fix(hcco): add CP pull-secret watches for in-place propagation

Add watches on the control plane namespace pull-secret in both the
globalps and resources HCCO controllers so that in-place updates to
HostedCluster.spec.pullSecret propagate promptly to the guest cluster
without depending on incidental kube-system secret activity.

Also clarify the spec.pullSecret API godoc to document the in-place
update behavior for AWS and Azure Replace-strategy NodePools.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: enxebre

api/hypershift/v1beta1/hostedcluster_types.go

@@ -674,10 +674,13 @@ type HostedClusterSpec struct {
 	// pullSecret is a local reference to a Secret that must have a ".dockerconfigjson" key whose content must be a valid Openshift pull secret JSON.
 	// If the reference is set but none of the above requirements are met, the HostedCluster will enter a degraded state.
 	// TODO(alberto): Signal this in a condition.
-	// This pull secret will be part of every payload generated by the controllers for any NodePool of the HostedCluster
-	// and it will be injected into the container runtime of all NodePools.
-	// Changing this value will trigger a rollout for all existing NodePools in the cluster.
-	// Changing the content of the secret inplace will not trigger a rollout and might result in unpredictable behaviour.
+	// This pull secret is included in NodePool ignition/bootstrap payloads and applied to the container runtime when nodes provision.
+	// Changing this value will trigger a rollout for all existing NodePools in the cluster (for both replace and inplace upgrade types).
+	// Updating the referenced Secret's data in place (without changing this reference) does not trigger that rollout.
+	// In AWS and Azure NodePools using the Replace upgrade strategy, the Secret's data in place changes
+	// will still propagate the updated credentials down to the guest cluster and kubelet config.
+	// See https://github.com/openshift/hypershift/blob/3e0e06f78460ac1100dd8432dd7eee4e980a87d0/docs/content/how-to/common/global-pull-secret.md
+	// for details.
 	// +required
 	// +rollout
 	// TODO(alberto): have our own local reference type to include our opinions and avoid transparent changes.

api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/AAA_ungated.yaml

@@ -5690,10 +5690,13 @@ spec:
                 description: |-
                   pullSecret is a local reference to a Secret that must have a ".dockerconfigjson" key whose content must be a valid Openshift pull secret JSON.
                   If the reference is set but none of the above requirements are met, the HostedCluster will enter a degraded state.
-                  This pull secret will be part of every payload generated by the controllers for any NodePool of the HostedCluster
-                  and it will be injected into the container runtime of all NodePools.
-                  Changing this value will trigger a rollout for all existing NodePools in the cluster.
-                  Changing the content of the secret inplace will not trigger a rollout and might result in unpredictable behaviour.
+                  This pull secret is included in NodePool ignition/bootstrap payloads and applied to the container runtime when nodes provision.
+                  Changing this value will trigger a rollout for all existing NodePools in the cluster (for both replace and inplace upgrade types).
+                  Updating the referenced Secret's data in place (without changing this reference) does not trigger that rollout.
+                  In AWS and Azure NodePools using the Replace upgrade strategy, the Secret's data in place changes
+                  will still propagate the updated credentials down to the guest cluster and kubelet config.
+                  See https://github.com/openshift/hypershift/blob/3e0e06f78460ac1100dd8432dd7eee4e980a87d0/docs/content/how-to/common/global-pull-secret.md
+                  for details.
                 properties:
                   name:
                     default: ""

api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/AutoNodeKarpenter.yaml

@@ -5809,10 +5809,13 @@ spec:
                 description: |-
                   pullSecret is a local reference to a Secret that must have a ".dockerconfigjson" key whose content must be a valid Openshift pull secret JSON.
                   If the reference is set but none of the above requirements are met, the HostedCluster will enter a degraded state.
-                  This pull secret will be part of every payload generated by the controllers for any NodePool of the HostedCluster
-                  and it will be injected into the container runtime of all NodePools.
-                  Changing this value will trigger a rollout for all existing NodePools in the cluster.
-                  Changing the content of the secret inplace will not trigger a rollout and might result in unpredictable behaviour.
+                  This pull secret is included in NodePool ignition/bootstrap payloads and applied to the container runtime when nodes provision.
+                  Changing this value will trigger a rollout for all existing NodePools in the cluster (for both replace and inplace upgrade types).
+                  Updating the referenced Secret's data in place (without changing this reference) does not trigger that rollout.
+                  In AWS and Azure NodePools using the Replace upgrade strategy, the Secret's data in place changes
+                  will still propagate the updated credentials down to the guest cluster and kubelet config.
+                  See https://github.com/openshift/hypershift/blob/3e0e06f78460ac1100dd8432dd7eee4e980a87d0/docs/content/how-to/common/global-pull-secret.md
+                  for details.
                 properties:
                   name:
                     default: ""

api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ClusterUpdateAcceptRisks.yaml

