Add ObservedGeneration handling to Bastions (gardener#4196)

* add observedgeneration to bastions

* update proposal

docs/proposals/15-manage-bastions-and-ssh-key-pair-rotation.md

@@ -147,6 +147,8 @@ spec:
       cidr: 1.2.3.4/32 # public IP of the user. CIDR is a string representing the IP Block. Valid examples are "192.168.1.1/24" or "2001:db9::/64"
 
 status:
+  observedGeneration: 1
+
   # the following fields are managed by the controller in the seed and synced by gardenlet
   ingress: # IP or hostname of the bastion
     ip: 1.2.3.5
@@ -186,6 +188,7 @@ spec:
   type: aws # from extensionsv1alpha1.DefaultSpec
 
 status:
+  observedGeneration: 1
   ingress:
     ip: 1.2.3.5
     # hostname: foo.bar

hack/api-reference/operations.md

@@ -339,6 +339,19 @@ Kubernetes meta/v1.Time
 garbage collected.</p>
 </td>
 </tr>
+<tr>
+<td>
+<code>observedGeneration</code></br>
+<em>
+int64
+</em>
+</td>
+<td>
+<em>(Optional)</em>
+<p>ObservedGeneration is the most recent generation observed for this Bastion. It corresponds to the
+Bastion&rsquo;s generation, which is updated on mutation by the API Server.</p>
+</td>
+</tr>
 </tbody>
 </table>
 <hr/>

pkg/apis/operations/types_bastion.go

@@ -80,4 +80,7 @@ type BastionStatus struct {
 	// ExpirationTimestamp is the time after which a Bastion is supposed to be
 	// garbage collected.
 	ExpirationTimestamp *metav1.Time
+	// ObservedGeneration is the most recent generation observed for this Bastion. It corresponds to the
+	// Bastion's generation, which is updated on mutation by the API Server.
+	ObservedGeneration *int64
 }

pkg/apis/operations/v1alpha1/types_bastion.go

@@ -97,4 +97,8 @@ type BastionStatus struct {
 	// garbage collected.
 	// +optional
 	ExpirationTimestamp *metav1.Time `json:"expirationTimestamp,omitempty" protobuf:"bytes,4,opt,name=expirationTimestamp"`
+	// ObservedGeneration is the most recent generation observed for this Bastion. It corresponds to the
+	// Bastion's generation, which is updated on mutation by the API Server.
+	// +optional
+	ObservedGeneration *int64 `json:"observedGeneration,omitempty" protobuf:"varint,5,opt,name=observedGeneration"`
 }

pkg/gardenlet/controller/bastion/bastion.go

@@ -151,13 +151,17 @@ func (c *Controller) bastionAdd(obj interface{}) {
 	c.bastionQueue.Add(key)
 }
 
-func (c *Controller) bastionUpdate(oldObj, newObj interface{}) {
-	oldBastion := oldObj.(*operationsv1alpha1.Bastion)
+func (c *Controller) bastionUpdate(_, newObj interface{}) {
 	newBastion := newObj.(*operationsv1alpha1.Bastion)
 
-	if oldBastion.Generation != newBastion.Generation {
-		c.bastionAdd(newObj)
+	// If the generation did not change for an update event (i.e., no changes to the .spec section have
+	// been made), we do not want to add the Bastion to the queue. The periodic reconciliation is handled
+	// elsewhere by adding the Bastion to the queue to dedicated times.
+	if newBastion.Status.ObservedGeneration != nil && newBastion.Generation == *newBastion.Status.ObservedGeneration {
+		return
 	}
+
+	c.bastionAdd(newObj)
 }
 
 func (c *Controller) bastionDelete(obj interface{}) {

pkg/gardenlet/controller/bastion/bastion_reconciler.go

@@ -188,6 +188,7 @@ func (r *reconciler) reconcileBastion(
 	patch := client.MergeFrom(bastion.DeepCopy())
 	setReadyCondition(bastion, gardencorev1alpha1.ConditionTrue, "SuccessfullyReconciled", "The bastion has been reconciled successfully.")
 	bastion.Status.Ingress = extBastion.Status.Ingress.DeepCopy()
+	bastion.Status.ObservedGeneration = &bastion.Generation
 
 	if err := gardenClient.Status().Patch(ctx, bastion, patch); err != nil {
 		return fmt.Errorf("failed patching ready condition of Bastion: %v", err)