Enhanced node reconciliation by automating maintenance CR lifecycle

.gitignore

@@ -25,3 +25,10 @@ vendor
 *.swo
 *~
 dev/
+
+.tiltbuild
+
+# kind configs
+config/kind/mgmt-kubeconfig-external
+config/kind/mgmt-kubeconfig-internal
+config/kind/worker-kubeconfig

Makefile

@@ -67,6 +67,21 @@ check-license: addlicense ## Check that every file has a license header present.
 
 check: add-license lint test
 
+.PHONY: kind-setup
+kind-setup:
+	kind create cluster --name mgmt
+	kind create cluster --name worker
+
+.PHONY: export-kubeconfig
+export-kubeconfig:
+	kind get kubeconfig --name mgmt > ./config/kind/mgmt-kubeconfig-external # for applying crds to mgmt cluster via tilt
+	kind get kubeconfig --name mgmt --internal > ./config/kind/mgmt-kubeconfig-internal # for ccm config (it needs access to mgmt cluster)
+	kind get kubeconfig --name worker > ./config/kind/worker-kubeconfig # for applying crds to worker cluster via tilt
+
+.PHONY: tilt-up
+tilt-up: kind-setup export-kubeconfig
+	KUBECONFIG=./config/kind/mgmt-kubeconfig:./config/kind/worker-kubeconfig tilt up
+
 ##@ Build
 
 .PHONY: build
@@ -78,7 +93,7 @@ run: fmt vet ## Run a metal cloud controller from your host.
 	go run ./cmd/metal-cloud-controller-manager/main.go
 
 .PHONY: docker-build
-docker-build: test ## Build docker image with the metal cloud controller.
+docker-build: ## Build docker image with the metal cloud controller.
 	$(CONTAINER_TOOL) build -t ${CONTROLLER_IMG} .
 
 .PHONY: docker-push

Tiltfile

@@ -0,0 +1,54 @@
+allow_k8s_contexts(['kind-mgmt', 'kind-worker'])
+
+mgmt_ctx = 'kind-mgmt'
+worker_ctx = 'kind-worker'
+
+mgmt_kubeconfig = './config/kind/mgmt-kubeconfig-external'
+worker_kubeconfig = './config/kind/worker-kubeconfig'
+
+def mgmt_kubectl(args):
+    return local('kubectl --kubeconfig=' + mgmt_kubeconfig + ' --context=' + mgmt_ctx + ' ' + args)
+
+def worker_kubectl(args):
+    return local('kubectl --kubeconfig=' + worker_kubeconfig + ' --context=' + worker_ctx + ' ' + args)
+
+METAL_OPERATOR_REF = "main" #TODO: update to the tag after new metal-operator release
+mgmt_kubectl('apply -f https://raw.githubusercontent.com/ironcore-dev/metal-operator/' + METAL_OPERATOR_REF + '/config/crd/bases/metal.ironcore.dev_serverclaims.yaml')
+mgmt_kubectl('apply -f https://raw.githubusercontent.com/ironcore-dev/metal-operator/' + METAL_OPERATOR_REF + '/config/crd/bases/metal.ironcore.dev_servermaintenances.yaml')
+mgmt_kubectl('apply -f https://raw.githubusercontent.com/ironcore-dev/metal-operator/' + METAL_OPERATOR_REF + '/config/crd/bases/metal.ironcore.dev_servers.yaml')
+mgmt_kubectl('wait --for=condition=Established --timeout=60s crd/serverclaims.metal.ironcore.dev')
+mgmt_kubectl('wait --for=condition=Established --timeout=60s crd/servermaintenances.metal.ironcore.dev')
+mgmt_kubectl('wait --for=condition=Established --timeout=60s crd/servers.metal.ironcore.dev')
+mgmt_kubectl('apply -f config/kind/crs/server.yaml')
+mgmt_kubectl('apply -f config/kind/crs/serverclaim.yaml')
+
+worker_kubectl('apply -k config/kind') # kustomize
+worker_kubectl('apply -f config/kind/crs/node.yaml')
+
+local_resource(
+    "manager-binary",
+    cmd = 'mkdir -p .tiltbuild; CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -o .tiltbuild/manager ./cmd/metal-cloud-controller-manager/main.go',
+    deps = ["pkg", "cmd", "go.mod", "go.sum"]
+)
+
+docker_build(
+    ref = "controller",
+    context = "./.tiltbuild/",
+    dockerfile_contents = """
+FROM gcr.io/distroless/static:nonroot
+WORKDIR /
+COPY manager /metal-cloud-controller-manager
+USER 65532:65532
+ENTRYPOINT ["/metal-cloud-controller-manager"]
+""",
+    only = "manager"
+)
+
+k8s_yaml(kustomize('config/kind'))
+
+k8s_resource(
+    'cloud-controller-manager',
+    labels=['CCM'],
+    port_forwards='10258:10258',
+    extra_pod_selectors=[{'app.kubernetes.io/name': 'cloud-controller-manager'}]
+)

