fix(controllers) expand TypeMeta population

CHANGELOG.md

@@ -90,6 +90,8 @@ Adding a new version? You'll need three changes:
 
 - No more "log.SetLogger(...) was never called..." log entry during shutdown of KIC
   [#4738](https://github.com/Kong/kubernetes-ingress-controller/pull/4738)
+- Changes to referenced Secrets are now tracked independent of their referent.
+  [#4758](https://github.com/Kong/kubernetes-ingress-controller/pull/4758)
 
 ### Added
 

hack/generators/controllers/networking/main.go

@@ -397,7 +397,6 @@ import (
 	discoveryv1 "k8s.io/api/discovery/v1"
 	netv1 "k8s.io/api/networking/v1"
 	apierrors "k8s.io/apimachinery/pkg/api/errors"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apimachinery/pkg/runtime/schema"
 	k8stypes "k8s.io/apimachinery/pkg/types"
@@ -550,11 +549,6 @@ func (r *{{.PackageAlias}}{{.Kind}}Reconciler) Reconcile(ctx context.Context, re
 
 	// get the relevant object
 	obj := new({{.PackageImportAlias}}.{{.Kind}})
-	// set type meta to the object
-	obj.TypeMeta = metav1.TypeMeta{
-		APIVersion: {{.PackageImportAlias}}.SchemeGroupVersion.String(),
-		Kind: "{{.Kind}}",
-	}
 
 	if err := r.Get(ctx, req.NamespacedName, obj); err != nil {
 		if apierrors.IsNotFound(err) {
@@ -572,6 +566,11 @@ func (r *{{.PackageAlias}}{{.Kind}}Reconciler) Reconcile(ctx context.Context, re
 	}
 	log.V(util.DebugLevel).Info("reconciling resource", "namespace", req.Namespace, "name", req.Name)
 
+	err := util.PopulateTypeMeta(obj)
+	if err != nil {
+		log.WithValues().Error(err, "could not set resource TypeMeta", "namespace", obj.GetNamespace(), "name", obj.GetName())
+	}
+
 	// clean the object up if it's being deleted
 	if !obj.DeletionTimestamp.IsZero() && time.Now().After(obj.DeletionTimestamp.Time) {
 		log.V(util.DebugLevel).Info("resource is being deleted, its configuration will be removed", "type", "{{.Kind}}", "namespace", req.Namespace, "name", req.Name)

internal/controllers/configuration/kongadminapi_controller.go

@@ -87,6 +87,11 @@ func (r *KongAdminAPIServiceReconciler) SetLogger(l logr.Logger) {
 }
 
 func (r *KongAdminAPIServiceReconciler) shouldReconcileEndpointSlice(obj client.Object) bool {
+	err := util.PopulateTypeMeta(obj)
+	if err != nil {
+		r.Log.Error(err, "could not set resource TypeMeta",
+			"namespace", obj.GetNamespace(), "name", obj.GetName())
+	}
 	endpoints, ok := obj.(*discoveryv1.EndpointSlice)
 	if !ok {
 		return false

internal/controllers/configuration/secret_controller.go

@@ -77,7 +77,16 @@ func (r *CoreV1SecretReconciler) SetLogger(l logr.Logger) {
 // - the secret has label: konghq.com/ca-cert:true
 // - or the secret is referred by objects we care (service, ingress, gateway, ...)
 func (r *CoreV1SecretReconciler) shouldReconcileSecret(obj client.Object) bool {
-	secret, ok := obj.(*corev1.Secret)
+	// TypeMeta is necessary to generate the correct key for references, but we can't use the original object
+	// controller-runtime's client provides the same object to both predicates and the admission webhook, and can result
+	// in a race condition if this uses the original
+	o := obj.DeepCopyObject()
+	err := util.PopulateTypeMeta(o)
+	if err != nil {
+		r.Log.Error(err, "could not set resource TypeMeta",
+			"namespace", obj.GetNamespace(), "name", obj.GetName())
+	}
+	secret, ok := o.(*corev1.Secret)
 	if !ok {
 		return false
 	}
@@ -113,6 +122,13 @@ func (r *CoreV1SecretReconciler) Reconcile(ctx context.Context, req ctrl.Request
 		}
 		return ctrl.Result{}, err
 	}
+
+	err := util.PopulateTypeMeta(secret)
+	if err != nil {
+		r.Log.Error(err, "could not set resource TypeMeta",
+			"namespace", secret.GetNamespace(), "name", secret.GetName())
+	}
+
 	log.V(util.DebugLevel).Info("reconciling resource", "namespace", req.Namespace, "name", req.Name)
 
 	// clean the object up if it's being deleted