WIP: Sync ClusterDeployment Unreachable condition to managedcluster for UI/Console to leverage.

[xuezhaojun]

Jira: https://issues.redhat.com/browse/ACM-16340

The source condition is from: https://github.com/openshift/hive/blob/a428d219e9fb59937d9b7e847f8d921ffb7b59a8/apis/hive/v1/clusterdeployment_types.go#L426

The controller in hive maintain this condition: https://github.com/openshift/hive/blob/a428d219e9fb59937d9b7e847f8d921ffb7b59a8/pkg/controller/unreachable/unreachable_controller.go#L277

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: xuezhaojun

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [xuezhaojun]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[xuezhaojun]

/assign @qiujian16
/assign @elgnay

Request for the review to confirm the direction of this solution is right.

[sonarqubecloud]

Quality Gate failed

Failed conditions
26.1% Coverage on New Code (required ≥ 70%)

See analysis details on SonarQube Cloud

[openshift-ci]

@xuezhaojun: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/sonar-pre-submit	a35eccc	link	true	/test sonar-pre-submit

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[elgnay]

I have two comments in general:

• Perhaps the ocm-controller is a better component to run this new controller;
• Unreachable condition from Hive might include information beyond our expectation. What we expected is to have a condition to indicate if the admin-kubeconfig of the managed cluster is invalid or not.

[xuezhaojun]

I have two comments in general:

• Perhaps the ocm-controller is a better component to run this new controller;
• Unreachable condition from Hive might include information beyond our expectation. What we expected is to have a condition to indicate if the admin-kubeconfig of the managed cluster is invalid or not.

Thanks for the review!

---

I checked the ocm-controller's controllers, it doesn't have a specific controller that handles the clusterdeployment resource.

The most close one is under the /clusterset folder:

• https://github.com/stolostron/multicloud-operators-foundation/blob/647e6993139536191a417f4f6d9e7a2b6074bbf3/pkg/controllers/clusterset/clusterdeployment/clusterdeployment_controller.go

Comparing with the import-controller, the path of the controller only has a the /clusterdeployment:

• https://github.com/stolostron/managedcluster-import-controller/blob/main/pkg/controller/clusterdeployment/clusterdeployment_controller.go

That's why I believe import-controller is more relate to this feature.

---

Because the CA update happens on the agent side, so to check the valid of the admin-kubeconfig secret, we need to implement the polling strategy on the hub side.

In hive, they use a DelayingReconciler to check valid status every 1000 seconds.

And hive also ensure the performance at scale by using the MaxConcurrentReconciles and some hard code retry logic e.g. maxUnreachableDuration

If we want to do the same valid check, we need to introduce these complixities to our repo and consider the performance issue as well.

So to me, I prefer, for the first step, we only do syncing the condition to managed cluster to let console have something to display. If customer like the feature and use it a lot, then we put effort to enhance it.