Use tenancy as filter in ownerReference test

cmd/clusterctl/client/cluster/ownergraph.go

@@ -20,9 +20,6 @@ import (
 	"github.com/pkg/errors"
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"sigs.k8s.io/controller-runtime/pkg/client"
-
-	clusterv1 "sigs.k8s.io/cluster-api/api/v1beta1"
 )
 
 // OwnerGraph contains a graph with all the objects considered by clusterctl move as nodes and the OwnerReference relationship
@@ -61,12 +58,8 @@ func GetOwnerGraph(namespace, kubeconfigPath string) (OwnerGraph, error) {
 
 	graph := newObjectGraph(p, invClient)
 
-	cl, err := p.NewClient()
-	if err != nil {
-		return OwnerGraph{}, errors.Wrap(err, "failed to create client for ownerGraph")
-	}
 	// Gets all the types defined by the CRDs installed by clusterctl plus the ConfigMap/Secret core types.
-	err = graph.getDiscoveryTypes()
+	err := graph.getDiscoveryTypes()
 	if err != nil {
 		return OwnerGraph{}, errors.Wrap(err, "failed to retrieve discovery types")
 	}
@@ -78,18 +71,8 @@ func GetOwnerGraph(namespace, kubeconfigPath string) (OwnerGraph, error) {
 		return OwnerGraph{}, errors.Wrap(err, "failed to discover the object graph")
 	}
 	owners := OwnerGraph{}
-	for _, v := range graph.uidToNode {
-		// The Discovery function returns all secrets in the Cluster namespace. Ensure a Secret that is not part of the
-		// Cluster is not added to the OwnerGraph.
-		if v.identity.Kind == "Secret" {
-			clusterSecret, err := isClusterSecret(v.identity, cl)
-			if err != nil {
-				return OwnerGraph{}, err
-			}
-			if !clusterSecret {
-				continue
-			}
-		}
+	// Using getMoveNodes here ensures only objects that are part of the Cluster are added to the OwnerGraph.
+	for _, v := range graph.getMoveNodes() {
 		n := OwnerGraphNode{Object: v.identity, Owners: []metav1.OwnerReference{}}
 		for owner, attributes := range v.owners {
 			n.Owners = append(n.Owners, nodeToOwnerRef(owner, attributes))
@@ -98,12 +81,3 @@ func GetOwnerGraph(namespace, kubeconfigPath string) (OwnerGraph, error) {
 	}
 	return owners, nil
 }
-
-// isClusterSecret checks whether a Secret is related to a CAPI Cluster by checking if the secret type is ClusterSecretType.
-func isClusterSecret(ref corev1.ObjectReference, c client.Client) (bool, error) {
-	s := &corev1.Secret{}
-	if err := c.Get(ctx, client.ObjectKey{Namespace: ref.Namespace, Name: ref.Name}, s); err != nil {
-		return false, err
-	}
-	return s.Type == clusterv1.ClusterSecretType, nil
-}

test/framework/ownerreference_helpers.go

@@ -177,7 +177,7 @@ var KubernetesReferenceAssertions = map[string]func([]metav1.OwnerReference) err
 	},
 	configMapKind: func(owners []metav1.OwnerReference) error {
 		// The only configMaps considered here are those owned by a ClusterResourceSet.
-		return hasOneOfExactOwnersByGVK(owners, []schema.GroupVersionKind{clusterResourceSetGVK}, []schema.GroupVersionKind{})
+		return hasOneOfExactOwnersByGVK(owners, []schema.GroupVersionKind{clusterResourceSetGVK})
 	},
 }