fix(hcco): OCPBUGS-88738 clean up orphaned mirrored CMs on NodePool deletion

The guard added in PR #8672 unconditionally skips deletion of guest-side
ConfigMaps with NTOMirroredConfigLabel, preventing spurious MCO rollouts
when the source CM is transiently absent. However, this also preserves
CMs whose owning NodePool has been permanently deleted.

Derive NodePool existence from the wantCMList already fetched from the
HCP namespace: when a NodePool is deleted, its finalizer removes all its
CMs, so zero CMs for a given NodePool means it has been deleted. Build
an activeNodePools set and only skip deletion when the owning NodePool
is still active.

Signed-off-by: Vimal Solanki <vsolanki@redhat.com>

Author: vsolanki12

control-plane-operator/hostedclusterconfigoperator/controllers/resources/resources.go

@@ -3016,6 +3016,20 @@ func (r *reconciler) reconcileKubeletConfig(ctx context.Context) error {
 	for _, cm := range wantCMList.Items {
 		want.Insert(cm.Name)
 	}
+	// Derive which NodePools are still active from CMs in the HCP namespace.
+	// When a NodePool is deleted, its finalizer removes all its CMs from the HCP namespace,
+	// so zero CMs for a given NodePool means it has been deleted.
+	// Note: a narrow race exists for a NodePool with exactly one immutable kubelet-config CM
+	// during the one-time immutable-to-mutable migration — the NodePool controller briefly
+	// deletes the CM before recreating it. If HCCO reconciles in that window the NodePool
+	// appears inactive. This is acceptable: the window is milliseconds, the migration is a
+	// one-time event, and the guest CM would be recreated on the next reconcile.
+	activeNodePools := set.Set[string]{}
+	for _, cm := range wantCMList.Items {
+		if npName := cm.Labels[hyperv1.NodePoolLabel]; npName != "" {
+			activeNodePools.Insert(npName)
+		}
+	}
 	for _, cm := range wantCMList.Items {
 		hostedClusterCM := &corev1.ConfigMap{
 			ObjectMeta: metav1.ObjectMeta{
@@ -3059,16 +3073,21 @@ func (r *reconciler) reconcileKubeletConfig(ctx context.Context) error {
 		}
 		// Mirrored CMs have a source in the HCP namespace managed by the NodePool controller.
 		// During delete+recreate migrations or transient API errors the source can be briefly
-		// absent. Deleting the guest copy here would cause NTO to regenerate MachineConfigs
-		// without it, triggering MCO node rollouts. If the source is permanently removed
-		// (e.g. NodePool deletion), the orphaned guest CM is harmless and will be cleaned up
-		// when the HostedCluster is deleted.
-		// TODO(OCPBUGS-88738): check whether the owning NodePool (via NodePoolLabel) still exists
-		// before unconditionally skipping, to allow cleanup of truly orphaned CMs.
+		// absent. Deleting the guest copy would cause NTO to regenerate MachineConfigs
+		// without it, triggering MCO node rollouts. However, if the owning NodePool has been
+		// deleted, its finalizer has already removed all its CMs from the HCP namespace, so
+		// the guest copy is orphaned and safe to delete.
 		if cm.Labels[nodepool.NTOMirroredConfigLabel] == "true" {
-			log.Info("skipping deletion of mirrored ConfigMap; source may be transiently absent or permanently removed after NodePool deletion",
-				"configMap", client.ObjectKeyFromObject(cm).String())
-			continue
+			npName := cm.Labels[hyperv1.NodePoolLabel]
+			// Defensive: if the CM has no NodePoolLabel, we cannot determine whether
+			// its owning NodePool still exists; preserve it to avoid spurious rollouts.
+			if npName == "" || activeNodePools.Has(npName) {
+				log.Info("skipping deletion of mirrored ConfigMap; source transiently absent but owning NodePool still active",
+					"configMap", client.ObjectKeyFromObject(cm).String())
+				continue
+			}
+			log.Info("deleting orphaned mirrored ConfigMap; owning NodePool no longer exists",
+				"configMap", client.ObjectKeyFromObject(cm).String(), "nodePool", npName)
 		}
 		log.Info("delete mirror config ConfigMap", "config", client.ObjectKeyFromObject(cm).String())
 		if _, err := k8sutil.DeleteIfNeeded(ctx, r.client, cm); err != nil {

control-plane-operator/hostedclusterconfigoperator/controllers/resources/resources_test.go

