Feat: add observedGeneration; simplify conditions

[r3v5]

Summary

Implements RHAIENG-4938: simplify AgentRuntime status by adding observedGeneration and removing redundant fields/conditions.

• Add status.observedGeneration — tracks the most recent metadata.generation processed by the controller
• Remove status.phase (Pending/Active/Error) — redundant with Ready condition
• Remove CardFetched and SkillsDiscovered conditions — card/skill status is observable via status.card and status.linkedSkills fields
• Move TargetResolved=True to after applyWorkloadConfig succeeds (not just after resolveTargetRef)
• Replace Phase printer column with Ready — kubectl get agentruntime now shows NAME TYPE TARGET READY AGE

Final status shape

status:
  observedGeneration: <int64>
  configuredPods: <int32>
  card: ...
  linkedSkills: [...]
  conditions:
  - type: IstioMeshEnrolled   # from PR #403
  - type: ConfigResolved
  - type: TargetResolved
  - type: Ready

Deviation from ticket

ConfigResolved kept — ticket AC says "exactly two conditions" but PR #405 (config merge) depends on ConfigResolved. Keeping it avoids cross-PR conflicts. Can be removed in a follow-up once #405 merges. Jira comment posted noting this deviation.

IstioMeshEnrolled — added by PR #403 (merged into main). Not part of this PR, but appears in the conditions list after rebase. Three states: True/NamespaceLabeled, False/OptedOut, False/PatchFailed.

Test plan

• make test — all unit tests pass
• make test-e2e (AgentRuntime focus) — 8/8 specs pass
• Manual verification in Kind cluster (Podman) — all 7 ACs pass
• make manifests generate — no drift
• make lint — pre-existing warnings only

Manual Verification Results (Kind + Podman)

Click to expand full verification output

AC1: Printer columns show NAME, TYPE, TARGET, READY, AGE

kubectl get agentruntime -n ac-test

NAME           TYPE    TARGET        READY   AGE
test-missing   agent   nonexistent           28s
test-runtime   agent   test-agent    True    28s

PASS — Phase column gone, Ready column present.

AC2: status.observedGeneration == metadata.generation

kubectl get agentruntime test-runtime -n ac-test \
  -o jsonpath='generation={.metadata.generation} observedGeneration={.status.observedGeneration}'

generation=1 observedGeneration=1

PASS

AC3: status.phase removed

kubectl get agentruntime test-runtime -n ac-test -o jsonpath='{.status.phase}'
# (empty output)

PASS

AC4: Conditions present (TargetResolved, ConfigResolved, Ready)

kubectl get agentruntime test-runtime -n ac-test \
  -o jsonpath='{range .status.conditions[*]}{.type}={.status} reason={.reason}{"\n"}{end}'

IstioMeshEnrolled=True reason=NamespaceLabeled
ConfigResolved=True reason=ConfigResolved
TargetResolved=True reason=TargetFound
Ready=True reason=Configured

PASS — All 3 required conditions present. IstioMeshEnrolled is from PR #403 (merged into main), not from this PR.

AC5: CardFetched condition absent

kubectl get agentruntime test-runtime -n ac-test \
  -o jsonpath='{.status.conditions[?(@.type=="CardFetched")].type}'
# (empty output)

PASS

AC6: SkillsDiscovered condition absent

kubectl get agentruntime test-runtime -n ac-test \
  -o jsonpath='{.status.conditions[?(@.type=="SkillsDiscovered")].type}'
# (empty output)

PASS

AC7: Error case — missing target sets TargetResolved=False, no Phase

TargetResolved=False reason=TargetNotFound

kubectl get agentruntime test-missing -n ac-test -o jsonpath='{.status.phase}'
# (empty output)

PASS

Full status YAML (happy path)

status:
  conditions:
  - lastTransitionTime: "2026-06-09T12:49:06Z"
    message: Namespace ac-test enrolled in Istio ambient mesh
    observedGeneration: 1
    reason: NamespaceLabeled
    status: "True"
    type: IstioMeshEnrolled
  - lastTransitionTime: "2026-06-09T12:49:06Z"
    message: Configuration resolved successfully
    observedGeneration: 1
    reason: ConfigResolved
    status: "True"
    type: ConfigResolved
  - lastTransitionTime: "2026-06-09T12:49:06Z"
    message: Deployment test-agent resolved
    observedGeneration: 1
    reason: TargetFound
    status: "True"
    type: TargetResolved
  - lastTransitionTime: "2026-06-09T12:49:06Z"
    message: Workload test-agent configured with config-hash 57de3ab75a7e
    observedGeneration: 1
    reason: Configured
    status: "True"
    type: Ready
  configuredPods: 1
  observedGeneration: 1

Summary

AC	Description	Result
AC1	Printer columns: NAME TYPE TARGET READY AGE	PASS
AC2	observedGeneration == generation	PASS
AC3	status.phase removed	PASS
AC4	3 conditions: TargetResolved, ConfigResolved, Ready	PASS
AC5	CardFetched condition absent	PASS
AC6	SkillsDiscovered condition absent	PASS
AC7	Error case: TargetResolved=False, no Phase	PASS

[pdettori]

LGTM — clean status simplification. All 15/16 checks pass; the failing E2E (should populate linkedSkills from annotation) is a pre-existing flaky test that also fails on main (run 27172754436, Jun 8) due to missing authbridge-config data in the skill-discovery namespace.

Two minor suggestions below (non-blocking).

[pdettori]

nit: ~180 lines of CardFetched/SkillsDiscovered tests correctly removed. Consider adding a small test that verifies Ready=False is set when applyWorkloadConfig returns an error (the ConfigApplyError path) — this error path is currently untested and interacts with the TargetResolved relocation above.

[r3v5]

Addressing review feedback from @pdettori

1. TargetResolved semantics (controller.go:243)

Agreed — moved TargetResolved=True back to immediately after resolveTargetRef succeeds. Cleaner semantic: "I found the deployment." The Ready condition gates the full success path.

Fixed in 6be4120.

2. ConfigApplyError test coverage (controller_test.go:235)

Good point. The ConfigApplyError path is mechanically identical to the other error paths (TargetNotFound, ConfigHashError) — all three call setCondition(Ready=False, ...) + Status().Update(). The TargetNotFound path is already tested end-to-end. Triggering ConfigApplyError specifically in envtest requires simulating a workload Update failure (RBAC, conflict) which would need a mock client — out of scope for this PR but worth a follow-up if we add client mocking infrastructure.

[pdettori]

@r3v5 CI has been fixed - please rebase from upstream main / resolve conflicts and force push so we can check now with full CI