Tiltfile.license

@@ -0,0 +1,3 @@
+SPDX-FileCopyrightText: 2026 SAP SE
+
+SPDX-License-Identifier: Apache-2.0

config/kind/cloud-config.yaml

@@ -0,0 +1,6 @@
+clusterName: kind-ccm
+networking:
+  configureNodeAddresses: true
+  ipamKind:
+    apiGroup: metal.ironcore.dev
+    kind: ServerClaim

config/kind/crs/node.yaml

@@ -0,0 +1,8 @@
+apiVersion: v1
+kind: Node
+metadata:
+  name: metal-node-1
+  labels:
+    kubernetes.io/hostname: metal-node-1
+spec:
+  providerID: metal://default/server-1

config/kind/crs/server.yaml

@@ -0,0 +1,7 @@
+apiVersion: metal.ironcore.dev/v1alpha1
+kind: Server
+metadata:
+  name: physical-server-1
+  namespace: default
+spec:
+  systemUUID: "some-uuid"

config/kind/crs/serverclaim.yaml

@@ -0,0 +1,13 @@
+apiVersion: metal.ironcore.dev/v1alpha1
+kind: ServerClaim
+metadata:
+  name: server-1
+  namespace: default
+spec:
+  image: "test-image"
+  power: "On"
+  serverRef:
+    name: physical-server-1
+  serverSelector:
+    matchLabels:
+      machine: "true"

config/kind/kustomization.yaml

@@ -0,0 +1,22 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: kube-system
+
+resources:
+  - ../default
+
+patches:
+  - target:
+      kind: Deployment
+      name: manager
+    path: manager-patch.yaml
+
+secretGenerator:
+  - name: metal-cloud-config
+    namespace: kube-system
+    files:
+      - cloud-config=cloud-config.yaml
+      - kubeconfig=mgmt-kubeconfig-internal
+
+generatorOptions:
+  disableNameSuffixHash: true

config/kind/manager-patch.yaml

@@ -0,0 +1,29 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: manager
+spec:
+  strategy:
+    type: Recreate
+  template:
+    spec:
+      containers:
+        - name: manager
+          image: controller
+          imagePullPolicy: IfNotPresent
+          args:
+            - --cloud-provider=metal
+            - --cloud-config=/etc/kubernetes/cloud-config/cloud-config
+            - --metal-kubeconfig=/etc/kubernetes/cloud-config/kubeconfig
+            - --concurrent-service-syncs=10
+            - --leader-elect=false
+            - --secure-port=10258
+            - --v=2
+          volumeMounts:
+            - mountPath: /etc/kubernetes/cloud-config
+              name: cloud-config
+              readOnly: true
+      volumes:
+        - name: cloud-config
+          secret:
+            secretName: metal-cloud-config

go.mod

@@ -1,23 +1,23 @@
 module github.com/ironcore-dev/cloud-provider-metal
 
-go 1.25.0
+go 1.25.6
 
 require (
 	github.com/ironcore-dev/controller-utils v0.11.0
-	github.com/ironcore-dev/metal-operator v0.2.1
+	github.com/ironcore-dev/metal-operator v0.3.1-0.20260220142141-5dabaca4f7d7
 	github.com/onsi/ginkgo/v2 v2.28.1
 	github.com/onsi/gomega v1.39.1
 	github.com/pkg/errors v0.9.1
 	github.com/spf13/pflag v1.0.10
-	k8s.io/api v0.34.1
-	k8s.io/apimachinery v0.34.1
-	k8s.io/client-go v0.34.1
-	k8s.io/cloud-provider v0.34.1
-	k8s.io/component-base v0.34.1
-	k8s.io/controller-manager v0.34.1
+	k8s.io/api v0.35.0
+	k8s.io/apimachinery v0.35.0
+	k8s.io/client-go v0.35.0
+	k8s.io/cloud-provider v0.35.0
+	k8s.io/component-base v0.35.0
+	k8s.io/controller-manager v0.35.0
 	k8s.io/klog/v2 v2.130.1
 	sigs.k8s.io/cluster-api v1.10.4
-	sigs.k8s.io/controller-runtime v0.22.3
+	sigs.k8s.io/controller-runtime v0.23.1
 	sigs.k8s.io/yaml v1.6.0
 )
 
