Add controller that dumps subscriptions

This will let us see the content without needing to access cosmos.  Can
be expanded later to include non-cluster contents like DNSReservations
in the the future.

Author: deads2k

backend/pkg/app/backend.go

@@ -262,7 +262,8 @@ func (b *Backend) runBackendControllersUnderLeaderElection(ctx context.Context,
 
 	maestroClientBuilder := maestro.NewMaestroClientBuilder()
 
-	dataDumpController := datadumpcontrollers.NewDataDumpController(b.options.CosmosDBClient, activeOperationLister, backendInformers)
+	subscriptionNonClusterDataDumpController := datadumpcontrollers.NewSubscriptionNonClusterDataDumpController(b.options.CosmosDBClient, activeOperationLister, backendInformers)
+	clusterRecursiveDataDumpController := datadumpcontrollers.NewClusterRecursiveDataDumpController(b.options.CosmosDBClient, activeOperationLister, backendInformers)
 	csStateDumpController := datadumpcontrollers.NewCSStateDumpController(b.options.CosmosDBClient, activeOperationLister, backendInformers, b.options.ClustersServiceClient)
 	doNothingController := controllers.NewDoNothingExampleController(b.options.CosmosDBClient, subscriptionLister)
 	operationClusterCreateController := operationcontrollers.NewGenericOperationController(
@@ -504,7 +505,8 @@ func (b *Backend) runBackendControllersUnderLeaderElection(ctx context.Context,
 				// start the SharedInformers
 				go backendInformers.RunWithContext(ctx)
 
-				go dataDumpController.Run(ctx, 20)
+				go subscriptionNonClusterDataDumpController.Run(ctx, 20)
+				go clusterRecursiveDataDumpController.Run(ctx, 20)
 				go csStateDumpController.Run(ctx, 20)
 				go doNothingController.Run(ctx, 20)
 				go operationClusterCreateController.Run(ctx, 20)

backend/pkg/controllers/controllerutils/subscription_watching_controller.go

@@ -0,0 +1,77 @@
+// Copyright 2026 Microsoft Corporation
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package controllerutils
+
+import (
+	"context"
+	"time"
+
+	azcorearm "github.com/Azure/azure-sdk-for-go/sdk/azcore/arm"
+
+	"github.com/Azure/ARO-HCP/backend/pkg/informers"
+)
+
+type SubscriptionSyncer interface {
+	SyncOnce(ctx context.Context, keyObj SubscriptionKey) error
+	CooldownChecker() CooldownChecker
+}
+
+type subscriptionWatchingController struct {
+	name   string
+	syncer SubscriptionSyncer
+}
+
+// NewSubscriptionWatchingController periodically looks up all subscriptions and queues them.
+// cooldownDuration is how long to wait before allowing a new notification to fire the controller.
+// Since our detection of change is coarse, we are being triggered every few second without new information.
+// Until we get a changefeed, the cooldownDuration value is effectively the min resync time.
+// This does NOT prevent us from re-executing on errors, so errors will continue to trigger fast checks as expected.
+func NewSubscriptionWatchingController(
+	name string,
+	informers informers.BackendInformers,
+	resyncDuration time.Duration,
+	syncer SubscriptionSyncer,
+) Controller {
+	subscriptionSyncer := &subscriptionWatchingController{
+		name:   name,
+		syncer: syncer,
+	}
+	subscriptionController := newGenericWatchingController(name, azcorearm.SubscriptionResourceType, subscriptionSyncer)
+
+	// this happens when unit tests don't want triggering.  This isn't beautiful, but fails to do nothing which is pretty safe.
+	if informers != nil {
+		subscriptionInformer, _ := informers.Subscriptions()
+		err := subscriptionController.QueueForInformers(resyncDuration, subscriptionInformer)
+		if err != nil {
+			panic(err) // coding error
+		}
+	}
+
+	return subscriptionController
+}
+
+func (c *subscriptionWatchingController) SyncOnce(ctx context.Context, key SubscriptionKey) error {
+	return c.syncer.SyncOnce(ctx, key)
+}
+
+func (c *subscriptionWatchingController) CooldownChecker() CooldownChecker {
+	return c.syncer.CooldownChecker()
+}
+
+func (c *subscriptionWatchingController) MakeKey(resourceID *azcorearm.ResourceID) SubscriptionKey {
+	return SubscriptionKey{
+		SubscriptionID: resourceID.SubscriptionID,
+	}
+}

backend/pkg/controllers/controllerutils/util.go

@@ -29,6 +29,7 @@ import (
 	azcorearm "github.com/Azure/azure-sdk-for-go/sdk/azcore/arm"
 
 	"github.com/Azure/ARO-HCP/internal/api"
+	"github.com/Azure/ARO-HCP/internal/api/arm"
 	"github.com/Azure/ARO-HCP/internal/database"
 	"github.com/Azure/ARO-HCP/internal/utils"
 )
@@ -148,6 +149,21 @@ func (k *HCPNodePoolKey) InitialController(controllerName string) *api.Controlle
 	}
 }
 
+// SubscriptionKey is for driving workqueues keyed for subscriptions
+type SubscriptionKey struct {
+	SubscriptionID string `json:"subscriptionID"`
+}
+
+func (k *SubscriptionKey) GetResourceID() *azcorearm.ResourceID {
+	return api.Must(arm.ToSubscriptionResourceID(k.SubscriptionID))
+}
+
+func (k *SubscriptionKey) AddLoggerValues(logger logr.Logger) logr.Logger {
+	return logger.WithValues(
+		utils.LogValues{}.
+			AddLogValuesForResourceID(k.GetResourceID())...)
+}
+
 // clock is used by helper functions for setting last transition time.  It is injectable for unit testing.
 var clock utilsclock.Clock = utilsclock.RealClock{}
 

