fix: sharded Warehouse cross-controller access (#2819)

Signed-off-by: Hidde Beydals <hidde@hhh.computer>
(cherry picked from commit 7490ff2)

cmd/controlplane/controller.go

@@ -194,10 +194,12 @@ func (o *controllerOptions) setupKargoManager(
 				},
 			},
 			Cache: cache.Options{
-				// Ensure that the controller only watches resources in the shard
-				// it is responsible for.
+				// When Kargo is sharded, we expect the controller to only handle
+				// resources in the shard it is responsible for. This is enforced
+				// by the following label selectors on the informers, EXCEPT for
+				// Warehouses — which should be accessible by all controllers in
+				// a sharded setup, but handled by only one controller at a time.
 				ByObject: map[client.Object]cache.ByObject{
-					&kargoapi.Warehouse{}: {Label: shardSelector},
 					&kargoapi.Stage{}:     {Label: shardSelector},
 					&kargoapi.Promotion{}: {Label: shardSelector},
 				},
@@ -311,6 +313,7 @@ func (o *controllerOptions) setupReconcilers(
 	if err := warehouses.SetupReconcilerWithManager(
 		kargoMgr,
 		credentialsDB,
+		o.ShardName,
 	); err != nil {
 		return fmt.Errorf("error setting up Warehouses reconciler: %w", err)
 	}

internal/controller/warehouses/warehouses.go

@@ -69,7 +69,13 @@ type reconciler struct {
 func SetupReconcilerWithManager(
 	mgr manager.Manager,
 	credentialsDB credentials.Database,
+	shardName string,
 ) error {
+	shardPredicate, err := controller.GetShardPredicate(shardName)
+	if err != nil {
+		return fmt.Errorf("error creating shard selector predicate: %w", err)
+	}
+
 	if err := ctrl.NewControllerManagedBy(mgr).
 		For(&kargoapi.Warehouse{}).
 		WithEventFilter(
@@ -86,6 +92,7 @@ func SetupReconcilerWithManager(
 				kargo.RefreshRequested{},
 			),
 		).
+		WithEventFilter(shardPredicate).
 		WithOptions(controller.CommonOptions()).
 		Complete(newReconciler(mgr.GetClient(), credentialsDB)); err != nil {
 		return fmt.Errorf("error building Warehouse reconciler: %w", err)