fix(hcco): OCPBUGS-84939: [release-4.21] add CP pull-secret watches for in-place propagation

Add watches on the pull-secret in the control plane namespace so that
changes are propagated in-place without requiring a rollout. This
includes setting up a global pull-secret controller and ensuring
resources are updated when the pull-secret changes.

Author: enxebre

api/hypershift/v1beta1/hostedcluster_types.go

@@ -652,10 +652,11 @@ type HostedClusterSpec struct {
 	// pullSecret is a local reference to a Secret that must have a ".dockerconfigjson" key whose content must be a valid Openshift pull secret JSON.
 	// If the reference is set but none of the above requirements are met, the HostedCluster will enter a degraded state.
 	// TODO(alberto): Signal this in a condition.
-	// This pull secret will be part of every payload generated by the controllers for any NodePool of the HostedCluster
-	// and it will be injected into the container runtime of all NodePools.
-	// Changing this value will trigger a rollout for all existing NodePools in the cluster.
-	// Changing the content of the secret inplace will not trigger a rollout and might result in unpredictable behaviour.
+	// This pull secret is included in NodePool ignition/bootstrap payloads and applied to the container runtime when nodes provision.
+	// Changing this value will trigger a rollout for all existing NodePools in the cluster (for both replace and inplace upgrade types).
+	// Updating the referenced Secret's data in place (without changing this reference) does not trigger that rollout.
+	// In AWS and Azure NodePools using the Replace upgrade strategy, the Secret's data in place changes
+	// will still propagate the updated credentials down to the guest cluster and kubelet config.
 	// +required
 	// +rollout
 	// TODO(alberto): have our own local reference type to include our opinions and avoid transparent changes.

api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/AAA_ungated.yaml

@@ -5359,10 +5359,11 @@ spec:
                 description: |-
                   pullSecret is a local reference to a Secret that must have a ".dockerconfigjson" key whose content must be a valid Openshift pull secret JSON.
                   If the reference is set but none of the above requirements are met, the HostedCluster will enter a degraded state.
-                  This pull secret will be part of every payload generated by the controllers for any NodePool of the HostedCluster
-                  and it will be injected into the container runtime of all NodePools.
-                  Changing this value will trigger a rollout for all existing NodePools in the cluster.
-                  Changing the content of the secret inplace will not trigger a rollout and might result in unpredictable behaviour.
+                  This pull secret is included in NodePool ignition/bootstrap payloads and applied to the container runtime when nodes provision.
+                  Changing this value will trigger a rollout for all existing NodePools in the cluster (for both replace and inplace upgrade types).
+                  Updating the referenced Secret's data in place (without changing this reference) does not trigger that rollout.
+                  In AWS and Azure NodePools using the Replace upgrade strategy, the Secret's data in place changes
+                  will still propagate the updated credentials down to the guest cluster and kubelet config.
                 properties:
                   name:
                     default: ""

api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/AutoNodeKarpenter.yaml

@@ -5389,10 +5389,11 @@ spec:
                 description: |-
                   pullSecret is a local reference to a Secret that must have a ".dockerconfigjson" key whose content must be a valid Openshift pull secret JSON.
                   If the reference is set but none of the above requirements are met, the HostedCluster will enter a degraded state.
-                  This pull secret will be part of every payload generated by the controllers for any NodePool of the HostedCluster
-                  and it will be injected into the container runtime of all NodePools.
-                  Changing this value will trigger a rollout for all existing NodePools in the cluster.
-                  Changing the content of the secret inplace will not trigger a rollout and might result in unpredictable behaviour.
+                  This pull secret is included in NodePool ignition/bootstrap payloads and applied to the container runtime when nodes provision.
+                  Changing this value will trigger a rollout for all existing NodePools in the cluster (for both replace and inplace upgrade types).
+                  Updating the referenced Secret's data in place (without changing this reference) does not trigger that rollout.
+                  In AWS and Azure NodePools using the Replace upgrade strategy, the Secret's data in place changes
+                  will still propagate the updated credentials down to the guest cluster and kubelet config.
                 properties:
                   name:
                     default: ""

api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ClusterVersionOperatorConfiguration.yaml

