Background

This is the first part of this work, implementing it for just Machines. OCPCLOUD-3188 will need to be completed for MachineSets once we have a test suite to test VAPs against MachineSets in place.

To prevent concurrent reconciles, we will need to validate creation requests for Machine API Machines.

In particular, if a Machine API resource is created, and there already exists a Cluster API equivalent resource:

• The MAPI resource may only be create when it is not authoritative

Determine if we can leverage ValidatingAdmissionPolicy for this use case, given we need information from a different resource. If we cannot use VAP, a webhook validation must be created for this.

Behaviours

• If CAPI resource exists
  • Only allow creation of MAPI resource if spec.authoritativeAPI == ClusterAPI

Steps

• Determine if we can use VAP
• If we cannot use VAP, ensure or build out webhook for the use case.
• Implement behaviours for MAPI creation as per above description.

Stakeholders

• Cluster Infra

Definition of Done

• When creating a MAPI resource that has an equivalent CAPI resource, above rules on pausing are observed

• Docs

• <Add docs requirements for this card>

• Testing

• <Explain testing that will be added>