Add DeviceClass lifecycle management to DRA reconciler

Extend the DRAReconciler to manage cluster-scoped DeviceClass resources
declared in spec.dra.deviceClasses. DeviceClasses use label-based ownership
(ModuleNameLabel + ModuleNamespaceLabel) since ownerReferences cannot
reference namespaced resources from cluster-scoped objects.

The reconciler performs declarative convergence on each cycle:
- Creates missing DeviceClasses with ownership labels
- Patches existing DeviceClasses to correct spec drift
- Deletes stale DeviceClasses no longer in the desired list
- Cleans up all DeviceClasses on Module deletion or DRA removal

Errors are aggregated via errors.Join to attempt all operations before
requeueing. NotFound errors on delete are tolerated to handle races.

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: TomerNewman

internal/constants/constants.go

@@ -2,6 +2,7 @@ package constants
 
 const (
 	ModuleNameLabel        = "kmm.node.kubernetes.io/module.name"
+	ModuleNamespaceLabel   = "kmm.node.kubernetes.io/module.namespace"
 	NodeLabelerFinalizer   = "kmm.node.kubernetes.io/node-labeler"
 	TargetKernelTarget     = "kmm.node.kubernetes.io/target-kernel"
 	ResourceType           = "kmm.node.kubernetes.io/resource-type"

internal/controllers/dra_reconciler.go

@@ -27,6 +27,8 @@ import (
 	"github.com/kubernetes-sigs/kernel-module-management/internal/utils"
 	appsv1 "k8s.io/api/apps/v1"
 	v1 "k8s.io/api/core/v1"
+	resourcev1 "k8s.io/api/resource/v1"
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/runtime"
 	ctrl "sigs.k8s.io/controller-runtime"
@@ -82,14 +84,18 @@ func (r *DRAReconciler) Reconcile(ctx context.Context, mod *kmmv1beta1.Module) (
 		return res, fmt.Errorf("could not get DRA DaemonSets for module %s, namespace %s: %v", mod.Name, mod.Namespace, err)
 	}
 
+	existingDCs, err := r.reconHelperAPI.getModuleDeviceClasses(ctx, mod.Name, mod.Namespace)
+	if err != nil {
+		return res, fmt.Errorf("could not get DeviceClasses for module %s, namespace %s: %v", mod.Name, mod.Namespace, err)
+	}
+
 	if mod.GetDeletionTimestamp() != nil {
-		err = r.reconHelperAPI.deleteDRADaemonSets(ctx, existingDRADS)
-		return ctrl.Result{}, err
+		return ctrl.Result{}, r.reconHelperAPI.deleteDRAResources(ctx, existingDRADS, existingDCs)
 	}
 
 	if mod.Spec.DRA == nil {
-		if len(existingDRADS) > 0 {
-			if err = r.reconHelperAPI.deleteDRADaemonSets(ctx, existingDRADS); err != nil {
+		if len(existingDRADS) > 0 || len(existingDCs) > 0 {
+			if err = r.reconHelperAPI.deleteDRAResources(ctx, existingDRADS, existingDCs); err != nil {
 				return ctrl.Result{}, err
 			}
 		}
@@ -101,6 +107,11 @@ func (r *DRAReconciler) Reconcile(ctx context.Context, mod *kmmv1beta1.Module) (
 		return res, fmt.Errorf("could not handle DRA: %v", err)
 	}
 