@@ -80,12 +80,12 @@ require (
 	github.com/prometheus/common v0.67.1 // indirect
 	github.com/prometheus/procfs v0.19.1 // indirect
 	github.com/spf13/cobra v1.10.2 // indirect
-	github.com/stmcginnis/gofish v0.20.0 // indirect
+	github.com/stmcginnis/gofish v0.21.1 // indirect
 	github.com/stoewer/go-strcase v1.3.0 // indirect
 	github.com/x448/float16 v0.8.4 // indirect
-	go.etcd.io/etcd/api/v3 v3.6.4 // indirect
-	go.etcd.io/etcd/client/pkg/v3 v3.6.4 // indirect
-	go.etcd.io/etcd/client/v3 v3.6.4 // indirect
+	go.etcd.io/etcd/api/v3 v3.6.5 // indirect
+	go.etcd.io/etcd/client/pkg/v3 v3.6.5 // indirect
+	go.etcd.io/etcd/client/v3 v3.6.5 // indirect
 	go.opentelemetry.io/auto/sdk v1.2.1 // indirect
 	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.60.0 // indirect
 	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.63.0 // indirect
@@ -100,15 +100,15 @@ require (
 	go.uber.org/zap v1.27.0 // indirect
 	go.yaml.in/yaml/v2 v2.4.3 // indirect
 	go.yaml.in/yaml/v3 v3.0.4 // indirect
-	golang.org/x/crypto v0.47.0 // indirect
+	golang.org/x/crypto v0.48.0 // indirect
 	golang.org/x/exp v0.0.0-20250506013437-ce4c2cf36ca6 // indirect
 	golang.org/x/mod v0.32.0 // indirect
 	golang.org/x/net v0.49.0 // indirect
 	golang.org/x/oauth2 v0.32.0 // indirect
 	golang.org/x/sync v0.19.0 // indirect
-	golang.org/x/sys v0.40.0 // indirect
-	golang.org/x/term v0.39.0 // indirect
-	golang.org/x/text v0.33.0 // indirect
+	golang.org/x/sys v0.41.0 // indirect
+	golang.org/x/term v0.40.0 // indirect
+	golang.org/x/text v0.34.0 // indirect
 	golang.org/x/time v0.14.0 // indirect
 	golang.org/x/tools v0.41.0 // indirect
 	gomodules.xyz/jsonpatch/v2 v2.5.0 // indirect
@@ -119,14 +119,14 @@ require (
 	gopkg.in/evanphx/json-patch.v4 v4.13.0 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	gopkg.in/natefinch/lumberjack.v2 v2.2.1 // indirect
-	k8s.io/apiextensions-apiserver v0.34.1 // indirect
-	k8s.io/apiserver v0.34.1 // indirect
-	k8s.io/component-helpers v0.34.1 // indirect
-	k8s.io/kms v0.34.1 // indirect
+	k8s.io/apiextensions-apiserver v0.35.0 // indirect
+	k8s.io/apiserver v0.35.0 // indirect
+	k8s.io/component-helpers v0.35.0 // indirect
+	k8s.io/kms v0.35.0 // indirect
 	k8s.io/kube-openapi v0.0.0-20250910181357-589584f1c912 // indirect
 	k8s.io/utils v0.0.0-20251002143259-bc988d571ff4 // indirect
 	sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.33.0 // indirect
 	sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 // indirect
 	sigs.k8s.io/randfill v1.0.0 // indirect
-	sigs.k8s.io/structured-merge-diff/v6 v6.3.0 // indirect
+	sigs.k8s.io/structured-merge-diff/v6 v6.3.2-0.20260122202528-d9cc6641c482 // indirect
 )