Add controller-reference subject owner adapter

[nadaverell]

Status and program context

Ready for review as an independent foundation. No production consumer uses this resolver yet.

The GPU, batch, and AI/ML breadth work exposed a shared prerequisite: Radar cannot compose controller-generated resources across Topology, Applications, Issues, Timeline, and MCP while owner identity is only Kind + namespace + name. This PR is the P0.1c subject-parity foundation for resolving Kubernetes controller ownership with exact API-group identity. Controller-native contexts and drilldowns such as JobSet are separate verticals.

Summary

• add a pure, group-aware ControllerOwnerResolver over injected exact-resource lookup and exact group/kind scope resolution
• follow only Kubernetes controller references, preserving authoritative group, kind, and owner name while deriving namespace from known resource scope
• fail closed when a namespaced child's controller scope is unknown instead of fabricating a namespaced or cluster-scoped identity
• add a parity corpus for Deployment, CronJob, Rollout, JobSet, RayService, CloudNativePG, Strimzi, and Crossplane ownership chains
• pin partial-cache behavior: a child may identify an unobserved controller when its scope is known, but the walk stops there

Dependency and merge map

• This PR targets main and is independently mergeable.
• Rebased onto current main. Everything this PR referenced has since merged (#1558, #1559, #1560, the JobSet stack), along with #1868, which moved identity helpers into pkg/resourceid. The resolver now uses resourceid.GroupFromAPIVersion.
• #1560 is separate exact-resource, Topology, and Applications identity work. It does not consume or wire this owner resolver; reviewers should not infer that Add controller-reference subject owner adapter #1557 is production-connected through Make topology and application identity API-group-aware #1560.
• It does not block the JobSet stack #1552 -> #1562 -> #1561.
• A later production-adapter PR must wire the scope callback to group-aware API discovery and migrate consumers one at a time. This PR deliberately does not make that global switch.

Review focus

• controller references only: never follow non-controller owner references or broad topology management edges
• exact API group and Kind preservation across multi-hop chains
• scope resolution for namespaced children whose controller may be namespaced or cluster-scoped
• fail-closed behavior when scope is unknown, and bounded behavior when an identified parent is not cached
• parity fixtures for existing integrations, not only the new GPU ecosystem

Deliberate boundaries

This PR does not switch a production consumer, expand operator allowlists, follow broad topology management edges, or aggregate root-level Issues. The Strimzi fixture intentionally stops at StrimziPodSet: current Strimzi creates the KafkaNodePool reference with controller=false, so following it would violate the contract.

Scope and terminal hardening

• A cluster-scoped child whose controller owner is known to be namespaced resolves to no parent. The garbage collector treats that owner as unresolvable.
• Only the core-group Node is the static-pod terminal. A custom Node kind from another API group collapses like any other controller.

Known gaps for the production-adapter PR

• Owner UID is not validated. Ref carries no UID. If a Pod still references deleted Job A and a new Job with the same name exists, the walk follows the new Job to that Job's root. The adapter needs to carry the owner UID (resourceid.OwnerReference keeps it) and check it at each hop.
• Operator anchor. Used as both OwnerResolver and DefaultOperatorRoots.Owners, this full controller walk goes past the operator CR before the hook runs. CNPG and similar subjects then anchor as owner_collapsed, never operator_cr. The first consumer must decide where the operator boundary sits and test the whole Subject, including Anchor.
• ScopeForKind still classifies by Kind alone.

Source revalidation

• Kubernetes ownership scope rules: https://kubernetes.io/docs/concepts/overview/working-with-objects/owners-dependents/#owners-and-dependents
• JobSet v0.12.0 makes JobSet the Job controller: https://github.com/kubernetes-sigs/jobset/blob/v0.12.0/pkg/controllers/jobset_controller.go#L740
• KubeRay v1.7.0 makes RayService the RayCluster controller and RayCluster the Pod controller: https://github.com/ray-project/kuberay/blob/v1.7.0/ray-operator/controllers/ray/rayservice_controller.go#L1544 and https://github.com/ray-project/kuberay/blob/v1.7.0/ray-operator/controllers/ray/raycluster_controller.go#L1753
• CloudNativePG makes Cluster the Pod controller: https://github.com/cloudnative-pg/cloudnative-pg/blob/8179beb0592398b9ae3221d8488c815b73e94b2c/internal/controller/cluster_create.go#L1495
• Strimzi marks KafkaNodePool as a non-controller owner: https://github.com/strimzi/strimzi-kafka-operator/blob/035bdf3026a477d3ffe017b8bc0640e9779961cc/cluster-operator/src/main/java/io/strimzi/operator/cluster/model/nodepools/NodePoolUtils.java#L72
• Crossplane composed-resource controller references retain the author-defined XR group: https://github.com/crossplane/crossplane/blob/0e4f8c1d78ef7a4b1cb2d95d92cafa9a905c2280/internal/controller/apiextensions/composite/composition_render.go#L114-L116

Verification

• (cd pkg && go test ./subject ./resourceid)
• go build ./... and (cd pkg && go build ./...)
• go test ./internal/cloudinstall
• git diff --check
• Mutation check: reverting either new guard fails its regression test

Visual testing was skipped because this has no rendered UI path or production consumer change.

Part of RAD-418.

---

Note

Low Risk
New isolated resolver with tests only; the small ResolveSubject Node guard change is unlikely to affect current callers that mostly use overlay resolution, not owner walks.

Overview
Introduces ControllerOwnerResolver, a Tier-1 OwnerResolver that walks only ownerReferences with controller=true via injected object lookup. Parent refs keep the exact API group (from GroupFromAPIVersion), kind, and owner name; namespace is inferred from an IsNamespaced(group, kind) callback. For namespaced children, resolution fails closed when owner scope is unknown; cluster-scoped children reject a known namespaced controller.

Adds a broad parity test corpus (Deployment, CronJob, Rollout, JobSet, Ray, CNPG, Strimzi, Crossplane) covering multi-hop ResolveSubject collapse, partial cache (stop at unobserved parent), and edge cases (non-controller owners, incomplete refs, core vs custom Node).

ResolveSubject now treats Node as a terminal anchor only for the core API group (Group == ""), so a CRD kind named Node can still collapse up the controller chain. Package docs and the OwnerResolver contract are updated to describe object-backed vs heuristic behavior. No production wiring in this PR—the resolver is foundation-only.

^{Reviewed by Cursor Bugbot for commit 35754e0. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit be830d5. Configure here.}