Update machine status

[yairpod]

Update machine status CRDs that were unused and could be meaningful.

Summary by Sourcery

Expose meaningful Machine status conditions for key provisioning and attestation-key approval.

New Features:

• Add Machine status conditions for attestation-key approval and encryption-key provisioning.

Enhancements:

• Update controllers to publish and patch Machine and AttestationKey status conditions consistently.

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: yairpod

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[sourcery-ai]

Reviewer's Guide

The PR introduces meaningful Machine status conditions for key provisioning and attestation-key approval, defines their shared constants and builders, and updates both reconciliation paths to patch status only when conditions change while retaining existing error and requeue behavior.

Sequence diagram for Machine key provisioning status

sequenceDiagram
    participant MachineReconciler
    participant Trustee
    participant KubernetesAPI

    MachineReconciler->>Trustee: generate_secret(id, owner_reference)
    alt secret generation succeeds
        MachineReconciler->>Trustee: send_secret(id)
    end
    MachineReconciler->>MachineReconciler: machine_key_provisioned_condition(provisioned, generation, existing_status)
    alt condition changed
        MachineReconciler->>KubernetesAPI: patch_status(Machine, conditions)
    end
    MachineReconciler-->>MachineReconciler: requeue or return provisioning error

Loading

Sequence diagram for Machine attestation-key approval status

sequenceDiagram
    participant AttestationKeyReconciler
    participant KubernetesAPI

    AttestationKeyReconciler->>KubernetesAPI: patch_status(AttestationKey, Approved)
    AttestationKeyReconciler->>AttestationKeyReconciler: machine_ak_approved_condition(false, generation, status)
    alt matching key approved
        AttestationKeyReconciler->>KubernetesAPI: patch_status(Machine, AttestationKeyApproved)
    else no matching key
        AttestationKeyReconciler->>KubernetesAPI: patch_status(Machine, AttestationKeyApproved=False)
    end

Loading

File-Level Changes

Change	Details	Files
Added shared Machine condition definitions and status access support across Go CRDs and Rust operator code.	Defined key-provisioning and attestation-key approval condition types, reasons, and messages. Implemented MachineStatus support for generic condition transition handling. Added condition builders for successful and failed machine key provisioning and attestation-key approval.	api/v1alpha1/conditions.go lib/src/conditions.rs lib/src/lib.rs operator/src/conditions.rs
Reported machine key provisioning outcomes during register-server reconciliation.	Tracked generation and existing Machine status before provisioning. Updated the Machine condition after secret generation and mounting succeeds or fails. Preserved error propagation and long requeue behavior after status reporting.	operator/src/register_server.rs
Reported attestation-key matching outcomes on Machine resources and modernized status updates.	Patched Machine approval conditions for both no-match and successful-match paths. Changed AttestationKey approval updates to use generic status condition patching. Added a reusable status subresource patch helper that avoids writes when the condition is unchanged.	operator/src/attestation_key_register.rs operator/src/lib.rs

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[sourcery-ai]

Hey - I've reviewed your changes and they look great!

Sourcery assessment

Needs a human reviewer. If the condition logic or status patch is wrong, a Machine could retain an incorrect provisioning or attestation status after a revert, potentially misleading status-based automation or operators. The underlying key operations are not changed in substance, and the persisted status can be corrected by a subsequent reconciliation or rerun.

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}

[Jakob-Naucke]

I know I'm no saint for this but could you motivate the change in the commit message a little more? Which new conditions are there and why, where do and don't we change the way we update a status (apply vs. merge)

[yairpod]

I know I'm no saint for this but could you motivate the change in the commit message a little more? Which new conditions are there and why, where do and don't we change the way we update a status (apply vs. merge)

Yes, I get too lax, I now wrote a proper Commit message.

[Jakob-Naucke]

Extract a generic patch_status_condition helper that uses
Patch::Apply with per-controller field managers, replacing the
previous upsert-then-merge-patch pattern. SSA lets each controller
own its conditions independently, avoiding last-write-wins races
on the conditions array.
Migrate all existing condition-update call sites (register_server,
attestation_key_register) to the new helper.

I think it's easier to review if these changes go in a separate (preceding) commit