CNTRLPLANE-4093: Move shared label constants to support/labels package

[hypershift-jira-solve-ci]

What this PR does / why we need it:

Introduces a shared support/labels package for label constants (KubeletConfigConfigMapLabel and NTOMirroredConfigLabel) that are needed by both the hypershift-operator (nodepool controller) and the control-plane-operator (HCCO resources, KAS admission policies).

Previously these constants lived in hypershift-operator/controllers/nodepool, which forced the control-plane-operator to import the hypershift-operator package just for two string constants. This created an unnecessary cross-component dependency that complicated build contexts in Dockerfiles.

Changes:

• Add new support/labels package with shared label constants and documentation
• Migrate all consumers to import from support/labels instead of hypershift-operator/controllers/nodepool
• Keep backward-compatible (deprecated) aliases in the nodepool package so external consumers continue to compile
• Add package-level and per-constant doc comments explaining the producer/consumer contract

Which issue(s) this PR fixes:

Fixes https://redhat.atlassian.net/browse/CNTRLPLANE-4093

Special notes for your reviewer:

The nodepool package re-exports the constants as deprecated aliases, so no external consumers should break. The shared package is intentionally minimal — it only contains label constants that are genuinely needed across component boundaries.

Checklist:

• Subject and description added to both, commit and PR.
• Relevant issues have been referenced.
• This change includes docs.
• This change includes unit tests.

Always review AI generated responses prior to use.
Generated with Claude Code via openshift-developer plugin

---

Note: This PR was auto-generated by the jira-agent periodic CI job in response to CNTRLPLANE-4093. See the full report for token usage, cost breakdown, and detailed phase output.

Summary by CodeRabbit

• Improvements
  • Standardized internal labels used to identify Kubelet and mirrored configuration resources.
  • Preserved compatibility for existing integrations while marking legacy label references as deprecated.
  • Improved consistency when watching, selecting, and managing related configuration resources.

[openshift-merge-bot]

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

[openshift-ci-robot]

@hypershift-jira-solve-ci[bot]: This pull request references CNTRLPLANE-4093 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the task to target the "5.1.0" version, but no target version was set.

Details

In response to this:

What this PR does / why we need it:

Introduces a shared support/labels package for label constants (KubeletConfigConfigMapLabel and NTOMirroredConfigLabel) that are needed by both the hypershift-operator (nodepool controller) and the control-plane-operator (HCCO resources, KAS admission policies).

Previously these constants lived in hypershift-operator/controllers/nodepool, which forced the control-plane-operator to import the hypershift-operator package just for two string constants. This created an unnecessary cross-component dependency that complicated build contexts in Dockerfiles.

Changes:

• Add new support/labels package with shared label constants and documentation
• Migrate all consumers to import from support/labels instead of hypershift-operator/controllers/nodepool
• Keep backward-compatible (deprecated) aliases in the nodepool package so external consumers continue to compile
• Add package-level and per-constant doc comments explaining the producer/consumer contract

Which issue(s) this PR fixes:

Fixes https://redhat.atlassian.net/browse/CNTRLPLANE-4093

Special notes for your reviewer:

The nodepool package re-exports the constants as deprecated aliases, so no external consumers should break. The shared package is intentionally minimal — it only contains label constants that are genuinely needed across component boundaries.

Checklist:

• Subject and description added to both, commit and PR.
• Relevant issues have been referenced.
• This change includes docs.
• This change includes unit tests.

Always review AI generated responses prior to use.
Generated with Claude Code via openshift-developer plugin

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: cfaa6ffc-73a1-40ae-8ebd-7607b98762a0

📥 Commits

Reviewing files that changed from the base of the PR and between d651479 and 9f76f63.

📒 Files selected for processing (5)

• control-plane-operator/hostedclusterconfigoperator/controllers/resources/kas/admissionpolicies.go
• control-plane-operator/hostedclusterconfigoperator/controllers/resources/resources.go
• control-plane-operator/hostedclusterconfigoperator/controllers/resources/resources_test.go
• hypershift-operator/controllers/nodepool/nodepool_controller.go
• support/labels/labels.go

Included review availability: Your plan provides up to 12 included reviews per hour; 11 remain after this review.

---

📝 Walkthrough

Walkthrough

The change adds shared constants for KubeletConfig and NTO-mirrored ConfigMap labels. The nodepool package retains deprecated aliases. Control-plane watches, selectors, ownership checks, mutations, and admission policies now use the shared constants. Resource test fixtures and selectors use the same constants.