@@ -5362,10 +5362,11 @@ spec:
                 description: |-
                   pullSecret is a local reference to a Secret that must have a ".dockerconfigjson" key whose content must be a valid Openshift pull secret JSON.
                   If the reference is set but none of the above requirements are met, the HostedCluster will enter a degraded state.
-                  This pull secret will be part of every payload generated by the controllers for any NodePool of the HostedCluster
-                  and it will be injected into the container runtime of all NodePools.
-                  Changing this value will trigger a rollout for all existing NodePools in the cluster.
-                  Changing the content of the secret inplace will not trigger a rollout and might result in unpredictable behaviour.
+                  This pull secret is included in NodePool ignition/bootstrap payloads and applied to the container runtime when nodes provision.
+                  Changing this value will trigger a rollout for all existing NodePools in the cluster (for both replace and inplace upgrade types).
+                  Updating the referenced Secret's data in place (without changing this reference) does not trigger that rollout.
+                  In AWS and Azure NodePools using the Replace upgrade strategy, the Secret's data in place changes
+                  will still propagate the updated credentials down to the guest cluster and kubelet config.
                 properties:
                   name:
                     default: ""

api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ExternalOIDC.yaml

@@ -5699,10 +5699,11 @@ spec:
                 description: |-
                   pullSecret is a local reference to a Secret that must have a ".dockerconfigjson" key whose content must be a valid Openshift pull secret JSON.
                   If the reference is set but none of the above requirements are met, the HostedCluster will enter a degraded state.
-                  This pull secret will be part of every payload generated by the controllers for any NodePool of the HostedCluster
-                  and it will be injected into the container runtime of all NodePools.
-                  Changing this value will trigger a rollout for all existing NodePools in the cluster.
-                  Changing the content of the secret inplace will not trigger a rollout and might result in unpredictable behaviour.
+                  This pull secret is included in NodePool ignition/bootstrap payloads and applied to the container runtime when nodes provision.
+                  Changing this value will trigger a rollout for all existing NodePools in the cluster (for both replace and inplace upgrade types).
+                  Updating the referenced Secret's data in place (without changing this reference) does not trigger that rollout.
+                  In AWS and Azure NodePools using the Replace upgrade strategy, the Secret's data in place changes
+                  will still propagate the updated credentials down to the guest cluster and kubelet config.
                 properties:
                   name:
                     default: ""

api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ExternalOIDCWithUIDAndExtraClaimMappings.yaml

@@ -5853,10 +5853,11 @@ spec:
                 description: |-
                   pullSecret is a local reference to a Secret that must have a ".dockerconfigjson" key whose content must be a valid Openshift pull secret JSON.
                   If the reference is set but none of the above requirements are met, the HostedCluster will enter a degraded state.
-                  This pull secret will be part of every payload generated by the controllers for any NodePool of the HostedCluster
-                  and it will be injected into the container runtime of all NodePools.
-                  Changing this value will trigger a rollout for all existing NodePools in the cluster.
-                  Changing the content of the secret inplace will not trigger a rollout and might result in unpredictable behaviour.
+                  This pull secret is included in NodePool ignition/bootstrap payloads and applied to the container runtime when nodes provision.
+                  Changing this value will trigger a rollout for all existing NodePools in the cluster (for both replace and inplace upgrade types).
+                  Updating the referenced Secret's data in place (without changing this reference) does not trigger that rollout.
+                  In AWS and Azure NodePools using the Replace upgrade strategy, the Secret's data in place changes
+                  will still propagate the updated credentials down to the guest cluster and kubelet config.
                 properties:
                   name:
                     default: ""

api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/GCPPlatform.yaml

@@ -5641,10 +5641,11 @@ spec:
                 description: |-
                   pullSecret is a local reference to a Secret that must have a ".dockerconfigjson" key whose content must be a valid Openshift pull secret JSON.
                   If the reference is set but none of the above requirements are met, the HostedCluster will enter a degraded state.
-                  This pull secret will be part of every payload generated by the controllers for any NodePool of the HostedCluster
-                  and it will be injected into the container runtime of all NodePools.
-                  Changing this value will trigger a rollout for all existing NodePools in the cluster.
-                  Changing the content of the secret inplace will not trigger a rollout and might result in unpredictable behaviour.
+                  This pull secret is included in NodePool ignition/bootstrap payloads and applied to the container runtime when nodes provision.
+                  Changing this value will trigger a rollout for all existing NodePools in the cluster (for both replace and inplace upgrade types).
+                  Updating the referenced Secret's data in place (without changing this reference) does not trigger that rollout.
+                  In AWS and Azure NodePools using the Replace upgrade strategy, the Secret's data in place changes
+                  will still propagate the updated credentials down to the guest cluster and kubelet config.
                 properties:
                   name:
                     default: ""

api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/HyperShiftOnlyDynamicResourceAllocation.yaml

