Triggering GrandPa Controller Reconcile on Indirect GrandSon Resource Changes in Kubernetes

Learn how to set up Kubernetes controller-runtime to trigger a parent controller reconcile when an indirectly owned child resource changes, using custom Watches and owner reference mapping.
---
This video is based on the question https://stackoverflow.com/q/79475508/ asked by the user 'guettli' ( https://stackoverflow.com/u/633961/ ) and on the answer https://stackoverflow.com/a/79497058/ provided by the user 'Halo' ( https://stackoverflow.com/u/16752210/ ) at 'Stack Overflow' website. Thanks to these great users and Stackexchange community for their contributions.

Visit these links for original content and any more details, such as alternate solutions, latest updates/developments on topic, comments, revision history etc. For example, the original title of the Question was: controller runtime: GrandPa, Son, GrandSon and setting OwnerReferences

Also, Content (except music) licensed under CC BY-SA https://meta.stackexchange.com/help/l...
The original Question post is licensed under the 'CC BY-SA 4.0' ( https://creativecommons.org/licenses/... ) license, and the original Answer post is licensed under the 'CC BY-SA 4.0' ( https://creativecommons.org/licenses/... ) license.

If anything seems off to you, please feel free to drop me a comment under this video.
---
Introduction

In Kubernetes controller development using controller-runtime, it is common to set up ownership relations so that changes in child resources trigger the reconcile loop of their owners. But what happens when ownership is indirect, spanning multiple generations of Custom Resources?

Consider three Custom Resource Definitions (CRDs): GrandPa, Son, and GrandSon. Each has its own controller in separate deployments:

The GrandPa controller creates a Son resource and sets itself as owner.

The Son controller creates a GrandSon resource and sets itself as owner.

The challenge: How to trigger GrandPa's Reconcile() function when a GrandSon changes, given GrandPa is not a direct owner?

Problem Breakdown

GrandPa directly owns Son

Son directly owns GrandSon

GrandPa's controller watches Son but not GrandSon

controller-runtime .Owns() only watches directly owned resources

Hence, changes to GrandSon do not trigger GrandPa reconciles automatically.

Solution Overview

You can solve this by using the Watches() feature in controller-runtime with a custom mapping function:

Watch GrandSon resources explicitly.

When a GrandSon event occurs, manually:

Read the GrandSon's owner reference to find the Son resource.

Fetch the Son object to read its owner reference to find the GrandPa resource.

Enqueue a reconcile request for the corresponding GrandPa.

This way, the GrandPa controller reacts to changes in the indirectly owned GrandSon.

Implementing the Watch with Owner Reference Mapping

Here’s an example snippet using controller-runtime:

[[See Video to Reveal this Text or Code Snippet]]

Key Points

Direct .Owns() works only for immediate owner-child relationships.

Use Watches() with custom mapping functions for multi-level ownership.

Owner references are your source of truth to chain from GrandSon back to GrandPa.

This pattern lets GrandPa controller respond to deep resource changes without modifying other controllers.

Conclusion

By leveraging Watches() and owner reference traversal, you can elegantly trigger reconciles in the GrandPa controller on changes to indirectly owned GrandSon resources. This pattern is essential in complex operator architectures with hierarchies of custom resources.

Feel free to adapt this method in any multi-tier controller ownership scenario in Kubernetes.