Add Device watch to controllers for Paused field changes

Add watches on Device resources to all controllers that use
annotations.IsPaused to trigger reconciliation when a Device's Paused
spec field changes. This ensures resources are re-reconciled when their
parent Device is paused or unpaused.

Each controller now:
- Watches Device create/delete events (default behavior)
- Watches Device update events only when Spec.Paused changes
- Ignores Generic events for Device watches
- Uses deviceTo* map functions to find associated resources by label

Author: felix-kaestner

internal/controller/cisco/nx/bordergateway_controller.go

@@ -287,6 +287,23 @@ func (r *BorderGatewayReconciler) SetupWithManager(ctx context.Context, mgr ctrl
 				},
 			}),
 		).
+		// Watches enqueues BorderGateways for updates in referenced Device resources.
+		// Triggers on create, delete, and update events when the Paused spec field changes.
+		Watches(
+			&v1alpha1.Device{},
+			handler.EnqueueRequestsFromMapFunc(r.deviceToBorderGateways),
+			builder.WithPredicates(predicate.Funcs{
+				UpdateFunc: func(e event.UpdateEvent) bool {
+					oldDevice := e.ObjectOld.(*v1alpha1.Device)
+					newDevice := e.ObjectNew.(*v1alpha1.Device)
+					// Only trigger when Paused spec field changes.
+					return !equality.Semantic.DeepEqual(oldDevice.Spec.Paused, newDevice.Spec.Paused)
+				},
+				GenericFunc: func(e event.GenericEvent) bool {
+					return false
+				},
+			}),
+		).
 		Complete(r)
 }
 
@@ -593,3 +610,36 @@ func (r *BorderGatewayReconciler) bgpPeerToBorderGateway(ctx context.Context, ob
 
 	return requests
 }
+
+// deviceToBorderGateways is a [handler.MapFunc] to be used to enqueue requests for reconciliation
+// for BorderGateways when their referenced Device's Paused spec field changes.
+func (r *BorderGatewayReconciler) deviceToBorderGateways(ctx context.Context, obj client.Object) []ctrl.Request {
+	device, ok := obj.(*v1alpha1.Device)
+	if !ok {
+		panic(fmt.Sprintf("Expected a Device but got a %T", obj))
+	}
+
+	log := ctrl.LoggerFrom(ctx, "Device", klog.KObj(device))
+
+	list := new(nxv1alpha1.BorderGatewayList)
+	if err := r.List(ctx, list,
+		client.InNamespace(device.Namespace),
+		client.MatchingLabels{v1alpha1.DeviceLabel: device.Name},
+	); err != nil {
+		log.Error(err, "Failed to list BorderGateways")
+		return nil
+	}
+
+	requests := make([]ctrl.Request, 0, len(list.Items))
+	for _, i := range list.Items {
+		log.Info("Enqueuing BorderGateway for reconciliation", "BorderGateway", klog.KObj(&i))
+		requests = append(requests, ctrl.Request{
+			NamespacedName: client.ObjectKey{
+				Name:      i.Name,
+				Namespace: i.Namespace,
+			},
+		})
+	}
+
+	return requests
+}

internal/controller/cisco/nx/system_controller.go

@@ -16,9 +16,13 @@ import (
 	"k8s.io/apimachinery/pkg/runtime"
 	kerrors "k8s.io/apimachinery/pkg/util/errors"
 	"k8s.io/client-go/tools/record"
+	"k8s.io/klog/v2"
 	ctrl "sigs.k8s.io/controller-runtime"
+	"sigs.k8s.io/controller-runtime/pkg/builder"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
+	"sigs.k8s.io/controller-runtime/pkg/event"
+	"sigs.k8s.io/controller-runtime/pkg/handler"
 	"sigs.k8s.io/controller-runtime/pkg/predicate"
 