@@ -1649,13 +1649,21 @@ func TestReconcileKubeletConfig(t *testing.T) {
 			},
 		},
 		{
-			name:                      "When source CM is transiently absent, it should not delete the mirrored guest-side CM",
-			hostedControlPlaneObjects: []client.Object{},
+			// NodePool still active (another CM exists in HCP namespace with the same NodePoolLabel),
+			// but this particular source CM is transiently absent — preserve the guest copy.
+			name: "When source CM is transiently absent, it should not delete the mirrored guest-side CM",
+			hostedControlPlaneObjects: []client.Object{
+				// Another CM for the same NodePool proves it is still active.
+				makeMirroredKubeletConfigConfigMap(netutil.ShortenName("baz", npName1, validation.LabelValueMaxLength), hcpNamespace, npName1, kubeletConfig1),
+			},
 			existHostedControlPlaneObjects: []client.Object{
 				makeMirroredKubeletConfigConfigMap(netutil.ShortenName("bar", npName1, validation.LabelValueMaxLength), hcNamespace, npName1, kubeletConfig1),
+				// The "baz" CM is expected on the guest side too (reconciled from the HCP-namespace source above).
+				makeMirroredKubeletConfigConfigMap(netutil.ShortenName("baz", npName1, validation.LabelValueMaxLength), hcNamespace, npName1, kubeletConfig1),
 			},
 			expectedHostedClusterObjects: []client.Object{
 				makeMirroredKubeletConfigConfigMap(netutil.ShortenName("bar", npName1, validation.LabelValueMaxLength), hcNamespace, npName1, kubeletConfig1),
+				makeMirroredKubeletConfigConfigMap(netutil.ShortenName("baz", npName1, validation.LabelValueMaxLength), hcNamespace, npName1, kubeletConfig1),
 			},
 		},
 		{
@@ -1667,6 +1675,48 @@ func TestReconcileKubeletConfig(t *testing.T) {
 			},
 			expectedHostedClusterObjects: []client.Object{},
 		},
+		{
+			// NodePool deleted: its finalizer has removed all CMs from the HCP namespace,
+			// so the orphaned guest-side mirrored CM should be cleaned up.
+			name:                      "When NodePool is deleted, it should delete orphaned mirrored guest-side CM",
+			hostedControlPlaneObjects: []client.Object{},
+			existHostedControlPlaneObjects: []client.Object{
+				makeMirroredKubeletConfigConfigMap(netutil.ShortenName("bar", npName1, validation.LabelValueMaxLength), hcNamespace, npName1, kubeletConfig1),
+			},
+			expectedHostedClusterObjects: []client.Object{},
+		},
+		{
+			// Defensive: mirrored CM without NodePoolLabel cannot be attributed to any NodePool,
+			// so preserve it to avoid spurious MCO rollouts.
+			name:                      "When mirrored CM has no NodePoolLabel, it should be preserved",
+			hostedControlPlaneObjects: []client.Object{},
+			existHostedControlPlaneObjects: []client.Object{
+				&corev1.ConfigMap{
+					ObjectMeta: metav1.ObjectMeta{
+						Name:      "orphan-no-np-label",
+						Namespace: hcNamespace,
+						Labels: map[string]string{
+							nodepool.KubeletConfigConfigMapLabel: "true",
+							nodepool.NTOMirroredConfigLabel:      "true",
+						},
+					},
+					Data: map[string]string{"config": kubeletConfig1},
+				},
+			},
+			expectedHostedClusterObjects: []client.Object{
+				&corev1.ConfigMap{
+					ObjectMeta: metav1.ObjectMeta{
+						Name:      "orphan-no-np-label",
+						Namespace: hcNamespace,
+						Labels: map[string]string{
+							nodepool.KubeletConfigConfigMapLabel: "true",
+							nodepool.NTOMirroredConfigLabel:      "true",
+						},
+					},
+					Data: map[string]string{"config": kubeletConfig1},
+				},
+			},
+		},
 		{
 			name: "When guest CM is immutable but not a KubeletConfig, it should not be deleted",
 			hostedControlPlaneObjects: []client.Object{