[wmco] Stop adding pub-key-hash label to all nodes

This commit fixes an issue where the public key hash label was being
added to not all nodes, not just Windows nodes.

controllers/secret/secret_controller.go

@@ -180,7 +180,13 @@ func (r *ReconcileSecret) Reconcile(request reconcile.Request) (reconcile.Result
 			return reconcile.Result{}, errors.Wrap(err, "error creating signer from private key")
 		}
 		nodes := &core.NodeList{}
-		err = r.client.List(context.TODO(), nodes, client.HasLabels{nodeconfig.WindowsOSLabel})
+		// The controller-runtime client requires a map for label matching, so the Windows identifying label var needs
+		// to be split into a key/value pair.
+		windowsLabelKeyValuePair := strings.SplitN(nodeconfig.WindowsOSLabel, "=", 2)
+		if len(windowsLabelKeyValuePair) != 2 {
+			return reconcile.Result{}, fmt.Errorf("unexpected length of Windows OS label split")
+		}
+		err = r.client.List(context.TODO(), nodes, client.MatchingLabels{windowsLabelKeyValuePair[0]: windowsLabelKeyValuePair[1]})
 		if err != nil {
 			return reconcile.Result{}, errors.Wrapf(err, "error getting node list")
 		}