fix(nodepool): watch cloud config ConfigMaps for convergence

Cloud config ConfigMap changes (azure-cloud-config, openstack-cloud-config)
in the control plane namespace were not triggering nodepool reconciliation.
The existing enqueueNodePoolsForConfig handler lists NodePools in the
ConfigMap's namespace, but cloud config CMs live in the CP namespace while
NodePools live in the management namespace.

Add a dedicated watch handler that resolves CP namespace -> HostedCluster
-> NodePools via the HostedControlPlane annotation, with a name predicate
to short-circuit irrelevant ConfigMap events.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: twolff-gh

hypershift-operator/controllers/nodepool/nodepool_controller.go

@@ -51,6 +51,7 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/controller"
 	"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
 	"sigs.k8s.io/controller-runtime/pkg/handler"
+	"sigs.k8s.io/controller-runtime/pkg/predicate"
 	"sigs.k8s.io/controller-runtime/pkg/reconcile"
 
 	"github.com/blang/semver"
@@ -143,6 +144,10 @@ func (r *NodePoolReconciler) SetupWithManager(mgr ctrl.Manager) error {
 		Watches(&corev1.Secret{}, handler.EnqueueRequestsFromMapFunc(enqueueParentNodePool), builder.WithPredicates(supportutil.PredicatesForHostedClusterAnnotationScoping(mgr.GetClient()))).
 		// We want to reconcile when the ConfigMaps referenced by the spec.config and also the core ones change.
 		Watches(&corev1.ConfigMap{}, handler.EnqueueRequestsFromMapFunc(r.enqueueNodePoolsForConfig), builder.WithPredicates(supportutil.PredicatesForHostedClusterAnnotationScoping(mgr.GetClient()))).
+		// We want to reconcile when cloud provider config ConfigMaps change in the control plane namespace.
+		Watches(&corev1.ConfigMap{}, handler.EnqueueRequestsFromMapFunc(r.enqueueNodePoolsForCloudConfig), builder.WithPredicates(predicate.NewPredicateFuncs(func(obj client.Object) bool {
+			return obj.GetName() == "azure-cloud-config" || obj.GetName() == "openstack-cloud-config"
+		}))).
 		WithOptions(controller.Options{
 			RateLimiter:             workqueue.NewTypedItemExponentialFailureRateLimiter[reconcile.Request](1*time.Second, 10*time.Second),
 			MaxConcurrentReconciles: 10,
@@ -956,6 +961,33 @@ func (r *NodePoolReconciler) enqueueNodePoolsForConfig(ctx context.Context, obj
 	return result
 }
 
+func (r *NodePoolReconciler) enqueueNodePoolsForCloudConfig(ctx context.Context, obj client.Object) []reconcile.Request {
+	hcpList := &hyperv1.HostedControlPlaneList{}
+	if err := r.List(ctx, hcpList, client.InNamespace(obj.GetNamespace())); err != nil || len(hcpList.Items) == 0 {
+		return nil
+	}
+	hcName, ok := hcpList.Items[0].Annotations[k8sutil.HostedClusterAnnotation]
+	if !ok {
+		return nil
+	}
+	hc := supportutil.ParseNamespacedName(hcName)
+
+	nodePoolList := &hyperv1.NodePoolList{}
+	if err := r.List(ctx, nodePoolList, client.InNamespace(hc.Namespace)); err != nil {
+		return nil
+	}
+
+	var result []reconcile.Request
+	for i := range nodePoolList.Items {
+		if nodePoolList.Items[i].Spec.ClusterName == hc.Name {
+			result = append(result, reconcile.Request{
+				NamespacedName: client.ObjectKeyFromObject(&nodePoolList.Items[i]),
+			})
+		}
+	}
+	return result
+}
+
 // getNodePoolNamespace returns the namespaced name of a NodePool, given the NodePools name
 // and the control plane namespace name for the hosted cluster that this NodePool is a part of.
 func (r *NodePoolReconciler) getNodePoolNamespacedName(nodePoolName string, controlPlaneNamespace string) (types.NamespacedName, error) {

