fix(careinstruction): react to a Cluster losing its owner label

[mikolajkucinski]

Description

Removing the ownership label from a Cluster released it on paper only. The watch predicate looks at the new object, so the update was filtered out, and the handler finds the CareInstruction by that same label anyway. Nothing reconciled until the pod was restarted.

The predicate now also admits updates where the label was just lost, the handler enqueues every CareInstruction in the namespace when the owner is unknown, and each CareInstruction tracks who owns the cluster of every shoot it matches. A change to that view restarts its shoot controller.

Based on #73, not on main, because it uses the restart mechanism from there.

Closes #63

[Copilot]

Pull request overview

This PR fixes a reconciliation gap when a Greenhouse Cluster loses its shoot-grafter.cloudoperators.dev/careinstruction owner label, ensuring CareInstructions get re-enqueued and their shoot controllers restarted so ownership handoffs take effect without requiring a pod restart.

Changes:

• Extend controller-runtime predicates and Cluster watch handling to admit “label just lost” updates and enqueue appropriate CareInstructions (including all candidates when the owner is unknown).
• Track “blocked shoots” (foreign-owned clusters) per CareInstruction and restart the shoot controller when that ownership view changes.
• Add/extend tests and document the operational handoff procedure for moving a Shoot between CareInstructions.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
README.md	Documents how to move/release ownership using the CareInstruction label on the Secret/Cluster.
internal/clientutil/suite_test.go	Adds a Ginkgo suite for internal/clientutil tests.
internal/clientutil/predicates.go	Introduces PredicateHasLabelOrLost to pass updates where a label was removed.
internal/clientutil/predicates_test.go	Adds unit tests for the new predicate behavior.
controller/careinstruction/enqueue_test.go	Adds unit tests for Cluster → CareInstruction enqueue behavior (including released clusters).
controller/careinstruction/careinstruction_controller.go	Updates Cluster watch wiring, adds a custom Cluster event handler, and restarts shoot controllers on ownership-view changes.
controller/careinstruction/careinstruction_controller_test.go	Adds integration-style tests to ensure onboarding doesn’t restart controllers and ownership release does.

Suppressed comments (1)

controller/careinstruction/careinstruction_controller.go:782

• If the Cluster has the CareInstruction label key but an empty value (possible via kubectl label ... key=), this will enqueue a request with an empty CareInstruction name. That can lead to pointless reconciles and also prevents the intended “released cluster” behavior. Treat empty values like “no owner label”.

	// Check if the cluster has the CareInstruction label
	if careInstructionName, exists := cluster.Labels[v1alpha1.CareInstructionLabel]; exists {
		return []ctrl.Request{
			{
				NamespacedName: client.ObjectKey{
					Name:      careInstructionName,
					Namespace: cluster.Namespace,
				},
			},
		}
	}

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

Merging this branch will increase overall coverage

Impacted Packages	Coverage Δ	🤖
shoot-grafter/api/v1alpha1	73.08% (+13.85%)	🎉
shoot-grafter/controller/careinstruction	83.85% (+1.44%)	👍
shoot-grafter/controller/shoot	78.37% (+0.08%)	👍
shoot-grafter/internal/clientutil	75.00% (+1.67%)	👍

---

Coverage by file

Changed files (no unit tests)

Changed File	Coverage Δ	Total	Covered	Missed	🤖
shoot-grafter/api/v1alpha1/careinstruction_types.go	85.71% (+0.71%)	21 (+1)	18 (+1)	3	👍
shoot-grafter/controller/careinstruction/careinstruction_controller.go	83.67% (+1.94%)	349 (+37)	292 (+37)	57	👍
shoot-grafter/controller/shoot/shoot_controller.go	82.89% (+0.11%)	152 (+1)	126 (+1)	26	👍
shoot-grafter/internal/clientutil/predicates.go	75.00% (+1.67%)	24 (+9)	18 (+7)	6 (+2)	👍

Please note that the "Total", "Covered", and "Missed" counts above refer to code statements instead of lines of code. The value in brackets refers to the test coverage of that file in the old version of the code.

Changed unit test files

• shoot-grafter/controller/careinstruction/careinstruction_controller_test.go
• shoot-grafter/controller/careinstruction/enqueue_test.go
• shoot-grafter/controller/careinstruction/ownership_test.go
• shoot-grafter/controller/shoot/shoot_controller_fake_client_test.go
• shoot-grafter/internal/clientutil/predicates_test.go
• shoot-grafter/internal/clientutil/suite_test.go