Reconcile HetznerClusters when their Hetzner secret changes so the workload-cluster secret stays in sync

[abdullah599]

The Problem

The HetznerCluster controller copies the credentials from the Hetzner secret named in spec.hetznerSecret.Name of HetznerCluster resource into a secret in the workload cluster's kube-system namespace. The cloud controller manager (CCM) reads them there to reach the Hetzner API. The copy holds the hcloud token, plus the Hetzner Robot user and password when they are configured. The controller rewrites it on every reconcile pass.

The controller watches the HetznerCluster, the secrets it owns, and the CAPI Cluster, but not the Hetzner secret. So when the Hetzner secret is updated, the HetznerCluster does not reconcile, and the workload-cluster copy keeps the old credentials. The CCM then keeps using the outdated credentials.

The Solution

Give the HetznerCluster controller a watch on secrets, so a changed secret re-syncs the workload-cluster copy at once. PR #2001 already did this for HCloudMachines in issue #1972, and issue #2157 tracks it for HetznerBareMetalHosts.

• Watch secrets in the HetznerCluster controller.
• Reuse the predicate PR ✨ Reconcile HCloudMachines when hcloud token secret changes #2001 added, IgnoreInsignificantSecretUpdates, which fires only when a secret's data changes.
• When a secret changes, reconcile every HetznerCluster whose spec.hetznerSecret.Name names it, mirroring the HetznerSecretToHCloudMachines map function on the HCloudMachine controller.