 	nxv1alpha1 "github.com/ironcore-dev/network-operator/api/cisco/nx/v1alpha1"
@@ -203,6 +207,23 @@ func (r *SystemReconciler) SetupWithManager(mgr ctrl.Manager) error {
 		For(&nxv1alpha1.System{}).
 		Named("system").
 		WithEventFilter(filter).
+		// Watches enqueues Systems for updates in referenced Device resources.
+		// Triggers on create, delete, and update events when the Paused spec field changes.
+		Watches(
+			&v1alpha1.Device{},
+			handler.EnqueueRequestsFromMapFunc(r.deviceToSystems),
+			builder.WithPredicates(predicate.Funcs{
+				UpdateFunc: func(e event.UpdateEvent) bool {
+					oldDevice := e.ObjectOld.(*v1alpha1.Device)
+					newDevice := e.ObjectNew.(*v1alpha1.Device)
+					// Only trigger when Paused spec field changes.
+					return !equality.Semantic.DeepEqual(oldDevice.Spec.Paused, newDevice.Spec.Paused)
+				},
+				GenericFunc: func(e event.GenericEvent) bool {
+					return false
+				},
+			}),
+		).
 		Complete(r)
 }
 
@@ -260,3 +281,36 @@ func (r *SystemReconciler) finalize(ctx context.Context, s *systemScope) (reterr
 
 	return s.Provider.ResetSystemSettings(ctx)
 }
+
+// deviceToSystems is a [handler.MapFunc] to be used to enqueue requests for reconciliation
+// for Systems when their referenced Device's Paused spec field changes.
+func (r *SystemReconciler) deviceToSystems(ctx context.Context, obj client.Object) []ctrl.Request {
+	device, ok := obj.(*v1alpha1.Device)
+	if !ok {
+		panic(fmt.Sprintf("Expected a Device but got a %T", obj))
+	}
+
+	log := ctrl.LoggerFrom(ctx, "Device", klog.KObj(device))
+
+	list := new(nxv1alpha1.SystemList)
+	if err := r.List(ctx, list,
+		client.InNamespace(device.Namespace),
+		client.MatchingLabels{v1alpha1.DeviceLabel: device.Name},
+	); err != nil {
+		log.Error(err, "Failed to list Systems")
+		return nil
+	}
+
+	requests := make([]ctrl.Request, 0, len(list.Items))
+	for _, i := range list.Items {
+		log.Info("Enqueuing System for reconciliation", "System", klog.KObj(&i))
+		requests = append(requests, ctrl.Request{
+			NamespacedName: client.ObjectKey{
+				Name:      i.Name,
+				Namespace: i.Namespace,
+			},
+		})
+	}
+
+	return requests
+}

internal/controller/cisco/nx/vpcdomain_controller.go

@@ -17,6 +17,7 @@ import (
 	"k8s.io/apimachinery/pkg/runtime"
 	kerrors "k8s.io/apimachinery/pkg/util/errors"
 	"k8s.io/client-go/tools/record"
+	"k8s.io/klog/v2"
 	ctrl "sigs.k8s.io/controller-runtime"
 	"sigs.k8s.io/controller-runtime/pkg/builder"
 	"sigs.k8s.io/controller-runtime/pkg/client"
@@ -457,6 +458,23 @@ func (r *VPCDomainReconciler) SetupWithManager(ctx context.Context, mgr ctrl.Man
 				},
 			}),
 		).
+		// Watches enqueues VPCDomains for updates in referenced Device resources.
+		// Triggers on create, delete, and update events when the Paused spec field changes.
+		Watches(
+			&corev1.Device{},
+			handler.EnqueueRequestsFromMapFunc(r.deviceToVPCDomains),
+			builder.WithPredicates(predicate.Funcs{
+				UpdateFunc: func(e event.UpdateEvent) bool {
+					oldDevice := e.ObjectOld.(*corev1.Device)
+					newDevice := e.ObjectNew.(*corev1.Device)
+					// Only trigger when Paused spec field changes.
+					return !equality.Semantic.DeepEqual(oldDevice.Spec.Paused, newDevice.Spec.Paused)
+				},
+				GenericFunc: func(e event.GenericEvent) bool {
+					return false
+				},
+			}),
+		).
 		Complete(r)
 }
 
@@ -499,6 +517,39 @@ func (r *VPCDomainReconciler) finalize(ctx context.Context, s *vpcdomainScope) (
 	return s.Provider.DeleteVPCDomain(ctx)
 }
 