@@ -5364,10 +5364,11 @@ spec:
                 description: |-
                   pullSecret is a local reference to a Secret that must have a ".dockerconfigjson" key whose content must be a valid Openshift pull secret JSON.
                   If the reference is set but none of the above requirements are met, the HostedCluster will enter a degraded state.
-                  This pull secret will be part of every payload generated by the controllers for any NodePool of the HostedCluster
-                  and it will be injected into the container runtime of all NodePools.
-                  Changing this value will trigger a rollout for all existing NodePools in the cluster.
-                  Changing the content of the secret inplace will not trigger a rollout and might result in unpredictable behaviour.
+                  This pull secret is included in NodePool ignition/bootstrap payloads and applied to the container runtime when nodes provision.
+                  Changing this value will trigger a rollout for all existing NodePools in the cluster (for both replace and inplace upgrade types).
+                  Updating the referenced Secret's data in place (without changing this reference) does not trigger that rollout.
+                  In AWS and Azure NodePools using the Replace upgrade strategy, the Secret's data in place changes
+                  will still propagate the updated credentials down to the guest cluster and kubelet config.
                 properties:
                   name:
                     default: ""

api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ImageStreamImportMode.yaml

@@ -5360,10 +5360,11 @@ spec:
                 description: |-
                   pullSecret is a local reference to a Secret that must have a ".dockerconfigjson" key whose content must be a valid Openshift pull secret JSON.
                   If the reference is set but none of the above requirements are met, the HostedCluster will enter a degraded state.
-                  This pull secret will be part of every payload generated by the controllers for any NodePool of the HostedCluster
-                  and it will be injected into the container runtime of all NodePools.
-                  Changing this value will trigger a rollout for all existing NodePools in the cluster.
-                  Changing the content of the secret inplace will not trigger a rollout and might result in unpredictable behaviour.
+                  This pull secret is included in NodePool ignition/bootstrap payloads and applied to the container runtime when nodes provision.
+                  Changing this value will trigger a rollout for all existing NodePools in the cluster (for both replace and inplace upgrade types).
+                  Updating the referenced Secret's data in place (without changing this reference) does not trigger that rollout.
+                  In AWS and Azure NodePools using the Replace upgrade strategy, the Secret's data in place changes
+                  will still propagate the updated credentials down to the guest cluster and kubelet config.
                 properties:
                   name:
                     default: ""

api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/KMSEncryptionProvider.yaml

@@ -5418,10 +5418,11 @@ spec:
                 description: |-
                   pullSecret is a local reference to a Secret that must have a ".dockerconfigjson" key whose content must be a valid Openshift pull secret JSON.
                   If the reference is set but none of the above requirements are met, the HostedCluster will enter a degraded state.
-                  This pull secret will be part of every payload generated by the controllers for any NodePool of the HostedCluster
-                  and it will be injected into the container runtime of all NodePools.
-                  Changing this value will trigger a rollout for all existing NodePools in the cluster.
-                  Changing the content of the secret inplace will not trigger a rollout and might result in unpredictable behaviour.
+                  This pull secret is included in NodePool ignition/bootstrap payloads and applied to the container runtime when nodes provision.
+                  Changing this value will trigger a rollout for all existing NodePools in the cluster (for both replace and inplace upgrade types).
+                  Updating the referenced Secret's data in place (without changing this reference) does not trigger that rollout.
+                  In AWS and Azure NodePools using the Replace upgrade strategy, the Secret's data in place changes
+                  will still propagate the updated credentials down to the guest cluster and kubelet config.
                 properties:
                   name:
                     default: ""