hypershift-operator/controllers/nodepool/nodepool_controller_test.go

@@ -3747,3 +3747,128 @@ func TestNodePoolReconciler_reconcile(t *testing.T) {
 		})
 	}
 }
+
+func TestEnqueueNodePoolsForCloudConfig(t *testing.T) {
+	t.Parallel()
+	hcNamespace := "clusters"
+	hcName := "my-cluster"
+	cpNamespace := "clusters-my-cluster"
+
+	hcp := &hyperv1.HostedControlPlane{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      hcName,
+			Namespace: cpNamespace,
+			Annotations: map[string]string{
+				k8sutil.HostedClusterAnnotation: hcNamespace + "/" + hcName,
+			},
+		},
+	}
+
+	matchingNodePool := &hyperv1.NodePool{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "np-1",
+			Namespace: hcNamespace,
+		},
+		Spec: hyperv1.NodePoolSpec{
+			ClusterName: hcName,
+		},
+	}
+
+	unrelatedNodePool := &hyperv1.NodePool{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "np-other",
+			Namespace: hcNamespace,
+		},
+		Spec: hyperv1.NodePoolSpec{
+			ClusterName: "other-cluster",
+		},
+	}
+
+	testCases := []struct {
+		name     string
+		cm       *corev1.ConfigMap
+		objects  []client.Object
+		expected []reconcile.Request
+	}{
+		{
+			name: "When azure-cloud-config changes, it should enqueue matching NodePools",
+			cm: &corev1.ConfigMap{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:      "azure-cloud-config",
+					Namespace: cpNamespace,
+				},
+			},
+			objects: []client.Object{hcp, matchingNodePool, unrelatedNodePool},
+			expected: []reconcile.Request{
+				{NamespacedName: types.NamespacedName{Name: "np-1", Namespace: hcNamespace}},
+			},
+		},
+		{
+			name: "When openstack-cloud-config changes, it should enqueue matching NodePools",
+			cm: &corev1.ConfigMap{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:      "openstack-cloud-config",
+					Namespace: cpNamespace,
+				},
+			},
+			objects: []client.Object{hcp, matchingNodePool},
+			expected: []reconcile.Request{
+				{NamespacedName: types.NamespacedName{Name: "np-1", Namespace: hcNamespace}},
+			},
+		},
+		{
+			name: "When no HostedControlPlane exists in the namespace, it should return nil",
+			cm: &corev1.ConfigMap{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:      "azure-cloud-config",
+					Namespace: cpNamespace,
+				},
+			},
+			objects:  []client.Object{matchingNodePool},
+			expected: nil,
+		},
+		{
+			name: "When HostedControlPlane has no cluster annotation, it should return nil",
+			cm: &corev1.ConfigMap{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:      "azure-cloud-config",
+					Namespace: cpNamespace,
+				},
+			},
+			objects: []client.Object{
+				&hyperv1.HostedControlPlane{
+					ObjectMeta: metav1.ObjectMeta{
+						Name:      hcName,
+						Namespace: cpNamespace,
+					},
+				},
+				matchingNodePool,
+			},
+			expected: nil,
+		},
+		{
+			name: "When no NodePools match the HostedCluster, it should return empty",
+			cm: &corev1.ConfigMap{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:      "azure-cloud-config",
+					Namespace: cpNamespace,
+				},
+			},
+			objects:  []client.Object{hcp, unrelatedNodePool},
+			expected: nil,
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+			g := NewWithT(t)
+
+			c := fake.NewClientBuilder().WithScheme(api.Scheme).WithObjects(tc.objects...).Build()
+			r := &NodePoolReconciler{Client: c}
+
+			result := r.enqueueNodePoolsForCloudConfig(context.Background(), tc.cm)
+			g.Expect(result).To(Equal(tc.expected))
+		})
+	}
+}