Remove await_change

As per kube-rs docs, await_change is unadvisable for cases where
eventual consistency is desired because reconcile events can be lost
occasionally. We saw this happen in tests where owned resources with
finalizers stayed behind after TEC deletion.

Instead, requeue after 1 minute (ongoing deletion cases) or 5
minutes (resources applied cases). This is shorter than kube-rs's
"sane default" of 60 minutes, but aligns better with testing, user
expectations, and is also what KubeVirt appears to be doing.

Signed-off-by: Jakob Naucke <jnaucke@redhat.com>

Author: Jakob-Naucke

operator/src/reference_values.rs

@@ -291,7 +291,7 @@ async fn image_add_reconcile(
     }
 
     let (action, reason) = match handle_new_image(client.clone(), image).await {
-        Ok(reason) => (Action::await_change(), reason),
+        Ok(reason) => (Action::requeue(Duration::from_secs(300)), reason),
         Err(e) => {
             warn!("PCR computation for {name} failed: {e}");
             let action = Action::requeue(Duration::from_secs(60));
@@ -320,7 +320,7 @@ async fn image_remove_reconcile(
     let name = image.metadata.name.as_ref().unwrap_or(&default);
     if cluster.is_none() {
         info!("No TrustedExecutionCluster found, skipping disallow_image for {name}");
-        return Ok(Action::await_change());
+        return Ok(Action::requeue(Duration::from_secs(60)));
     }
     let cluster = cluster.unwrap();
     let tec_name = cluster.metadata.name.unwrap_or("<no name>".to_string());
@@ -329,10 +329,10 @@ async fn image_remove_reconcile(
             "TrustedExecutionCluster {tec_name} is being deleted, \
              skipping disallow_image for {name}"
         );
-        return Ok(Action::await_change());
+        return Ok(Action::requeue(Duration::from_secs(60)));
     }
     disallow_image(client, name).await?;
-    Ok(Action::await_change())
+    Ok(Action::requeue(Duration::from_secs(60)))
 }
 
 pub async fn launch_rv_image_controller(client: Client) {

operator/src/register_server.rs

@@ -20,7 +20,7 @@ use kube::runtime::{
 };
 use kube::{Api, Client, Resource};
 use log::info;
-use std::{collections::BTreeMap, sync::Arc};
+use std::{collections::BTreeMap, sync::Arc, time::Duration};
 
 use crate::trustee;
 use operator::*;
@@ -142,7 +142,7 @@ async fn keygen_reconcile(
                     trustee::mount_secret(kube_client, id).await
                 }
                 .await
-                .map(|_| Action::await_change())
+                .map(|_| Action::requeue(Duration::from_secs(300)))
                 .map_err(|e| finalizer::Error::<ControllerError>::ApplyFailed(e.into()))
             }
             Event::Cleanup(machine) => {
@@ -168,7 +168,7 @@ async fn keygen_reconcile(
                                      skipping unmount_secret for Machine {}",
                                 machine.metadata.name.as_deref().unwrap_or("unknown")
                             );
-                            return Ok(Action::await_change());
+                            return Ok(Action::requeue(Duration::from_secs(60)));
                         }
                         Err(kube::Error::Api(ae)) if ae.code == 404 => {
                             // TEC already deleted, skip unmount_secret
@@ -177,7 +177,7 @@ async fn keygen_reconcile(
                                      skipping unmount_secret for Machine {}",
                                 machine.metadata.name.as_deref().unwrap_or("unknown")
                             );
-                            return Ok(Action::await_change());
+                            return Ok(Action::requeue(Duration::from_secs(60)));
                         }
                         _ => {
                             // TEC exists and is not being deleted, proceed with unmount_secret
@@ -187,7 +187,7 @@ async fn keygen_reconcile(
 
                 trustee::unmount_secret(kube_client, id)
                     .await
-                    .map(|_| Action::await_change())
+                    .map(|_| Action::requeue(Duration::from_secs(60)))
                     .map_err(|e| finalizer::Error::<ControllerError>::CleanupFailed(e.into()))
             }
         }