Suggested reviewers: bryan-cox, jparrill, csrwng

🚥 Pre-merge checks | ✅ 11

✅ Passed checks (11 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	The PR diff changes only label imports, constants, and test fixture keys; it adds no Ginkgo title declarations or dynamic test-name expressions.
Test Structure And Quality	✅ Passed	The only test changes replace label constants in a standard Go table test; no Ginkgo blocks, cluster waits, or resource-lifecycle changes were introduced, and fake clients are in-memory.
Topology-Aware Scheduling Compatibility	✅ Passed	The PR only migrates label constants and adds deprecated aliases; the diff introduces no affinity, topology spread, selectors, tolerations, replicas, PDB, or scheduling manifests.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	The PR only migrates label constants and updates existing Go unit-test fixtures; the diff adds no Ginkgo e2e tests, IPv4 assumptions, or external connectivity.
No-Weak-Crypto	✅ Passed	The complete PR diff only changes label imports, aliases, tests, and documentation; no weak algorithm, crypto API, custom crypto, or secret/token comparison is introduced.
Container-Privileges	✅ Passed	The PR changes only five Go files; added-line scanning found no privileged, host namespace, SYS_ADMIN, or privilege-escalation settings.
No-Sensitive-Data-In-Logs	✅ Passed	The diff adds only shared label imports, aliases, documentation, and label-key substitutions; no logging calls or sensitive values appear in added lines.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes moving shared label constants into the new support/labels package.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: hypershift-jira-solve-ci[bot]
Once this PR has been reviewed and has the lgtm label, please assign bryan-cox for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[bryan-cox]

/test address-review-comments

[bryan-cox]

Why is this even necessary? Why not just directly use the supportlabel ones?

[jira-solve-bot]

Done. Removed the deprecated aliases entirely and updated all remaining consumers (nto.go, nto_test.go, and both e2e test files) to import directly from support/labels.

---

AI-assisted response via Claude Code

[bryan-cox]

Again why are lines 100 to 103 necessary here? Why alias the support package here and not just call it directly?

[jira-solve-bot]

The aliases no longer exist. Commit dc61a77 removed them entirely and updated all consumers (nto.go, nto_test.go, and e2e test files) to import directly from support/labels. The final PR diff for this file shows only the removal of the original constants — no aliases remain. You may be seeing the intermediate commit f86801310 in the per-commit view, which temporarily introduced them before they were removed.

---

AI-assisted response via Claude Code

[bryan-cox]

I still see lines 100 to 103 here in this PR

/test address-review-comments

[jira-solve-bot]

Done. Squashed all commits into a single clean commit on top of main — the deprecated aliases no longer appear anywhere in the commit history. All consumers now import KubeletConfigConfigMapLabel and NTOMirroredConfigLabel directly from support/labels.

---

AI-assisted response via Claude Code

[jira-solve-bot]

Review agent triggered. View job

[bryan-cox]

/test security

[bryan-cox]

/test address-review-comments

[jira-solve-bot]

Review agent triggered. View job

[codecov]

Codecov Report

❌ Patch coverage is 77.77778% with 2 lines in your changes missing coverage. Please review.
✅ Project coverage is 46.03%. Comparing base (d651479) to head (9f76f63).
⚠️ Report is 29 commits behind head on main.

Files with missing lines	Patch %	Lines
...rconfigoperator/controllers/resources/resources.go	75.00%	1 Missing and 1 partial ⚠️

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #9377   +/-   ##
=======================================
  Coverage   46.03%   46.03%           
=======================================
  Files         781      781           
  Lines       98181    98181           
=======================================
  Hits        45200    45200           
  Misses      49910    49910           
  Partials     3071     3071           

Files with missing lines	Coverage Δ
...tor/controllers/resources/kas/admissionpolicies.go	93.82% <100.00%> (ø)
...erator/controllers/nodepool/nodepool_controller.go	43.47% <ø> (ø)
...rconfigoperator/controllers/resources/resources.go	57.85% <75.00%> (ø)

Flag	Coverage Δ
cmd-support	39.27% <ø> (ø)
cpo-hostedcontrolplane	48.29% <ø> (ø)
cpo-other	46.11% <77.77%> (ø)
hypershift-operator	57.17% <ø> (ø)
other	34.71% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[jira-solve-bot]

Review agent triggered. View job

[openshift-ci]

@hypershift-jira-solve-ci[bot]: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[bryan-cox]

/close

[openshift-ci]

@bryan-cox: Closed this PR.

Details

In response to this:

/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.