fix: set ownerRef on imageRegistry and globalMirror secrets

Author: dkoshkin

pkg/handlers/generic/mutation/imageregistries/credentials/inject.go

@@ -28,6 +28,7 @@ import (
 	"github.com/nutanix-cloud-native/cluster-api-runtime-extensions-nutanix/common/pkg/k8s/client"
 	"github.com/nutanix-cloud-native/cluster-api-runtime-extensions-nutanix/pkg/handlers/generic/mutation/imageregistries"
 	"github.com/nutanix-cloud-native/cluster-api-runtime-extensions-nutanix/pkg/handlers/generic/mutation/mirrors"
+	handlersutils "github.com/nutanix-cloud-native/cluster-api-runtime-extensions-nutanix/pkg/handlers/utils"
 )
 
 type imageRegistriesPatchHandler struct {
@@ -99,6 +100,15 @@ func (h *imageRegistriesPatchHandler) Mutate(
 		return globalMirrorErr
 	}
 
+	cluster, err := clusterGetter(ctx)
+	if err != nil {
+		log.Error(
+			err,
+			"failed to get cluster from Image Registry Credentials mutation handler",
+		)
+		return err
+	}
+
 	registriesWithOptionalCredentials := make([]providerConfig, 0, len(imageRegistries))
 	for _, imageRegistry := range imageRegistries {
 		registryWithOptionalCredentials, generateErr := registryWithOptionalCredentialsFromImageRegistryCredentials(
@@ -115,6 +125,23 @@ func (h *imageRegistriesPatchHandler) Mutate(
 			registriesWithOptionalCredentials,
 			registryWithOptionalCredentials,
 		)
+
+		if secretName := secretNameForImageRegistryCredentials(imageRegistry.Credentials); secretName != "" {
+			// Ensure the Secret is owned by the Cluster so it is correctly moved and deleted with the Cluster.
+			// This code assumes that Secret exists and that was validated before calling this function.
+			err := handlersutils.EnsureOwnerRefForSecret(
+				ctx,
+				h.client,
+				secretName,
+				cluster,
+			)
+			if err != nil {
+				return fmt.Errorf(
+					"error updating owner references on image registry Secret: %w",
+					err,
+				)
+			}
+		}
 	}
 
 	if globalMirrorErr == nil {
@@ -131,6 +158,23 @@ func (h *imageRegistriesPatchHandler) Mutate(
 			registriesWithOptionalCredentials,
 			mirrorCredentials,
 		)
+
+		if secretName := secretNameForImageRegistryCredentials(globalMirror.Credentials); secretName != "" {
+			// Ensure the Secret is owned by the Cluster so it is correctly moved and deleted with the Cluster.
+			// This code assumes that Secret exists and that was validated before calling this function.
+			err := handlersutils.EnsureOwnerRefForSecret(
+				ctx,
+				h.client,
+				secretName,
+				cluster,
+			)
+			if err != nil {
+				return fmt.Errorf(
+					"error updating owner references on global mirror Secret: %w",
+					err,
+				)
+			}
+		}
 	}
 
 	needCredentials, err := needImageRegistryCredentialsConfiguration(
@@ -173,15 +217,6 @@ func (h *imageRegistriesPatchHandler) Mutate(
 				commands...,
 			)
 
-			cluster, err := clusterGetter(ctx)
-			if err != nil {
-				log.Error(
-					err,
-					"failed to get cluster from Image Registry Credentials mutation handler",
-				)
-				return err
-			}
-
 			generateErr = createSecretIfNeeded(ctx, h.client, registriesWithOptionalCredentials, cluster)
 			if generateErr != nil {
 				return generateErr
@@ -226,15 +261,6 @@ func (h *imageRegistriesPatchHandler) Mutate(
 			).Info("adding PreKubeadmCommands to worker node kubeadm config template")
 			obj.Spec.Template.Spec.PreKubeadmCommands = append(obj.Spec.Template.Spec.PreKubeadmCommands, commands...)
 
-			cluster, err := clusterGetter(ctx)
-			if err != nil {
-				log.Error(
-					err,
-					"failed to get cluster from Image Registry Credentials mutation handler",
-				)
-				return err
-			}
-
 			generateErr := createSecretIfNeeded(ctx, h.client, registriesWithOptionalCredentials, cluster)
 			if generateErr != nil {
 				return generateErr
@@ -390,12 +416,13 @@ func secretForImageRegistryCredentials(
 	credentials *v1alpha1.RegistryCredentials,
 	objectNamespace string,
 ) (*corev1.Secret, error) {
-	if credentials == nil || credentials.SecretRef == nil {
+	name := secretNameForImageRegistryCredentials(credentials)
+	if name == "" {
 		return nil, nil
 	}
 
 	key := ctrlclient.ObjectKey{
-		Name:      credentials.SecretRef.Name,
+		Name:      name,
 		Namespace: objectNamespace,
 	}
 	secret := &corev1.Secret{}
@@ -434,3 +461,12 @@ func needImageRegistryCredentialsConfiguration(configs []providerConfig) (bool,
 
 	return true, nil
 }
+
+// secretForImageRegistryCredentials returns the name of the Secret for the given RegistryCredentials.
+// Returns an empty string if the credentials or secret field is empty.
+func secretNameForImageRegistryCredentials(credentials *v1alpha1.RegistryCredentials) string {
+	if credentials == nil || credentials.SecretRef == nil || credentials.SecretRef.Name == "" {
+		return ""
+	}
+	return credentials.SecretRef.Name
+}