+	err = r.reconHelperAPI.handleDeviceClasses(ctx, mod, existingDCs)
+	if err != nil {
+		return res, fmt.Errorf("could not handle DeviceClasses: %v", err)
+	}
+
 	err = r.reconHelperAPI.moduleUpdateDRAStatus(ctx, mod, existingDRADS)
 	if err != nil {
 		return res, fmt.Errorf("failed to update DRA status of the module: %v", err)
@@ -116,9 +127,11 @@ func (r *DRAReconciler) Reconcile(ctx context.Context, mod *kmmv1beta1.Module) (
 type draReconcilerHelperAPI interface {
 	getModuleDRADaemonSets(ctx context.Context, name, namespace string) ([]appsv1.DaemonSet, error)
 	handleDRA(ctx context.Context, mod *kmmv1beta1.Module, existingDRADS []appsv1.DaemonSet) error
-	deleteDRADaemonSets(ctx context.Context, existingDRADS []appsv1.DaemonSet) error
+	deleteDRAResources(ctx context.Context, daemonSets []appsv1.DaemonSet, deviceClasses []resourcev1.DeviceClass) error
 	moduleUpdateDRAStatus(ctx context.Context, mod *kmmv1beta1.Module, existingDRADS []appsv1.DaemonSet) error
 	clearDRAStatus(ctx context.Context, mod *kmmv1beta1.Module) error
+	getModuleDeviceClasses(ctx context.Context, name, namespace string) ([]resourcev1.DeviceClass, error)
+	handleDeviceClasses(ctx context.Context, mod *kmmv1beta1.Module, existingDCs []resourcev1.DeviceClass) error
 }
 
 type draReconcilerHelper struct {
@@ -183,14 +196,21 @@ func (drh *draReconcilerHelper) handleDRA(ctx context.Context, mod *kmmv1beta1.M
 	return err
 }
 
-func (drh *draReconcilerHelper) deleteDRADaemonSets(ctx context.Context, existingDRADS []appsv1.DaemonSet) error {
-	for _, ds := range existingDRADS {
-		err := drh.client.Delete(ctx, &ds)
-		if err != nil {
-			return fmt.Errorf("failed to delete DRA DaemonSet %s/%s: %v", ds.Namespace, ds.Name, err)
+// deleteDRAResources deletes all DRA-owned DaemonSets and DeviceClasses.
+// It attempts every deletion and returns a joined error so the controller requeues on partial failure.
+func (drh *draReconcilerHelper) deleteDRAResources(ctx context.Context, daemonSets []appsv1.DaemonSet, deviceClasses []resourcev1.DeviceClass) error {
+	var errs []error
+	for _, ds := range daemonSets {
+		if err := drh.client.Delete(ctx, &ds); err != nil && !apierrors.IsNotFound(err) {
+			errs = append(errs, fmt.Errorf("failed to delete DRA DaemonSet %s/%s: %v", ds.Namespace, ds.Name, err))
 		}
 	}
-	return nil
+	for _, dc := range deviceClasses {
+		if err := drh.client.Delete(ctx, &dc); err != nil && !apierrors.IsNotFound(err) {
+			errs = append(errs, fmt.Errorf("failed to delete DeviceClass %s: %v", dc.Name, err))
+		}
+	}
+	return errors.Join(errs...)
 }
 
 func (drh *draReconcilerHelper) moduleUpdateDRAStatus(ctx context.Context,
@@ -233,6 +253,110 @@ func (drh *draReconcilerHelper) clearDRAStatus(ctx context.Context, mod *kmmv1be
 	return drh.client.Status().Patch(ctx, mod, client.MergeFrom(unmodifiedMod))
 }
 
