🐛 Return errors from HasKubeadmConfig instead of swallowing them

[mrueg]

What this PR does / why we need it:

HasKubeadmConfig discarded every error returned by the API server and reported it as "the cluster does not have a kubeadm-config ConfigMap":

err := w.Client.Get(ctx, key, &corev1.ConfigMap{})
// TODO: Consider if this should only return false if the error is IsNotFound.
// TODO: Consider adding a third state of 'unknown' when there is an error retrieving the config map.
return err == nil, nil

A request timeout, an RBAC denial or a transient workload cluster apiserver outage was therefore indistinguishable from the ConfigMap genuinely being absent.

Both callers, in controlplane/kubeadm/reconcilers/kubeadmcontrolplane/status.go (in updateV1Beta1Status and updateStatus), do check the returned error:

hasKubeadmConfig, err := workloadCluster.HasKubeadmConfig(ctx)
if err != nil {
    return err
}

Since the error was always nil, those checks could never fire.

The practical effect is that a transient failure to reach the workload cluster made KCP conclude the control plane was not initialized, so it left status.initialization.controlPlaneInitialized and the Available condition unset and waited for the next resync instead of surfacing the failure and retrying. The error was also invisible to operators, since it was neither returned nor logged.

This addresses the first of the two pre-existing TODOs on that function. The second one, about introducing a third "unknown" state, is intentionally left alone as it would be an API change for WorkloadCluster.

Changes:

• HasKubeadmConfig now maps only NotFound to false; any other error is returned to the caller, which makes the existing error handling in both callers effective.
• Adds a test case covering a non-NotFound error, injected with interceptor.NewClient. The expectErr field already present in the test table was previously unused, so no case exercised the error path.

Which issue(s) this PR fixes:

Additional context:

Verified that the new test case fails against the current implementation on main and passes with the change, so it genuinely covers the fixed behaviour. make lint and the full ./controlplane/kubeadm/... suite pass.

/area control-plane

[linux-foundation-easycla]

The committers listed above are authorized under a signed CLA.

• ✅ login: mrueg / name: Manuel Rüger (6e53179)

[kubernetes-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign justinsb for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[sbueringer]

Same comment as here: #13960

What is the issue with this code that we are suddenly getting PRs to change it?
I think it has been working exactly as is without issues for years

Please also consider https://www.kubernetes.dev/docs/guide/pull-requests/#ai-guidance