@@ -5673,10 +5673,13 @@ spec:
                 description: |-
                   pullSecret is a local reference to a Secret that must have a ".dockerconfigjson" key whose content must be a valid Openshift pull secret JSON.
                   If the reference is set but none of the above requirements are met, the HostedCluster will enter a degraded state.
-                  This pull secret will be part of every payload generated by the controllers for any NodePool of the HostedCluster
-                  and it will be injected into the container runtime of all NodePools.
-                  Changing this value will trigger a rollout for all existing NodePools in the cluster.
-                  Changing the content of the secret inplace will not trigger a rollout and might result in unpredictable behaviour.
+                  This pull secret is included in NodePool ignition/bootstrap payloads and applied to the container runtime when nodes provision.
+                  Changing this value will trigger a rollout for all existing NodePools in the cluster (for both replace and inplace upgrade types).
+                  Updating the referenced Secret's data in place (without changing this reference) does not trigger that rollout.
+                  In AWS and Azure NodePools using the Replace upgrade strategy, the Secret's data in place changes
+                  will still propagate the updated credentials down to the guest cluster and kubelet config.
+                  See https://github.com/openshift/hypershift/blob/3e0e06f78460ac1100dd8432dd7eee4e980a87d0/docs/content/how-to/common/global-pull-secret.md
+                  for details.
                 properties:
                   name:
                     default: ""

api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ClusterVersionOperatorConfiguration.yaml

@@ -5693,10 +5693,13 @@ spec:
                 description: |-
                   pullSecret is a local reference to a Secret that must have a ".dockerconfigjson" key whose content must be a valid Openshift pull secret JSON.
                   If the reference is set but none of the above requirements are met, the HostedCluster will enter a degraded state.
-                  This pull secret will be part of every payload generated by the controllers for any NodePool of the HostedCluster
-                  and it will be injected into the container runtime of all NodePools.
-                  Changing this value will trigger a rollout for all existing NodePools in the cluster.
-                  Changing the content of the secret inplace will not trigger a rollout and might result in unpredictable behaviour.
+                  This pull secret is included in NodePool ignition/bootstrap payloads and applied to the container runtime when nodes provision.
+                  Changing this value will trigger a rollout for all existing NodePools in the cluster (for both replace and inplace upgrade types).
+                  Updating the referenced Secret's data in place (without changing this reference) does not trigger that rollout.
+                  In AWS and Azure NodePools using the Replace upgrade strategy, the Secret's data in place changes
+                  will still propagate the updated credentials down to the guest cluster and kubelet config.
+                  See https://github.com/openshift/hypershift/blob/3e0e06f78460ac1100dd8432dd7eee4e980a87d0/docs/content/how-to/common/global-pull-secret.md
+                  for details.
                 properties:
                   name:
                     default: ""

api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ExternalOIDC.yaml

@@ -6006,10 +6006,13 @@ spec:
                 description: |-
                   pullSecret is a local reference to a Secret that must have a ".dockerconfigjson" key whose content must be a valid Openshift pull secret JSON.
                   If the reference is set but none of the above requirements are met, the HostedCluster will enter a degraded state.
-                  This pull secret will be part of every payload generated by the controllers for any NodePool of the HostedCluster
-                  and it will be injected into the container runtime of all NodePools.
-                  Changing this value will trigger a rollout for all existing NodePools in the cluster.
-                  Changing the content of the secret inplace will not trigger a rollout and might result in unpredictable behaviour.
+                  This pull secret is included in NodePool ignition/bootstrap payloads and applied to the container runtime when nodes provision.
+                  Changing this value will trigger a rollout for all existing NodePools in the cluster (for both replace and inplace upgrade types).
+                  Updating the referenced Secret's data in place (without changing this reference) does not trigger that rollout.
+                  In AWS and Azure NodePools using the Replace upgrade strategy, the Secret's data in place changes
+                  will still propagate the updated credentials down to the guest cluster and kubelet config.
+                  See https://github.com/openshift/hypershift/blob/3e0e06f78460ac1100dd8432dd7eee4e980a87d0/docs/content/how-to/common/global-pull-secret.md
+                  for details.
                 properties:
                   name:
                     default: ""

api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ExternalOIDCWithUIDAndExtraClaimMappings.yaml