+// deviceToVPCDomains is a [handler.MapFunc] to be used to enqueue requests for reconciliation
+// for VPCDomains when their referenced Device's Paused spec field changes.
+func (r *VPCDomainReconciler) deviceToVPCDomains(ctx context.Context, obj client.Object) []ctrl.Request {
+	device, ok := obj.(*corev1.Device)
+	if !ok {
+		panic(fmt.Sprintf("Expected a Device but got a %T", obj))
+	}
+
+	log := ctrl.LoggerFrom(ctx, "Device", klog.KObj(device))
+
+	list := new(nxv1.VPCDomainList)
+	if err := r.List(ctx, list,
+		client.InNamespace(device.Namespace),
+		client.MatchingLabels{corev1.DeviceLabel: device.Name},
+	); err != nil {
+		log.Error(err, "Failed to list VPCDomains")
+		return nil
+	}
+
+	requests := make([]ctrl.Request, 0, len(list.Items))
+	for _, i := range list.Items {
+		log.Info("Enqueuing VPCDomain for reconciliation", "VPCDomain", klog.KObj(&i))
+		requests = append(requests, ctrl.Request{
+			NamespacedName: client.ObjectKey{
+				Name:      i.Name,
+				Namespace: i.Namespace,
+			},
+		})
+	}
+
+	return requests
+}
+
 func conditionChanged(oldConds, newConds []metav1.Condition, t string) bool {
 	o := meta.FindStatusCondition(oldConds, t)
 	n := meta.FindStatusCondition(newConds, t)

internal/controller/core/acl_controller.go

@@ -23,6 +23,7 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/builder"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
+	"sigs.k8s.io/controller-runtime/pkg/event"
 	"sigs.k8s.io/controller-runtime/pkg/handler"
 	"sigs.k8s.io/controller-runtime/pkg/predicate"
 	"sigs.k8s.io/controller-runtime/pkg/reconcile"
@@ -229,7 +230,25 @@ func (r *AccessControlListReconciler) SetupWithManager(mgr ctrl.Manager) error {
 		)
 	}
 
-	return bldr.Complete(r)
+	return bldr.
+		// Watches enqueues AccessControlLists for updates in referenced Device resources.
+		// Triggers on create, delete, and update events when the Paused spec field changes.
+		Watches(
+			&v1alpha1.Device{},
+			handler.EnqueueRequestsFromMapFunc(r.deviceToAccessControlLists),
+			builder.WithPredicates(predicate.Funcs{
+				UpdateFunc: func(e event.UpdateEvent) bool {
+					oldDevice := e.ObjectOld.(*v1alpha1.Device)
+					newDevice := e.ObjectNew.(*v1alpha1.Device)
+					// Only trigger when Paused spec field changes.
+					return !equality.Semantic.DeepEqual(oldDevice.Spec.Paused, newDevice.Spec.Paused)
+				},
+				GenericFunc: func(e event.GenericEvent) bool {
+					return false
+				},
+			}),
+		).
+		Complete(r)
 }
 
 // scope holds the different objects that are read and used during the reconcile.
@@ -300,6 +319,39 @@ func (r *AccessControlListReconciler) finalize(ctx context.Context, s *aclScope)
 	})
 }
 