…rollers/datadumpcontrollers/data_dump.go …umpcontrollers/dump_cluster_recursive.gobackend/pkg/controllers/datadumpcontrollers/data_dump.go renamed to backend/pkg/controllers/datadumpcontrollers/dump_cluster_recursive.go backend/pkg/controllers/datadumpcontrollers/data_dump.go renamed to backend/pkg/controllers/datadumpcontrollers/dump_cluster_recursive.go

@@ -26,21 +26,21 @@ import (
 	"github.com/Azure/ARO-HCP/internal/utils"
 )
 
-type dataDump struct {
+type clusterRecursiveDataDump struct {
 	cooldownChecker controllerutils.CooldownChecker
 	cosmosClient    database.DBClient
 
 	// nextDataDumpChecker ensures we don't hotloop from any source.
 	nextDataDumpChecker controllerutils.CooldownChecker
 }
 
-// NewDataDumpController periodically lists all clusters and logs when the cluster was created and its state.
-func NewDataDumpController(
+// NewClusterRecursiveDataDumpController periodically lists all clusters and logs when the cluster was created and its state.
+func NewClusterRecursiveDataDumpController(
 	cosmosClient database.DBClient,
 	activeOperationLister listers.ActiveOperationLister,
 	backendInformers informers.BackendInformers,
 ) controllerutils.Controller {
-	syncer := &dataDump{
+	syncer := &clusterRecursiveDataDump{
 		cooldownChecker:     controllerutils.DefaultActiveOperationPrioritizingCooldown(activeOperationLister),
 		cosmosClient:        cosmosClient,
 		nextDataDumpChecker: controllerutils.DefaultActiveOperationPrioritizingCooldown(activeOperationLister),
@@ -55,7 +55,7 @@ func NewDataDumpController(
 	)
 }
 
-func (c *dataDump) SyncOnce(ctx context.Context, key controllerutils.HCPClusterKey) error {
+func (c *clusterRecursiveDataDump) SyncOnce(ctx context.Context, key controllerutils.HCPClusterKey) error {
 	if !c.nextDataDumpChecker.CanSync(ctx, key) {
 		return nil
 	}
@@ -70,6 +70,6 @@ func (c *dataDump) SyncOnce(ctx context.Context, key controllerutils.HCPClusterK
 	return nil
 }
 
-func (c *dataDump) CooldownChecker() controllerutils.CooldownChecker {
+func (c *clusterRecursiveDataDump) CooldownChecker() controllerutils.CooldownChecker {
 	return c.cooldownChecker
 }

backend/pkg/controllers/datadumpcontrollers/dump_subscription_non_cluster.go

@@ -0,0 +1,86 @@
+// Copyright 2025 Microsoft Corporation
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package datadumpcontrollers
+
+import (
+	"context"
+	"fmt"
+	"time"
+
+	"github.com/Azure/ARO-HCP/backend/pkg/controllers/controllerutils"
+	"github.com/Azure/ARO-HCP/backend/pkg/informers"
+	"github.com/Azure/ARO-HCP/backend/pkg/listers"
+	"github.com/Azure/ARO-HCP/internal/database"
+	"github.com/Azure/ARO-HCP/internal/utils"
+)
+
+type subscriptionNonClusterDataDump struct {
+	cooldownChecker controllerutils.CooldownChecker
+	cosmosClient    database.DBClient
+
+	// nextDataDumpChecker ensures we don't hotloop from any source.
+	nextDataDumpChecker controllerutils.CooldownChecker
+}
+
+// NewSubscriptionNonClusterDataDumpController periodically dumps data for a subscription that is NOT related to a cluster.
+func NewSubscriptionNonClusterDataDumpController(
+	cosmosClient database.DBClient,
+	activeOperationLister listers.ActiveOperationLister,
+	backendInformers informers.BackendInformers,
+) controllerutils.Controller {
+	syncer := &subscriptionNonClusterDataDump{
+		cooldownChecker:     controllerutils.DefaultActiveOperationPrioritizingCooldown(activeOperationLister),
+		cosmosClient:        cosmosClient,
+		nextDataDumpChecker: controllerutils.NewTimeBasedCooldownChecker(4 * time.Minute),
+	}
+
+	return controllerutils.NewSubscriptionWatchingController(
+		"SubscriptionNonClusterDataDump",
+		backendInformers,
+		5*time.Minute,
+		syncer,
+	)
+}
+
+func (c *subscriptionNonClusterDataDump) SyncOnce(ctx context.Context, key controllerutils.SubscriptionKey) error {
+	if !c.nextDataDumpChecker.CanSync(ctx, key) {
+		return nil
+	}
+
+	logger := utils.LoggerFromContext(ctx)
+
+	cosmosCRUD, err := c.cosmosClient.UntypedCRUD(*key.GetResourceID())
+	if err != nil {
+		logger.Error(err, "failed to get cosmos CRUD")
+		return nil
+	}
+
+	subscription, err := cosmosCRUD.Get(ctx, key.GetResourceID())
+	if err != nil {
+		logger.Error(err, "failed to get subscription")
+		return nil
+	}
+
+	logger.Info(fmt.Sprintf("dumping resourceID %v", key.GetResourceID()),
+		"currentResourceID", key.GetResourceID().String(),
+		"content", subscription,
+	)
+
+	return nil
+}
+
+func (c *subscriptionNonClusterDataDump) CooldownChecker() controllerutils.CooldownChecker {
+	return c.cooldownChecker
+}