@@ -6146,10 +6146,13 @@ spec:
                 description: |-
                   pullSecret is a local reference to a Secret that must have a ".dockerconfigjson" key whose content must be a valid Openshift pull secret JSON.
                   If the reference is set but none of the above requirements are met, the HostedCluster will enter a degraded state.
-                  This pull secret will be part of every payload generated by the controllers for any NodePool of the HostedCluster
-                  and it will be injected into the container runtime of all NodePools.
-                  Changing this value will trigger a rollout for all existing NodePools in the cluster.
-                  Changing the content of the secret inplace will not trigger a rollout and might result in unpredictable behaviour.
+                  This pull secret is included in NodePool ignition/bootstrap payloads and applied to the container runtime when nodes provision.
+                  Changing this value will trigger a rollout for all existing NodePools in the cluster (for both replace and inplace upgrade types).
+                  Updating the referenced Secret's data in place (without changing this reference) does not trigger that rollout.
+                  In AWS and Azure NodePools using the Replace upgrade strategy, the Secret's data in place changes
+                  will still propagate the updated credentials down to the guest cluster and kubelet config.
+                  See https://github.com/openshift/hypershift/blob/3e0e06f78460ac1100dd8432dd7eee4e980a87d0/docs/content/how-to/common/global-pull-secret.md
+                  for details.
                 properties:
                   name:
                     default: ""

api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ExternalOIDCWithUpstreamParity.yaml

@@ -6127,10 +6127,13 @@ spec:
                 description: |-
                   pullSecret is a local reference to a Secret that must have a ".dockerconfigjson" key whose content must be a valid Openshift pull secret JSON.
                   If the reference is set but none of the above requirements are met, the HostedCluster will enter a degraded state.
-                  This pull secret will be part of every payload generated by the controllers for any NodePool of the HostedCluster
-                  and it will be injected into the container runtime of all NodePools.
-                  Changing this value will trigger a rollout for all existing NodePools in the cluster.
-                  Changing the content of the secret inplace will not trigger a rollout and might result in unpredictable behaviour.
+                  This pull secret is included in NodePool ignition/bootstrap payloads and applied to the container runtime when nodes provision.
+                  Changing this value will trigger a rollout for all existing NodePools in the cluster (for both replace and inplace upgrade types).
+                  Updating the referenced Secret's data in place (without changing this reference) does not trigger that rollout.
+                  In AWS and Azure NodePools using the Replace upgrade strategy, the Secret's data in place changes
+                  will still propagate the updated credentials down to the guest cluster and kubelet config.
+                  See https://github.com/openshift/hypershift/blob/3e0e06f78460ac1100dd8432dd7eee4e980a87d0/docs/content/how-to/common/global-pull-secret.md
+                  for details.
                 properties:
                   name:
                     default: ""

api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/GCPPlatform.yaml

@@ -6093,10 +6093,13 @@ spec:
                 description: |-
                   pullSecret is a local reference to a Secret that must have a ".dockerconfigjson" key whose content must be a valid Openshift pull secret JSON.
                   If the reference is set but none of the above requirements are met, the HostedCluster will enter a degraded state.
-                  This pull secret will be part of every payload generated by the controllers for any NodePool of the HostedCluster
-                  and it will be injected into the container runtime of all NodePools.
-                  Changing this value will trigger a rollout for all existing NodePools in the cluster.
-                  Changing the content of the secret inplace will not trigger a rollout and might result in unpredictable behaviour.
+                  This pull secret is included in NodePool ignition/bootstrap payloads and applied to the container runtime when nodes provision.
+                  Changing this value will trigger a rollout for all existing NodePools in the cluster (for both replace and inplace upgrade types).
+                  Updating the referenced Secret's data in place (without changing this reference) does not trigger that rollout.
+                  In AWS and Azure NodePools using the Replace upgrade strategy, the Secret's data in place changes
+                  will still propagate the updated credentials down to the guest cluster and kubelet config.
+                  See https://github.com/openshift/hypershift/blob/3e0e06f78460ac1100dd8432dd7eee4e980a87d0/docs/content/how-to/common/global-pull-secret.md
+                  for details.
                 properties:
                   name:
                     default: ""

api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/HCPEtcdBackup.yaml

@@ -5738,10 +5738,13 @@ spec:
                 description: |-
                   pullSecret is a local reference to a Secret that must have a ".dockerconfigjson" key whose content must be a valid Openshift pull secret JSON.
                   If the reference is set but none of the above requirements are met, the HostedCluster will enter a degraded state.
-                  This pull secret will be part of every payload generated by the controllers for any NodePool of the HostedCluster
-                  and it will be injected into the container runtime of all NodePools.
-                  Changing this value will trigger a rollout for all existing NodePools in the cluster.
-                  Changing the content of the secret inplace will not trigger a rollout and might result in unpredictable behaviour.
+                  This pull secret is included in NodePool ignition/bootstrap payloads and applied to the container runtime when nodes provision.
+                  Changing this value will trigger a rollout for all existing NodePools in the cluster (for both replace and inplace upgrade types).
+                  Updating the referenced Secret's data in place (without changing this reference) does not trigger that rollout.
+                  In AWS and Azure NodePools using the Replace upgrade strategy, the Secret's data in place changes
+                  will still propagate the updated credentials down to the guest cluster and kubelet config.
+                  See https://github.com/openshift/hypershift/blob/3e0e06f78460ac1100dd8432dd7eee4e980a87d0/docs/content/how-to/common/global-pull-secret.md
+                  for details.
                 properties:
                   name:
                     default: ""