[release-0.4] Fix APIResourceSchema agent annotations/labels (#142)

* respect the PR filter when reconciling APIResourceSchemas

On-behalf-of: @SAP christoph.mewes@sap.com

* correct broken metadata by updating the APIResourceSchemas

On-behalf-of: @SAP christoph.mewes@sap.com

---------

Co-authored-by: Christoph Mewes <christoph@kubermatic.com>

Author: kcp-ci-bot

internal/controller/apiresourceschema/controller.go

@@ -61,6 +61,7 @@ type Reconciler struct {
 	recorder    record.EventRecorder
 	lcName      logicalcluster.Name
 	agentName   string
+	prFilter    labels.Selector
 }
 
 // Add creates a new controller and adds it to the given manager.
@@ -81,6 +82,7 @@ func Add(
 		log:         log.Named(ControllerName),
 		recorder:    mgr.GetEventRecorderFor(ControllerName),
 		agentName:   agentName,
+		prFilter:    prFilter,
 	}
 
 	_, err := builder.ControllerManagedBy(mgr).
@@ -98,7 +100,7 @@ func (r *Reconciler) enqueueMatchingPublishedResources(ctx context.Context, obj
 	crd := obj.(*apiextensionsv1.CustomResourceDefinition)
 
 	pubResources := &syncagentv1alpha1.PublishedResourceList{}
-	if err := r.localClient.List(ctx, pubResources); err != nil {
+	if err := r.localClient.List(ctx, pubResources, &ctrlruntimeclient.ListOptions{LabelSelector: r.prFilter}); err != nil {
 		runtime.HandleError(err)
 		return nil
 	}
@@ -171,7 +173,8 @@ func (r *Reconciler) reconcile(ctx context.Context, log *zap.SugaredLogger, pubR
 	ars := &kcpdevv1alpha1.APIResourceSchema{}
 	err = r.kcpClient.Get(ctx, types.NamespacedName{Name: arsName}, ars, &ctrlruntimeclient.GetOptions{})
 
-	if apierrors.IsNotFound(err) {
+	switch {
+	case apierrors.IsNotFound(err):
 		ars, err := kcp.CreateAPIResourceSchema(projectedCRD, arsName, r.agentName)
 		if err != nil {
 			return nil, fmt.Errorf("failed to construct APIResourceSchema: %w", err)
@@ -182,8 +185,40 @@ func (r *Reconciler) reconcile(ctx context.Context, log *zap.SugaredLogger, pubR
 		if err := r.kcpClient.Create(ctx, ars); err != nil {
 			return nil, fmt.Errorf("failed to create APIResourceSchema: %w", err)
 		}
-	} else if err != nil {
+
+	case err != nil:
 		return nil, fmt.Errorf("failed to check for APIResourceSchema: %w", err)
+
+	default:
+		// A bug in earlier api-syncagent versions made any agent potentially reconcile any PublishedResource,
+		// ignoring the configured PR filter. This would lead to the wrong agent name in the ARS labels
+		// and annotations.
+		// ARS are immutable and normally we would never need to update the metadata on one, we do it
+		// temporarily anyway to fix broken metadata. The metadata is of informational nature only,
+		// so having the wrong values is just a cosmetic issue.
+		//
+		// TODO: Remove this at some point when we're sure enough all ARS out there have been fixed.
+
+		validAnnotation := ars.Annotations[syncagentv1alpha1.AgentNameAnnotation] == r.agentName
+		validLabel := ars.Labels[syncagentv1alpha1.AgentNameLabel] == r.agentName
+
+		if !validAnnotation || !validLabel {
+			if ars.Labels == nil {
+				ars.Labels = map[string]string{}
+			}
+			if ars.Annotations == nil {
+				ars.Annotations = map[string]string{}
+			}
+
+			ars.Labels[syncagentv1alpha1.AgentNameLabel] = r.agentName
+			ars.Annotations[syncagentv1alpha1.AgentNameAnnotation] = r.agentName
+
+			log.With("name", arsName).Info("Fixing incorrect agent metadata…")
+
+			if err := r.kcpClient.Update(ctx, ars); err != nil {
+				return nil, fmt.Errorf("failed to update APIResourceSchema: %w", err)
+			}
+		}
 	}
 
 	// update Status with ARS name