+func (drh *draReconcilerHelper) getModuleDeviceClasses(ctx context.Context, name, namespace string) ([]resourcev1.DeviceClass, error) {
+	dcList := resourcev1.DeviceClassList{}
+	opts := []client.ListOption{
+		client.MatchingLabels(map[string]string{
+			constants.ModuleNameLabel:      name,
+			constants.ModuleNamespaceLabel: namespace,
+		}),
+	}
+	if err := drh.client.List(ctx, &dcList, opts...); err != nil {
+		return nil, fmt.Errorf("could not list DeviceClasses: %v", err)
+	}
+
+	return dcList.Items, nil
+}
+
+// handleDeviceClasses reconciles cluster-scoped DeviceClass resources to match the desired state
+// declared in mod.Spec.DRA.DeviceClasses. It performs declarative convergence:
+//   - DeviceClasses present in the spec but missing from the cluster are created.
+//   - DeviceClasses present in both are patched to reflect the current spec (drift correction).
+//   - DeviceClasses present in the cluster but absent from the spec are deleted (stale cleanup).
+func (drh *draReconcilerHelper) handleDeviceClasses(ctx context.Context, mod *kmmv1beta1.Module, existingDCs []resourcev1.DeviceClass) error {
+	if mod.Spec.DRA == nil {
+		return nil
+	}
+
+	logger := log.FromContext(ctx)
+
+	existingByName := make(map[string]resourcev1.DeviceClass, len(existingDCs))
+	for _, dc := range existingDCs {
+		existingByName[dc.Name] = dc
+	}
+
+	desiredByName := make(map[string]kmmv1beta1.DeviceClassSpec, len(mod.Spec.DRA.DeviceClasses))
+	for _, dc := range mod.Spec.DRA.DeviceClasses {
+		desiredByName[dc.Name] = dc
+	}
+
+	var errs []error
+
+	// Create missing or patch existing DeviceClasses to match the desired spec.
+	for _, desired := range mod.Spec.DRA.DeviceClasses {
+		existingDC, exists := existingByName[desired.Name]
+		if err := drh.createOrPatchDeviceClass(ctx, mod, desired, existingDC, exists); err != nil {
+			errs = append(errs, err)
+		}
+	}
+
+	// Delete DeviceClasses that exist in the cluster but are no longer in the desired spec.
+	for name, dc := range existingByName {
+		if _, desired := desiredByName[name]; !desired {
+			if deleteErr := drh.client.Delete(ctx, &dc); deleteErr != nil && !apierrors.IsNotFound(deleteErr) {
+				errs = append(errs, fmt.Errorf("failed to delete DeviceClass %s: %v", name, deleteErr))
+			} else {
+				logger.Info("Deleted extra DeviceClass", "name", name)
+			}
+		}
+	}
+
+	return errors.Join(errs...)
+}
+
+// createOrPatchDeviceClass ensures a single DeviceClass matches the desired spec.
+// If the DeviceClass does not exist, it creates one with ownership labels.
+// If it already exists, it patches selectors and config to correct any drift.
+func (drh *draReconcilerHelper) createOrPatchDeviceClass(
+	ctx context.Context,
+	mod *kmmv1beta1.Module,
+	desired kmmv1beta1.DeviceClassSpec,
+	existingDC resourcev1.DeviceClass,
+	exists bool,
+) error {
+	logger := log.FromContext(ctx)
+
+	if !exists {
+		dc := resourcev1.DeviceClass{
+			ObjectMeta: metav1.ObjectMeta{
+				Name: desired.Name,
+				Labels: map[string]string{
+					constants.ModuleNameLabel:      mod.Name,
+					constants.ModuleNamespaceLabel: mod.Namespace,
+				},
+			},
+			Spec: resourcev1.DeviceClassSpec{
+				Selectors: desired.Selectors,
+				Config:    desired.Config,
+			},
+		}
+		if err := drh.client.Create(ctx, &dc); err != nil {
+			return fmt.Errorf("failed to create DeviceClass %s: %v", desired.Name, err)
+		}
+		logger.Info("Created DeviceClass", "name", desired.Name)
+		return nil
+	}
+
+	patch := client.MergeFrom(existingDC.DeepCopy())
+	existingDC.Spec.Selectors = desired.Selectors
+	existingDC.Spec.Config = desired.Config
+	if err := drh.client.Patch(ctx, &existingDC, patch); err != nil {
+		return fmt.Errorf("failed to patch DeviceClass %s: %v", desired.Name, err)
+	}
+	logger.Info("Patched DeviceClass", "name", desired.Name)
+	return nil
+}
+
 type draDaemonSetCreator interface {
 	setDRAAsDesired(ctx context.Context, ds *appsv1.DaemonSet, mod *kmmv1beta1.Module) error
 }