karmada.io/permanent-id":   "ee4b0939-0000-0000-0000-000000000099",
+			},
+			Annotations: map[string]string{ppNameAnnotationKey: "other-pp"},
 		},
 	}
 	r, hubCl := newOrphanRBReconciler(nonCityRB)
@@ -179,12 +197,17 @@ func TestOrphanRB_IgnoresNonCityPPRB(t *testing.T) {
 func TestOrphanRB_IgnoresWorkloadDeploymentRB(t *testing.T) {
 	t.Parallel()
 
-	// WD RB: correct city- PP label but wrong kind suffix.
+	// WD RB: correct city- PP annotation but wrong kind suffix ("-workloaddeployment"
+	// instead of "-configmap"/"-secret"). Production shape: PP name in annotations.
 	wdRB := &karmadaworkv1alpha2.ResourceBinding{
 		ObjectMeta: metav1.ObjectMeta{
 			Namespace: orbTestNS,
 			Name:      "my-workload-workloaddeployment",
-			Labels:    map[string]string{ppNameLabelKey: "city-dfw"},
+			Labels: map[string]string{
+				"propagationpolicy.karmada.io/permanent-id": "a3d5b1ac-0000-0000-0000-000000000088",
+				"resourcebinding.karmada.io/permanent-id":   "ee4b0939-0000-0000-0000-000000000088",
+			},
+			Annotations: map[string]string{ppNameAnnotationKey: "city-dfw"},
 		},
 	}
 	r, hubCl := newOrphanRBReconciler(wdRB)