+// deviceToAccessControlLists is a [handler.MapFunc] to be used to enqueue requests for reconciliation
+// for AccessControlLists when their referenced Device's Paused spec field changes.
+func (r *AccessControlListReconciler) deviceToAccessControlLists(ctx context.Context, obj client.Object) []ctrl.Request {
+	device, ok := obj.(*v1alpha1.Device)
+	if !ok {
+		panic(fmt.Sprintf("Expected a Device but got a %T", obj))
+	}
+
+	log := ctrl.LoggerFrom(ctx, "Device", klog.KObj(device))
+
+	list := new(v1alpha1.AccessControlListList)
+	if err := r.List(ctx, list,
+		client.InNamespace(device.Namespace),
+		client.MatchingLabels{v1alpha1.DeviceLabel: device.Name},
+	); err != nil {
+		log.Error(err, "Failed to list AccessControlLists")
+		return nil
+	}
+
+	requests := make([]ctrl.Request, 0, len(list.Items))
+	for _, i := range list.Items {
+		log.Info("Enqueuing AccessControlList for reconciliation", "AccessControlList", klog.KObj(&i))
+		requests = append(requests, ctrl.Request{
+			NamespacedName: client.ObjectKey{
+				Name:      i.Name,
+				Namespace: i.Namespace,
+			},
+		})
+	}
+
+	return requests
+}
+
 // accessControlListsForProviderConfig is a [handler.MapFunc] to be used to enqueue requests for reconciliation
 // for a AccessControlList to update when one of its referenced provider configurations gets updated.
 func (r *AccessControlListReconciler) accessControlListsForProviderConfig(ctx context.Context, obj client.Object) []reconcile.Request {

internal/controller/core/banner_controller.go

@@ -24,6 +24,7 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/builder"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
+	"sigs.k8s.io/controller-runtime/pkg/event"
 	"sigs.k8s.io/controller-runtime/pkg/handler"
 	"sigs.k8s.io/controller-runtime/pkg/predicate"
 	"sigs.k8s.io/controller-runtime/pkg/reconcile"
@@ -245,7 +246,25 @@ func (r *BannerReconciler) SetupWithManager(mgr ctrl.Manager) error {
 		)
 	}
 
-	return bldr.Complete(r)
+	return bldr.
+		// Watches enqueues Banners for updates in referenced Device resources.
+		// Triggers on create, delete, and update events when the Paused spec field changes.
+		Watches(
+			&v1alpha1.Device{},
+			handler.EnqueueRequestsFromMapFunc(r.deviceToBanners),
+			builder.WithPredicates(predicate.Funcs{
+				UpdateFunc: func(e event.UpdateEvent) bool {
+					oldDevice := e.ObjectOld.(*v1alpha1.Device)
+					newDevice := e.ObjectNew.(*v1alpha1.Device)
+					// Only trigger when Paused spec field changes.
+					return !equality.Semantic.DeepEqual(oldDevice.Spec.Paused, newDevice.Spec.Paused)
+				},
+				GenericFunc: func(e event.GenericEvent) bool {
+					return false
+				},
+			}),
+		).
+		Complete(r)
 }
 
 // scope holds the different objects that are read and used during the reconcile.
@@ -315,6 +334,39 @@ func (r *BannerReconciler) finalize(ctx context.Context, s *bannerScope) (reterr
 	})
 }
 
+// deviceToBanners is a [handler.MapFunc] to be used to enqueue requests for reconciliation
+// for Banners when their referenced Device's Paused spec field changes.
+func (r *BannerReconciler) deviceToBanners(ctx context.Context, obj client.Object) []ctrl.Request {
+	device, ok := obj.(*v1alpha1.Device)
+	if !ok {
+		panic(fmt.Sprintf("Expected a Device but got a %T", obj))
+	}
+
+	log := ctrl.LoggerFrom(ctx, "Device", klog.KObj(device))
+
+	list := new(v1alpha1.BannerList)
+	if err := r.List(ctx, list,
+		client.InNamespace(device.Namespace),
+		client.MatchingLabels{v1alpha1.DeviceLabel: device.Name},
+	); err != nil {
+		log.Error(err, "Failed to list Banners")
+		return nil
+	}
+
+	requests := make([]ctrl.Request, 0, len(list.Items))
+	for _, i := range list.Items {
+		log.Info("Enqueuing Banner for reconciliation", "Banner", klog.KObj(&i))
+		requests = append(requests, ctrl.Request{
+			NamespacedName: client.ObjectKey{
+				Name:      i.Name,
+				Namespace: i.Namespace,
+			},
+		})
+	}
+
+	return requests
+}
+
 // secretToBanner is a [handler.MapFunc] to be used to enqueue requests for reconciliation
 // for a Banner to update when one of its referenced Secrets gets updated.
 func (r *BannerReconciler) secretToBanner(ctx context.Context, obj client.Object) []ctrl.Request {