HetznerCluster does not react on changes in relevant secrets

[janiskemper]

/kind bug

What steps did you take and what happened:
The "HetznerCluster" object should listen to the changes in the secret that stores the Hetzner credentials. For example, because they have to be synced in the updated form to the workload clusters. This doesn't happen right now because the controller doesn't react on the relevant events.

In

cluster-api-provider-hetzner/controllers/hetznercluster_controller.go

Line 400 in 1904cab

hetznerSecret, err := secretManager.AcquireSecret(

we "acquire" the secret but set "controlledByOwner" to false. This means that the hetznercluster-controller doesn't actually own the secret, so that the events are not shown, even though we set the event listener here:

cluster-api-provider-hetzner/controllers/hetznercluster_controller.go

Line 749 in 1904cab

Owns(&corev1.Secret{}).

What did you expect to happen:
We should react on the events in the hetzner secret. Either by setting the hetznercluster controller as "controller" of the secret, or by changing the way we listen to events.

It would be obviously easier to set the hetznercluster as controller of the secret, that's just one value. I'm not aware if that has any drawbacks compared to the current state.

[guettli]

@janiskemper

if a controller owns a secret and you delete the controller, Kubernetes garbage collection (GC) will typically remove the secret.

Somehow I think an owneRef does not match. The user is responsible for that secret.

We can use an option for .Own():

From the Owns docstring:

// The default behavior reconciles only the first controller-type OwnerReference of the given type.
// Use Owns(object, builder.MatchEveryOwner) to reconcile all owners.

I suggest to use MatchEveryOwner